prefer single part operations with softhsm module

[petrovr]

Describe the feature
SoftHSM software module is used for testing This means that it could keep simplified implementation model. Most of mechanism are marked internally as single part (bAllowMultiPartOp = false;).

Expected behavior
Attempt to use multipart operation should fail. In the same time single part is working.

Additional context
Request is provider do not try multipart part operations unless is supported by back end.

[simo5]

Sorry but there is no way to know that a token is broken, and I say broken intentionally, because you can't selectively implement only some part of the spec that is not optional and expect applications to always work.

SoftHSM declares support for 3.x PKCS#11 spec without correctly supporting all of the requirements of the spec.

There is nothing in the spec that allows to "negotiate" whether a mechanism can support single-part only operations, so I cannot detect that multi-part operations are unsupported.

I suggest testing with a token that is not so broken, like the kryoptic software token.

[bukka]

For the record I started working on the fix for ECDSA so should get addressed hopefully soon.

[petrovr]

• PKCS Make RTLD_DEEPBIND optional #11 Specification : "... mechanism for single- and multiple-part signatures and verification ..."
  Above is repeated for many mechanisms, but I cannot see explicit requirement both modes to be supported.

• statement : implementation without multiple-part is broken
  Sure

• statement : implementation without single-path is broken
  Sure

---

In addition, OpenSSL calls "single" or "multiple" depending on EVP API parameters.
The problem is that currently OpenSSL utilities lack arguments to specify model (set of "signature" functions) to use for signing or verification.
Remark: pre OpenSSL 3 API is different.

---

If I remember well for classical keys (RSA,DSA,EC) OpenSSL provider-signature(7) may use "single", but usually "multiple" is used because of EVP API arguments.

In the same time PKIX-SSH for RSA and EC keys uses only C_SignInit and C_Sign when works directly with PKCS#11 module. These functions are used to implement low level key methods. It does not needed "complex" methods.

---

I will not categorise any software as broken.
Each model has pros and cons.

This is request was open to allow tuning of middleware functionality. It seems to me I should accept contributors point of view.