pkcs11rs

pkcs11rs is a Rust-based PKCS #11 provider designed to unify access to various hardware security modules and software tokens through a single ABI. It supports YubiKey applications (PIV, OpenPGP, YubiHSM Auth, Issuer Security Domain), FIDO2 authenticators, YubiHSM devices, and explicitly configured in-memory software tokens. The project implements PKCS #11 function tables for versions 2.40, 3.0, 3.1, and 3.2, ensuring unsupported entry points return appropriate errors rather than being omitted. Key features include hardware-backed cryptographic operations for RSA, ECDSA, Ed25519, and post-quantum algorithms like ML-DSA and ML-KEM in software slots. It offers robust session management with independent slot locking, shared physical-device coordination, and hot-plug reconciliation. The module supports secure transport protocols such as SCP03 and SCP11a/b/c, and includes a multi-device connector for remote YubiHSM access over HTTPS with mutual TLS support. pkcs11rs also provides platform-protected login capabilities using Apple's Secure Enclave on macOS and iOS, allowing named credentials to be generated and provisioned into YubiHSMs. The project includes comprehensive validation through CI tests on Linux, Windows, macOS, and iOS, covering ABI compatibility, profile conformance, and live-hardware interactions. It requires Rust toolchain version 1.94 or higher and dependencies like PC/SC and libudev for building.