Question on crypto backends

[awslabs]

Question on crypto backends

[petreeftime]

Hi @ionut-arm!

I've had a brief look over Parsec and it seems like it could be a good way to integrate a few other crypto providers. So far I don't know any users that use this during boot, but I would like to be able to keep a somewhat minimal set of requirements by default (eg. just libcrypto or ring), we are using this is a rather constrained environment and keeping things simple is critical.

At the moment, the only requirement that I know of, from our customers, is integration with AWS KMS (#23), but other than that, I don't know of additional plans from us to extend the library in the near future.

However, I don't see an issue adding Parsec as an optional dependency, in case someone wants to use this with a HSM or another PKCS11 provider (including perhaps https://github.com/aws/aws-nitro-enclaves-acm), and perhaps removing the TPM support as it is right now and using it through Parsec.

[ionut-arm]

Hi @petreeftime !

Thanks for taking the time to have a look! That sounds reasonable, I'll close this and open another issue to track implementing a backend based on Parsec.

For ACM for Nitro Enclaves do you reckon we should include some end-to-end testing on our side, as part of the backend implementation here?