Skip to content

Conversation

rajanarahul93
Copy link

Add PKCS11 Token Support with Tests and Documentation

Description

This PR reintroduces the changes from PR #780, which was closed unintentionally due to the fork being deleted.
It adds support for PKCS11 tokens (HSMs) with secp256k1 curve support to HWI, allowing users to use PKCS11-compliant hardware security modules as Bitcoin hardware wallets.

Changes Made

  • Added PKCS11 client implementation in hwilib/devices/pkcs11.py
  • Created a comprehensive test suite in test/test_pkcs11.py
  • Updated test runner in test/run_tests.py to include PKCS11 tests
  • Added documentation in README.md
  • Included Windows-specific prerequisites and installation instructions

Features

  • Support for PKCS11 tokens with secp256k1 curve
  • Cross-platform support (Windows, Linux, macOS)
  • Full test coverage
  • Integration with existing test framework
  • Documentation and usage examples

Testing

To run the tests:

python test/run_tests.py

Set environment variables before running:

# Windows
$env:PKCS11_LIB_PATH = "C:\path\to\your\pkcs11\library.dll"
$env:PKCS11_TOKEN_LABEL = "YourTokenLabel"

# Unix-like
export PKCS11_LIB_PATH=/path/to/your/pkcs11/library.so
export PKCS11_TOKEN_LABEL=YourTokenLabel

Example usage with HWI:

hwi --device-type pkcs11 --path /path/to/library.so getmasterxpub

Dependencies

  • python-pkcs11 >= 0.7.0
  • OpenSSL development libraries
  • Visual Studio Build Tools (Windows)

Related Issues

Closes #774
Supersedes #780

@Sjors
Copy link
Member

Sjors commented Sep 4, 2025

CI should work again since #795 landed. Can you rebase?

Also since you're using Python 3.10 it might be worth building on top of (or at least checking against) #790.

@rajanarahul93 rajanarahul93 force-pushed the feature/pkcs11-token-support branch from 59c6598 to 0e2e435 Compare September 4, 2025 08:41
@Sjors
Copy link
Member

Sjors commented Sep 5, 2025

Rebase seems correct, but it looks like @achow101 needs to authorise a build.

@rajanarahul93 rajanarahul93 force-pushed the feature/pkcs11-token-support branch 2 times, most recently from 0517d79 to 49aa733 Compare September 6, 2025 10:43
@rajanarahul93 rajanarahul93 force-pushed the feature/pkcs11-token-support branch from 49aa733 to 2eacabc Compare September 6, 2025 10:50
@rajanarahul93
Copy link
Author

Hi @Sjors, I’ve rebased the branch and force-pushed the latest changes. Could you please let me know if any further actions are needed to get the build authorized or the PR approved? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pkcs11 token support

2 participants