Phase 4 : Backend NestJS - Intégration PKCS#11 CloudHSM¶

export interface HsmConfig {
  enabled: boolean;
  libraryPath: string;
  pin: string;
  slot: number;
  user: string;
}

export const hsmConfig = (): HsmConfig => ({
  enabled: process.env.CLOUDHSM_ENABLED === 'true',
  libraryPath: process.env.CLOUDHSM_LIBRARY_PATH || '/opt/cloudhsm/lib/libcloudhsm_pkcs11.so',
  pin: process.env.CLOUDHSM_PIN || '',
  slot: parseInt(process.env.CLOUDHSM_SLOT || '0', 10),
  user: process.env.CLOUDHSM_USER || 'crypto_user',
});

import * as graphene from 'graphene-pk11';
import { ConfigService } from '@nestjs/config';

export class Pkcs11Provider {
  private module: graphene.Module;
  private slot: graphene.Slot;

  constructor(private config: ConfigService) {}

  async initialize(): Promise<void> {
    const libraryPath = this.config.get<string>('hsm.libraryPath');

    // Load PKCS#11 library
    this.module = graphene.Module.load(libraryPath);
    this.module.initialize();

    // Get slot
    const slotId = this.config.get<number>('hsm.slot');
    const slots = this.module.getSlots(true);
    this.slot = slots.items(slotId);
  }

  getSlot(): graphene.Slot {
    return this.slot;
  }

  async close(): Promise<void> {
    this.module.finalize();
  }
}

import * as graphene from 'graphene-pk11';
import { Injectable, OnModuleDestroy } from '@nestjs/common';
import { Pkcs11Provider } from './pkcs11.provider';

@Injectable()
export class Pkcs11SessionService implements OnModuleDestroy {
  private session: graphene.Session;

  constructor(
    private pkcs11Provider: Pkcs11Provider,
    private config: ConfigService,
  ) {}

  async openSession(): Promise<graphene.Session> {
    const slot = this.pkcs11Provider.getSlot();

    // Open session
    this.session = slot.open(
      graphene.SessionFlag.SERIAL_SESSION | graphene.SessionFlag.RW_SESSION
    );

    // Login
    const pin = this.config.get<string>('hsm.pin');
    this.session.login(pin, graphene.UserType.USER);

    return this.session;
  }

  getSession(): graphene.Session {
    if (!this.session) {
      throw new Error('HSM session not initialized');
    }
    return this.session;
  }

  async closeSession(): Promise<void> {
    if (this.session) {
      this.session.logout();
      this.session.close();
    }
  }

  async onModuleDestroy(): Promise<void> {
    await this.closeSession();
  }
}

import { Injectable } from '@nestjs/common';
import * as graphene from 'graphene-pk11';
import { Pkcs11SessionService } from '../pkcs11/pkcs11-session.service';

@Injectable()
export class HsmSignatureService {
  constructor(private sessionService: Pkcs11SessionService) {}

  /**
   * Signer un document avec ECDSA P-256
   */
  async signEcdsa(data: Buffer, keyLabel: string): Promise<Buffer> {
    const session = this.sessionService.getSession();

    // Find private key
    const privateKey = this.findPrivateKey(session, keyLabel);

    // Sign with ECDSA-SHA256
    const signature = session.createSign(
      graphene.MechanismEnum.ECDSA_SHA256,
      privateKey
    ).once(data);

    return Buffer.from(signature);
  }

  /**
   * Signer un document avec RSA-PSS 4096
   */
  async signRsaPss(data: Buffer, keyLabel: string): Promise<Buffer> {
    const session = this.sessionService.getSession();

    // Find private key
    const privateKey = this.findPrivateKey(session, keyLabel);

    // Sign with RSA-PSS
    const signature = session.createSign(
      graphene.MechanismEnum.RSA_PKCS_PSS,
      privateKey,
      {
        hashAlgorithm: graphene.MechanismEnum.SHA256,
        mgf: graphene.MechanismEnum.MGF1_SHA256,
        saltLength: 32
      }
    ).once(data);

    return Buffer.from(signature);
  }

  private findPrivateKey(
    session: graphene.Session,
    label: string
  ): graphene.PrivateKey {
    const keys = session.find({
      class: graphene.ObjectClass.PRIVATE_KEY,
      label: label
    });

    if (keys.length === 0) {
      throw new Error(`Private key not found: ${label}`);
    }

    return keys.items(0).toType<graphene.PrivateKey>();
  }
}

describe('HsmSignatureService', () => {
  let service: HsmSignatureService;
  let mockSession: jest.Mocked<Pkcs11SessionService>;

  beforeEach(async () => {
    mockSession = {
      getSession: jest.fn(),
    } as any;

    const module = await Test.createTestingModule({
      providers: [
        HsmSignatureService,
        { provide: Pkcs11SessionService, useValue: mockSession },
      ],
    }).compile();

    service = module.get<HsmSignatureService>(HsmSignatureService);
  });

  describe('signEcdsa', () => {
    it('should sign data with ECDSA P-256', async () => {
      // Mock session
      const mockSessionObj = {
        find: jest.fn().mockReturnValue({
          length: 1,
          items: jest.fn().mockReturnValue({
            toType: jest.fn().mockReturnValue({}),
          }),
        }),
        createSign: jest.fn().mockReturnValue({
          once: jest.fn().mockReturnValue(Buffer.from('signature')),
        }),
      };
      mockSession.getSession.mockReturnValue(mockSessionObj as any);

      const data = Buffer.from('test data');
      const signature = await service.signEcdsa(data, 'test-key');

      expect(signature).toBeInstanceOf(Buffer);
      expect(mockSessionObj.createSign).toHaveBeenCalledWith(
        expect.any(Number), // ECDSA_SHA256
        expect.anything()
      );
    });
  });
});

describe('HSM Signature Integration', () => {
  let app: INestApplication;
  let hsmService: HsmSignatureService;

  beforeAll(async () => {
    const module = await Test.createTestingModule({
      imports: [HsmModule],
    }).compile();

    app = module.createNestApplication();
    await app.init();

    hsmService = module.get<HsmSignatureService>(HsmSignatureService);
  });

  afterAll(async () => {
    await app.close();
  });

  it('should sign and verify ECDSA signature', async () => {
    const data = Buffer.from('Integration test document');

    // Sign
    const signature = await hsmService.signEcdsa(data, 'test-ecdsa-key');

    expect(signature).toBeInstanceOf(Buffer);
    expect(signature.length).toBeGreaterThan(0);

    // Verify (using verification service)
    const verificationService = app.get<HsmVerificationService>(HsmVerificationService);
    const isValid = await verificationService.verifyEcdsa(
      data,
      signature,
      'test-ecdsa-key'
    );

    expect(isValid).toBe(true);
  });
});