Add hardware security module (HSM) integration

[parfenovvs]

Summary

Implement Hardware Security Module (HSM) integration for enhanced key management and cryptographic operations in enterprise environments.

Features

HSM Integration Points

• Private key generation and storage in HSM
• Certificate-based authentication
• Hardware-backed encryption for sensitive data
• Secure key exchange with backend services

Supported HSM Types

• PKCS#11 compatible devices
  • YubiKey HSM
  • SoftHSM (for testing)
  • Hardware HSM appliances
• TPM 2.0 integration
  • Platform TPM chips
  • Discrete TPM modules

Configuration Interface

# Configure HSM integration
mbvpn hsm setup --type pkcs11 --library /usr/lib/libpkcs11.so
mbvpn hsm setup --type tpm --device /dev/tpm0

# Generate keys in HSM
mbvpn hsm keygen --slot 0 --pin-file ~/.mbvpn-pin

# Connect using HSM-stored keys
mbvpn connect us-east-01 --use-hsm

Configuration Format

# In ~/.config/mbvpn/config.yml
hsm:
  enabled: true
  type: "pkcs11"  # or "tpm"
  library: "/usr/lib/libpkcs11.so"
  slot: 0
  pin_source: "file"  # file, env, prompt
  pin_file: "~/.config/mbvpn/hsm-pin"
  key_label: "mbvpn-private-key"

Implementation Requirements

Dependencies

• PKCS#11 library support
• TPM 2.0 tools integration
• Hardware cryptography libraries

Security Considerations

• PIN/password management
• Session handling and timeouts
• Key backup and recovery procedures
• Audit logging for HSM operations

Enterprise Features

• Policy-based HSM requirements
• Multiple HSM support for redundancy
• Integration with existing PKI infrastructure
• Certificate lifecycle management

Use Cases

• High-security enterprise environments
• Compliance requirements (FIPS 140-2)
• Zero-trust network architectures
• Government and defense applications

Implementation Phases

1. Phase 1: PKCS#11 basic integration
2. Phase 2: TPM 2.0 support
3. Phase 3: Enterprise policy management
4. Phase 4: Advanced HSM features

Priority

📊 Priority 3 (3-4 weeks)

Labels

• enhancement
• priority-3
• security
• enterprise
• cryptography