Holger Dengler

— On the schedule —

Beyond Algorithms: Exploiting Platform Cryptography with OpenSSL Providers

Cryptographic hardware is everywhere - from HSMs in data centers to hardwaresecurity features baked into modern CPUs and mainframes. Yet most applicationsaccess these features through various platform-specific code paths, or not atall. OpenSSL v3 Provider API changes this fundamentally. This session goes beyond the usual use of providers as algorithm plugins andreframes them as platform integration adapters: a clean, stable interface thatlets any OpenSSL-consuming application — TLS stacks, certificate authorities,confidential computing environments — transparently benefit fromplatform-native cryptographic capabilities, with no (or less) application codechanges required. Beside well the known provider for PKCS#11, the talk will mainly focus on theprovider for the IBM Z (s390x) hardware-backed key feature. The s390x platformexposes protected-key primitives through the Linux kernel's pkey subsystem, andthe zpcprovider can wrap these opaque key origins so that cryptographicoperations execute inside the hardware security boundary, with cleartext keymaterial never appearing in userspace memory. Key points of the talk are the common architectural patterns: opaque keyhandles, provider-owned key lifecycle management via the KEYMGMT dispatchtable, and a thin adapter layer between OpenSSL's generic operation API and theplatform's native interface. Understanding this pattern is the foundation forbuilding providers on any platform that exposes a native crypto API. The session closes with a call to action for platform developers. The goal isto lower the barrier to entry so that the broader ecosystem of platformcryptographic features becomes accessible to every OpenSSL user.