3 SoftHSM is part of the OpenDNSSEC project. Read more at www.opendnssec.org.
5 [![Travis Build Status](https://api.travis-ci.org/opendnssec/SoftHSMv2.png)](https://travis-ci.org/opendnssec/SoftHSMv2)
6 [![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/github/opendnssec/SoftHSMv2?svg=true)](https://ci.appveyor.com/project/opendnssec/softhsmv2)
10 OpenDNSSEC handles and stores its cryptographic keys via the PKCS#11 interface.
11 This interface specifies how to communicate with cryptographic devices such as
12 HSM:s (Hardware Security Modules) and smart cards. The purpose of these devices
13 is, among others, to generate cryptographic keys and sign information without
14 revealing private-key material to the outside world. They are often designed to
15 perform well on these specific tasks compared to ordinary processes in a normal
18 A potential problem with the use of the PKCS#11 interface is that it might
19 limit the wide spread use of OpenDNSSEC, since a potential user might not be
20 willing to invest in a new hardware device. To counter this effect, OpenDNSSEC
21 is providing a software implementation of a generic cryptographic device with a
22 PKCS#11 interface, the SoftHSM. SoftHSM is designed to meet the requirements of
23 OpenDNSSEC, but can also work together with other cryptographic products
24 because of the PKCS#11 interface.
28 - Rickard Bellgrim (Knowit Secure AB, www.knowitgroup.com)
29 - Francis Dupont (ISC, www.isc.org)
30 - René Post (XPT Software and Consulting, www.xpt.nl)
31 - Roland van Rijswijk (SURFnet bv, www.surfnet.nl)
35 SoftHSM depends on a cryptographic library, Botan or OpenSSL.
36 Minimum required versions:
41 If you are using Botan, make sure that it has support for GNU MP (--with-gnump).
42 This will improve the performance when doing public key operations.
44 The GNU Autotools are also required for building the software.
46 There is a migration tool for converting token databases from SoftHSMv1 into
47 the new type of tokens. If this tool is built, then SQLite3 is required (>=
54 Configure the installation/compilation scripts:
61 --disable-non-paged-memory
62 Disable non-paged memory for secure storage
64 --disable-ecc Disable support for ECC (default enabled)
65 --disable-gost Disable support for GOST (default enabled)
66 --disable-visibility Disable hidden visibilty link mode [enabled]
67 --with-crypto-backend Select crypto backend (openssl|botan)
68 --with-openssl=PATH Specify prefix of path of OpenSSL
69 --with-botan=PATH Specify prefix of path of Botan
70 --with-migrate Build the migration tool. Used when migrating
71 a SoftHSM v1 token database. Requires SQLite3
72 --with-objectstore-backend-db
73 Build with database object store (SQLite3)
74 --with-sqlite3=PATH Specify prefix of path of SQLite3
75 --disable-p11-kit Disable p11-kit integration (default enabled)
76 --with-p11-kit=PATH Specify install path of the p11-kit module, will
77 override path given by pkg-config
86 Compile the source code using the following command:
92 Install the library using the follow command:
98 The default location of the config file is /etc/softhsm2.conf. This location
99 can be change by setting the environment variable.
101 export SOFTHSM2_CONF=/home/user/config.file
103 Details on the configuration can be found in "man softhsm2.conf".
105 Create the token directory you defined in your config file:
109 ### Initialize Tokens
111 Use either softhsm2-util or the PKCS#11 interface. The SO PIN can e.g. be used
112 to re-initialize the token and the user PIN is handed out to the application so
113 it can interact with the token.
115 softhsm2-util --init-token --slot 0 --label "My token 1"
117 Type in SO PIN and user PIN. Once a token has been initialized, more slots will
118 be added automatically with a new uninitialized token.
120 Initialized tokens will be reassigned to another slot (based on the token
121 serial number). It is recommended to find and interact with the token by
122 searching for the token label or serial number in the slot list / token info.
126 Link to this library and use the PKCS#11 interface.
131 All of the tokens and their objects are stored in the location given by
132 softhsm2.conf. Backup can thus be done as a regular file copy.
137 Log information is sent to syslog or the Windows event log and the log
138 level is set in the configuration file. Each log event is prepended with
139 the source file name and line number.
142 ## Building from the repository
144 If the code is downloaded directly from the code repository, you have to
145 prepare the configuration scripts before continuing with the real README.
147 1. You need to install automake, autoconf, libtool, etc.
148 2. Run the command 'sh autogen.sh'
149 3. Continue reading this README.