[hsmtool] Improve attribute redactions

When showing objects, manually redact private key components.

The HSM normally redacts these, however, if you have extractable keys,
the show command might dump their contents to the console.  By default,
we'll redact these components to avoid accidentally exposing private key
material.

Signed-off-by: Chris Frantz <[email protected]>

sw/host/hsmtool/src/commands/object/show.rs

@@ -7,11 +7,12 @@ use cryptoki::session::Session;
 use serde::{Deserialize, Serialize};
 use serde_annotate::Annotate;
 use std::any::Any;
+use std::collections::HashSet;
 
 use crate::commands::Dispatch;
 use crate::error::HsmError;
 use crate::module::Module;
-use crate::util::attribute::AttributeMap;
+use crate::util::attribute::{AttributeMap, AttributeType};
 use crate::util::helper;
 
 #[derive(clap::Args, Debug, Serialize, Deserialize)]
@@ -20,13 +21,34 @@ pub struct Show {
     id: Option<String>,
     #[arg(short, long)]
     label: Option<String>,
+    #[arg(long,
+        action = clap::ArgAction::Set,
+        default_value = "true",
+        help="Redact senitive data",
+    )]
+    redact: bool,
 }
 
 #[derive(Default, Debug, Serialize, Deserialize)]
 pub struct ShowResult {
     pub objects: Vec<AttributeMap>,
 }
 
+impl Show {
+    fn redactions() -> HashSet<AttributeType> {
+        // TODO: Add attributes to this list depending on the type of
+        // object being shown.
+        HashSet::from([
+            AttributeType::PrivateExponent,
+            AttributeType::Prime1,
+            AttributeType::Prime2,
+            AttributeType::Exponent1,
+            AttributeType::Exponent2,
+            AttributeType::Coefficient,
+        ])
+    }
+}
+
 #[typetag::serde(name = "object-show")]
 impl Dispatch for Show {
     fn run(
@@ -40,7 +62,10 @@ impl Dispatch for Show {
         let objects = session.find_objects(&attr)?;
         let mut result = Box::<ShowResult>::default();
         for object in objects {
-            let map = AttributeMap::from_object(session, object)?;
+            let mut map = AttributeMap::from_object(session, object)?;
+            if self.redact {
+                map.redact(&Self::redactions());
+            }
             result.objects.push(map);
         }
         Ok(result)

sw/host/hsmtool/src/util/attribute/attr.rs

@@ -8,17 +8,18 @@ use cryptoki::session::Session;
 use indexmap::IndexMap;
 use once_cell::sync::OnceCell;
 use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
 use std::str::FromStr;
 use strum::IntoEnumIterator;
 
-use super::AttrData;
 use super::AttributeError;
 use super::AttributeType;
 use super::CertificateType;
 use super::Date;
 use super::KeyType;
 use super::MechanismType;
 use super::ObjectClass;
+use super::{AttrData, Redacted};
 
 /// Converts a cryptoki `Attribute` into a key-value pair of
 /// `(AttributeType, AttrData)`.  This allows converting HSM
@@ -285,6 +286,14 @@ impl AttributeMap {
         }
     }
 
+    pub fn redact(&mut self, redactions: &HashSet<AttributeType>) {
+        for (k, v) in self.0.iter_mut() {
+            if redactions.contains(k) && !matches!(v, AttrData::Redacted(_)) {
+                *v = AttrData::Redacted(Redacted::RedactedByTool);
+            }
+        }
+    }
+
     /// Retrieves an object from the PKCS#11 interface as an `AttributeMap`.
     pub fn from_object(session: &Session, object: ObjectHandle) -> Result<Self> {
         let all = Self::all();
@@ -299,7 +308,7 @@ impl AttributeMap {
         let mut map = AttributeMap::from(attrs.as_slice());
         for (&a, i) in all.iter().zip(info.iter()) {
             if matches!(i, AttributeInfo::Sensitive) {
-                map.insert(a.into(), AttrData::None);
+                map.insert(a.into(), AttrData::Redacted(Redacted::RedactedByHsm));
             }
         }
         Ok(map)

sw/host/hsmtool/src/util/attribute/data.rs

@@ -13,6 +13,12 @@ use crate::util::attribute::{
 };
 use crate::util::escape::{as_hex, escape, unescape};
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub enum Redacted {
+    RedactedByHsm,
+    RedactedByTool,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
 #[serde(untagged)]
 pub enum AttrData {
@@ -24,6 +30,7 @@ pub enum AttrData {
     KeyType(KeyType),
     MechanismType(MechanismType),
     ObjectClass(ObjectClass),
+    Redacted(Redacted),
     Str(String),
     List(Vec<AttrData>),
 }

sw/host/hsmtool/src/util/attribute/mod.rs

@@ -46,7 +46,7 @@ mod mechanism_type;
 mod object_class;
 
 pub use attr::AttributeMap;
-pub use data::AttrData;
+pub use data::{AttrData, Redacted};
 pub use error::AttributeError;
 
 pub use attribute_type::AttributeType;