Project: Parsec (Provisioning / Security & Compliance)
File: CHANGELOG.md

Fixed bugs: e2e\_tests: Ignore different key test for RSA in pkcs11 () Merged pull requests: Minor CI pipeline fixes () Merged pull requests: Revert "Test patch for cross-compiler docker image" () Use v1.0.0 release of trusted services () Adds support to build and test the cross-compiler docker images. () Minor fixes () Merged pull requests: tpm/tests: Ignore test\root\key\_check case () Implemented enhancements: Set up build to track dependency mismatches Fixed bugs: e2e\_tests/stress.rs: Add a workaround for spurious test failures () Security fixes: TPM Provider: Check root key's name () Closed issues: parsec-cli-tests.sh error: The CSR does not contain the serialNumber field of the Distinguished Name Migrate away from using users crate Parsec Quickstart - Docker: Pull access denied for parallaxsecond/parsec-quickstart, repository does not exist Vulnerability in SQLite Merged pull requests: dependency\cross\matcher: Fix typo \(missing comma\) () structopt: Migrate to clap () Cargo.toml: Bump tss-esapi to 7.5.0 () nightly/audit: Temporary ignore RUSTSEC-2024-0006 () Use infallible conversion into instead of try\_into () .cargo/config.toml: remove () Dependency mismatcher Comparison option () dependency\cross\matcher job: Move to PR runs and minor refactoring () Cargo.lock: Update rustix and bitflags dependencies to latest version () cargo-check: Run with both stable and MSRV Compilers () ci.yml: Trigger docker image creation only on workflow\_dispatch () ci.yml,deny.toml: Setup license testing () Cargo.toml: Specify rust-version=1.66.0 () Track and test dependencies' 'next' branch () Add dependency cross matching () e2e\tests/mangled\ping: Fix socket path () ci/coverage: Fix cargo-tarpaulin to its locked version () Merged pull requests: e2e\tests/wrong\permitted\_algorithm: Change used sha for hw compatibi () Closed issues: Update cryptoki version to `0.4.1` `ansi_term` is unmaintained Merged pull requests: Bump psa-crypto and interface crates () Update toml, env\_logger and bindgen crates () Bump various crates () Update picky crates () Cargo.toml: Remove uuid crate () Bump sd-notify to 0.4.1 () fuzz: Bump bumpalo to 3.14.0 () Update the tss-esapi crate to version 7.3.0 () Fix cargo-tarpaulin version to 0.26.1 () Add a Security Vulnerability Reporting section in the README () Update maintainers list () ci: Fix coverage builds, nightly issues () Update cryptoki and cryptoki-sys crates () Use arrays instead of vec! when possible () Make wrong\permitted\algorithm test use a non-deprecated Hash () Fix coverage builds for different providers () Update MSRV to Rust 1.66.0 () Bump ASN1 crates dependencies () Minor fixes to changelog () Upgrade proc-macro2 package () Update CONTRIBUTORS.md () Disable the optional features for the 'structopt' crate () Upgrade enumflags2 crate () Remove unmaintained 'users' crate () Fix compilation issues () Bump base64 dependency to 0.21.0 () Closed issues: Parsec 1.1 fails to build with meta-security master branch Closed issues: Parsec fails to compile for arm32 Merged pull requests: Update crates () Update rusqlite to fix security issue () Update MSRV to 1.58 () Remove dependency on crate "version" () Update TPM TCTI configuration docs () Add support for a Quickstart Docker image () Update to remove const\_err () Fix Clippy warnings for rustc version 1.65 () Bump sd-notify to 0.3.0 () Merged pull requests: Update change log for release candidate 1.1.0-rc2 () Release candidate prep

rc2 () Implemented enhancements: Update PKCS11 dependency Allow binary PIN values for PKCS11 providers Implement get\_random in the PKCS11 provider Implement get\_random in TPM provider Create script for Quickstart package Recognise a PKCS11 hardware token with its serial number instead of slot number Implement configurable exclusion of deprecated primitives Fixed bugs: RSA padding oracle issue PKCS11 provider serial\_number configuration Export of public EC key fails with PKCS\#11 back-end on NXP Layerscape Wrong permissions on KIM files Send back PsaErrorInvalidPadding when needed () Security fixes: Update Spiffe dependency Closed issues: Add key persistence tests for TS provider Create stability tests for SQLite KIM Change default socket path for E2E tests Merged pull requests: Update Change log and service version no. () Update maintainers list () Fix spiffy issue () Add sqlite stability tests () Feature/119 implement configurable exclusion of deprecated primitives () Feature/603 allow binary pin values for pkcs11 () Add `Eq` to the types with `PartialEq` () build and share docker image across jobs () Kim file permissions () Testing/568 add key persistence tests for ts provider () Fix problem reported by Clippy \(rust 1.62\) () Validate hash sign operation before execution. () Fix Hugues' email address () Compare trimmed token serial numbers \(PKCS11 provider\) () Added some context to error messages. () Implement get\_random in the PKCS11 provider () Add a script to create the Quickstart package () Change default socket path for E2E tests () Fix `cargo-audit` TOML config () Recognise a PKCS11 hardware token with its serial number instead of slot number () Bump version of cryptoki () Fix issue \#599 - allow EC\_POINT public key data to omit ASN.1 structure wrapping () Add generate random support into TPM provider () Security fixes: RUSTSEC-2022-0013 Merged pull requests: Update Changelog file to include 1.0.0 () Fixed bugs: Cargo audit failing Merged pull requests: Prepare for Release Candidate 3 () Implemented enhancements: Updates for Release Candidate 2 () Closed issues: Update the Parsec Book to include SQLiteKeyInfoManager Implemented enhancements: `parsec.service` hardening Implement `CryptoCanDo` for the Trusted Services and Mbed Crypto providers Implement CryptoCanDo for TPM provider Refactor the PKCS11 CryptoCanDo implementation Implement ActivateCredential key attestation Making the SQLiteKIM the default Create a new KeyInfoManager based on SQLite Add support for other cryptographic services in the Trusted Service provider Add system emulation tests for TS provider Add support for importing ECC public key in the TPM provider Add asymmetric encryption to TS provider () Change dependency revision for TSS crate () Add systemd hardening options () Make SQLite KIM default () Feature sqlite kim () Add error handling to ActivateCredential () Add ActivateCredential tests and fixes () Activate credential () Expand support for importing public keys for TPM () \ () Fixed bugs: Disable test from old E2E suite Errors in validating ECC key bits in PKCS11 provider UnixDomainSocket connection returns error from server Fuzz Testing & Nightly Cargo udeps are failing due to prost-derive TPM Provider does not persist generated keys accross reboot Issue with PKCS11 backend with Nitrokey HSM Skip flakey test () Fix codecov build () Fix handling of `bits` in PKCS11 imports () Closed issues: Align with stable TSS crate Stable 0.8.1 release depends on tss-esapi alpha Create E2E tests for SQLite KIM Switch to dynamic key names in tests Add capabilities discovery operations Merged pull requests: Update Changelog and service version

() Bump bindgen dependency version () Bump SQLite dependency () \ () Implement can-do-crypto for TS and mbed-crypto providers () Add error message if submodule not initialised () \ () Add clippy and fmt checkt to e2e\_tests () Re-factor e2e tests to use common key attributes functions () Merge can-do-crypto branch into main () Merge main branch changes into can-do crypto () Jn9e9/issue453 () e2e CanDoCrypto tests for Hashes, ECC curves and Crypto algorithms () Implement CanDoCrypto trait and use it for PKCS11 and TPM providers () Use ec\_params for can-do-crypto checks instead of hard-coded values () Small refactor of PKCS11 CryptoCanDo () Merge origin/main into can-do-crypto () Increase the MSRV to 1.53.0 () Update the CHANGELOG file with 0.8.1 () Added the CanDoCrypto operation as well as fixing some of the other test scripts. () Implemented enhancements: Add Unit Tests to SQLiteKeyInfoManager Change KeyTriple to Include Auth ID, Provider Name & Provider UUID Update provider to use new version fo TransKeyCtx () Fixed bugs: Decide and implement a new serialization format for KeyInfo Memory leak in TS context Disable broken workflows () Closed issues: Make a Parsec Ockam Vault: investigation issue Add Basic SQLiteKeyInfoManager Storage/Retrieval Functionality Add config tests for multiple provider names Merged pull requests: Bump version for release () Use as\_ptr for TS service name () Lower Hash algorithm () Update CHANGELOG () Implemented enhancements: Add Provider Name Config Option Add PKCS11 provider export-attributes switch Refactor the all-providers workflow Adjust linking for TS provider Allow providers to be optional or conditional depending on platform feature availability Add cross-compilation tests for the TPM provider Make the slot\_number field optional Design workflow and associated APIs for key attestation in Parsec Implement error handling for TS caller errors Add release-build tests to CI Add the possibility of changing key store location of Mbed Crypto provider Add TS provider to all-providers () Adjust TS provider linking () Add cargo-audit config () Update dependency on Trusted Services () Add import and export support for ECC for PKCS11 () Add a SPIFFE based authenticator () Add ECC functionality to PKCS11 prov () Enable coverage testing for TS provider () Create SECURITY.md () Add TPM provider cross-compilation () Added Option\<Slot\> to PKCS 11 Provider constructor () Fixed bugs: If a response is an error, log it before sending it Fix ingress/egress trace logs Make `KeyInfo` a private type Unable to build 0.7.2 for i686 \(and ppc64/ppc64le\) Unable to build 0.7.2 for armv7 Document clearly how Mbed Crypto provider keys are stored Fix code coverage reports () Modify the git submodule command () Do not login if no user pin was entered () Fix git command and use Arm machine () Fix CircleCI config format. () Add submodule initialisation to CircleCI () Make cross-compilation run on release version () Bump picky crate versions () Remove the TS coverage computation () Fix nightly workflow () Fix ServiceConfig import in fuzz\_service () Fix Contributing link () Fix ownership of ibmtpm folder () Fix CircleCI config () Implement a few fixes () Security fixes: Resurrect fuzz testing framework Set up Github security policy Investigate testing of Cryptoauthlib provider rust-spiffe: make sure that the claims returned by the validation operation are as expected rust-spiffe: provide a local validation of the JWT-SVID Revive the fuzz testing framework () Closed issues: NXP PKCS\#11 Parsec integration testing. Split the build tests on a different CI workflow Support ECC signing keys in

PKCS\#11 provider Stability: Communication with backends Adopt CII Best Practices Badge from the LF Unable to build parsec 0.7.2 with rust 1.43.1. Parsec 0.6.0 builds fine. Stability: Build toolchain Stability: Environment variables Stability: Dynamic libraries dependencies Stability: systemd communication Stability: OS signals Stability: Persistent state \(key mappings\) Stability: Configuration file Stability: CLI invocation Stability: Authenticators Stability: Communication with clients \(listeners endpoint\) Stability: Communication with clients \(operation contracts\) Stability: Communication with clients \(requests/responses\) Setup environment stability test Archive for 0.7.0 contains .cargo/ folder Add more Fixed Common header tests Merged pull requests: Switch imports to crates.io () Add the Class attribute when generating key pairs () Add tests checking absence of slot\_number () Split out the all-providers cargo check into its own CI job. () Make KeyInfo a private type Fix \#400 () Added psa\export\key & psa\generate\random to TS Provider () Add a allow\_export flag to restrict exporting () Added missing ingress logs to providers. \#416 () \#417 Added additional error logging to front end handle\_request function. () Update the TS revision used () Add a way to allow providers to fail instantiation () Randomly select the shutdown signal () Execute e2e tests with an old version of client () \ () Move CLI log into its own file () Add various tests checking contracts () Isolate config logic and add e2e config tests () \ () \ () Replace persistence tests with key mappings tests () Add Codecov and cii badges () CryptoAuthentication Library provider - support for PsaSignHash and PsaVerifyHash operations. () Make it compile for Rust 1.43.1 () PSA\IMPORT\KEY introduction. () CryptoAuthLib provider testability improvements: () Add CircleCI config () Import newest versions of cryptoki and tss-esapi () Update CHANGELOG () Implementation of PsaGenerateKey and PsaDestroyKey operations () Merged pull requests: Prepare for 0.7.2 () Closed issues: Investigate calculating test coverage Merged pull requests: Update tss-esapi dependency () Add quickstart reference () Update CHANGELOG () Implemented enhancements: Stop the duplication of key ID conversions Add key management operations support Enable TS context initialization Create the Trusted Service bindings Improve import key support in TPM provider Investigate and define the work required for SPIFFE-based client identity management Make existence of key info consistent with existence of key Extract Docker images into own repo Add version structures for better handling of versions Rearrange modules for a more structured feel Change CI to use published Docker image () Improve coverage script () Add coverage checking in nightly run () Trusted service provider () Add admin configuration () Add new parsec provider using ATECCx08 cryptochip via CryptoAuthentication Library () Improve error handling in builder () Add Changelog file \(\#278\) () Remove PKCS11 single thread

\(\#264\) () Fixed bugs: Move the spiffe related features in its own branch Resolve default implementation issue for `list_keys` in `Provide` ListKeys should only be callable on the Core provider Service should not start if some components weren't built successfully No changelog for the releases PKCS11 multi-threading Fix ImportKey to allow importing private key PKCS 11 provider stress tests sometimes fail Update docker registry for TPM2 images () Run the Codecov script outside container () Fix code coverage docker command () Remove the spiffe-based authenticator () Security fixes: Add a test for admin operations Implement admin logic Investigate admin role and admin-level operations Add failure-counter mechanism Closed issues: Implement ListClients and DeleteClient in the core provider Correct lint issues found after the toolchain upgrade to version 1.49.0 Investigate cross-compilation to Linux on Aarch64 Investigate adding ListClients and DeleteClient operations Consume the new, safer Rust PKCS\#11 interface into Parsec when it is available Add a SPIFFE JWT-SVID multitenancy test Add a JWT-SVID Authenticator Investigate and define the work required for compatibility with Arm Firmware Framework for Armv8-A \(FF-A\) Merged pull requests: Prepare for 0.7.0 release () Update to latest TSS crate version () Enable code coverage for PKCS11, disable for TS () Add Edmund to Contributors list () Add myself to contributors, re. rust-cryptoki () Add some cross-compilation tests () Upgrade all dependencies to their latest version () Create KeyInfoManagerClient () Parsec PsaHashCompare operation implementation for CryptoAuthLib provider () Parsec PsaGenerateRandom operation implementation for CryptoAuthLib provider () Add consistency in key creation/deletion () Make the authenticators their own features () Improve mandatory Provide methods () Use newest TSS crate () Add ListClients and DeleteClient operations () Added support for PsaHashCompute to CryptoAuthLib provider. () Update service dependencies () Add a test checking ListKeys provider target () Fix lint warning () Return correct key provider id in list\_keys () Use the new abstraction on the PKCS11 interface () Switch Travis CI build to cron-only () Add a JWT-SVID authenticator () Add Patrick to the contributor list () Implemented enhancements: Add multitenancy testing infrastructure Delete "Provider" suffix out of provider names Improve error message on service startup () Fixed bugs: Limit key imports in TPM provider () Closed issues: Add authenticator configuration Assemble a PR checklist for code reviewers Adjust README disclaimer wording Merged pull requests: Add multitenancy tests () Put config tests in all\_providers () Remove warnings about parsec and parsec-clients () Add authentication configuration () Refactored provider names () Add list keys () Implemented enhancements: Creating a build-time configuration file Merge integration tests in E2E test suite Support dbus-parsec with NXP secureobj library Verify which dependencies can/should be updated Add more test cases Test Parsec installation as a systemd daemon Improve E2E testing () Upgrade and clean dependencies () Import private key support for TPM provider () Allow software operations in PKCS11 provider () Improve key metadata handling () Add support for `psageneraterandom` operation for MbedCrypto provider () Fixed bugs: Memory cleanup of sensitive data Fix attribute conversion in PKCS11 provider () Fix sign attribute in PKCS11 () Add Uuid from the interface directly () Add `buffersizelimit` config option for providers () Security fixes: Add memory zeroizing when needed () Closed issues: Implement ListAuthenticators Better error message when file not found Implement an authenticator based on the domain socket peer credential Merged pull requests: Add Unix peer credentials authenticator () Implemented enhancements: Implement asymmetric encrypt/decrypt in

PKCS\#11 provider Implement asymmetric encrypting/decrypting for TPM provider Create a Parsec Command Line Interface Client Create a mechanism for the listener to pass system-level data to the authenticator Auto create `/tmp/parsec` with correct permissions on startup Update attribute handling in PKCS11 provider () Add asymmetric encryption support to TPM provider () Improve error message when config file is not found () Fixed bugs: Update Adam Parco email address in maintainers files Update email address () Bugfix: fix off-by-one error \(default body length limit\) () Fix clippy errors () Closed issues: Add an option to pass a path to a build-config file Merged pull requests: Add missing\_docs lint and missing docs () Added aead encrypt decrypt, hash compute compare and raw key agreement () Fix test and enable Travis () Add implementation for ListAuthenticators operation () Add check to prevent the Parsec service from running as root () CoreProvider can query the other providers () Rebase on new tss\_esapi () Add Asymmetric Encrypt/Decrypt to mbed supported opcodes () Create `Connection` abstraction for client communication () Added user and group checks. Auto create socket dir. () Implemented enhancements: Create a Mbed Crypto Secure Element driver calling Parsec Rust Client Threat model of Parsec Precise the providers' order importance () Keep list\_providers order; add cfg tests () Merged pull requests: Added PsaExportKey () Migrated uses of a locally declared RsaPublic key to new create picky-asn1-x509 () Added asymmetric encrypt and decrypt to Mbed Crypto provider () Implemented enhancements: Further simplification of the Mbed Crypto provider Create config "service" Use psa-crypto crate in the Mbed Crypto Provider Have a real integration test example Separate provider code into modules Update with PSA Crypto 1.0.0 interface Create a Parsec Rust Client TPM provider should establish most-secure primitives for itself Improvements for tests/ci.sh Split out ProviderConfig Check clippy::pedantic lints Modify configuration to have provider-specific table Create a PSA Crypto Rust wrapper crate Add TCTI configuration functionality () Updated Parsec to use latest parsec-interface \(0.17.0\) () Modify socket path () Changed local\ids for Atomic counter and removed key\slot\_semaphore. () Removed duplicate macros for sign output size and export pub key size. () Move Parsec over to psa-crypto () Add trace logging on Provide method calls () Update fuzz target () Improve log security () Add GlobalConfig () Add community repo link () Use crates.io version of the interface () Import the newest Parsec interface () Improve handling of list\_opcodes () Add default context cipher selection for TPM provider () Add ECDSA support for TPM provider () Improve TPM provider () Improve digest handling in PKCS11 provider () Split provider code into separate modules () Add integration test () Move end to end tests to own crate () Move test client back in the Parsec repo () Remove stress test on Travis CI for PKCS 11 () Add tests checking if key attributes are respected () Add Contributors file () Update with the latest interface () Improvments for tests/ci.sh () Fixed bugs: Integration tests should be isolated in their crate Key should be deleted from the KIM if generation/import fails Fixed PKCS\#11 provieder failing failed\created\key\should\be\_removed test () Replace calendar iframe with URL () Fix clippy errors () Allow PKCS11 tests to fail on Travis () Security fixes: Implement mitigation 4 of TM () Closed issues: Allow TPM owner hierarchy auth to be non-string Merged pull requests: Update partners file with web links and logos () Update CONTRIBUTORS.md () A few more README updates including fixes for broken doc links () README enhancements, PARTNERS file and new visual style for the project () Implemented enhancements: Modify configuration to have provider-specific structs () Improve code documentation () Implemented enhancements: Check for more Clippy lints Switch to picky-asn1-der for ASN.1-DER parsing Have all the providers dynamically loadable Pass

path as command-line argument Convert Key ID Manager String errors to ResponseStatus in the KIM itself Test strategy for our providers on the CI Add a PKCS 11 Provider Add a Trusted Platform Module Provider Assess the contents of unsafe blocks in Mbed Provider Drop key handles implicitly Add cross-compilation to Aarch64 logic and investigate CI testing Add fuzz tests Update to Mbed Crypto v2.0.0 Improve logging message structure Make PARSEC a daemon Improve builders for service components Implement a thread pool Use dynamically-sized buffers in Mbed provider Implement configuration Prepare for upload to crates io () Add cargo clippy lints to the CI () Implement fuzz testing () Add body length limit () Ensure the safety of unsafe blocks () Replace most panicking behaviours with Result () Modify Travis CI test script () Deny compilation for some rustc lints () Switch crates to use picky-asn1-der () Modify tests directory structure () Allow optional providers and key ID managers () Add a command-line option to select configuration () Add a TPM provider () Add SIGHUP signal handling to reload configuration () Add a PKCS 11 provider () Simplify the README.md file () Add cross compilation tests to the CI with cross () Add cross-compilation logic for Mbed Crypto () Make key slot release implicit () Make buffers dynamically sized in Mbed Provider () Upgrade dependency on Mbed Crypto to v2.0.0 () Add provider configuration () Improve handling of systemd activation () Replace println calls with log crate () Add a compile-time option for a daemon binary () Add service builder and configuration () Add stress test to the suite () Add SIGTERM handler for a graceful shutdown () Add a GitHub Actions workflow for CI () Add and improve component builders () Fixed bugs: TPM provider must support Owner Hierarchy authentication Audit our use of panicking Audit our use of unsafe code Review response codes returned by providers Warning during compilation about `llvm-config --prefix` Key handle manipulation is not thread-safe in Mbed Crypto Add owner hierarchy auth param () Add a verify-only integration test () Add sign to ASN.1 Integer types for RSAPublicKey () Make sure Cargo features work () Make UnixStreams block on read/write () Keep key ID within bounds for Mbed provider () Add locking around key handle operations in mbed provider () Use new version of test client to fix CI () Closed issues: Deny compilation if there is any warning Merged pull requests: Remove references to key lifetime () Use thread pool instead of new thread per request () Add the integration tests in the parsec repository () Closed issues: Building/running PARSEC Add Jenkins, CI/CD, unit testing, and code coverage Implement stubbed server API for client testing Create PASL golang client API Merged pull requests: Add versioning requirement on the interface () Fixed Ionut's email address () Remove Go client from PARSEC service () Add documentation updates () Docs: Update documentation to reflect the source code state () Add support for ListProviders operation update () Add a MAINTAINERS file () Merge Integration into Master () Update conn and key interfaces for initialization () Update response to handle a mis-aligned header and response test () Various improvements of the service internals () Go client implementations () update logo from plasma to parsec () Initial go client interface for signing keys () Provide minimal software solution based on Mbed Crypto () Add API landing page () Adding doc fragments. () update name from PASL to PLASMA () \ This Changelog was automatically generated by *