OpenSSL Provider: Support AES-CBC cipher, Random number and ECDSA

[prabakaranklst]

Implemented features on OpenSSL provider

• AES-CBC (128/192/256 & PKCS#7 padding) encryption and decryption
• ECDSA (P-256/P-384/P-521) key generation
• ECDSA (P-256/P-384/P-521) signature generation and verification (signature format: IEEE P1363 r||s)
• CTR-DRBG (Counter Deterministic Random Bit Generator) conforming to NIST SP 800-90A

Key-permission bug fix

• Permissions were checked nowhere at context creation
  The key binding and authorization is done during context creation for the intended operation. The daemon returns kKeyOperationNotPermitted if permission check fails.

• PKCS#11 token objects dropped their slot policy
  Updated RegisterTokenObject() to use slot's allowed_operations instead of hard-coded kNone.

• ExtractOptionalPermissions() read the wrong integer width
  KeyOperationPermission is serialised with with_in_val_uint32(), but the parser looked for uint64_t. Updated ExtractOptionalPermissions() to read correct integer width.

Asymmetric keys now carry public_key_permissions separately (std::nullopt = unrestricted, since a public key is public information)

Closes #97, #104, #105, #118, #246

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: fd4475c4-6ede-4c77-af63-e79365849315
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
WARNING: For repository 'score_bazel_platforms', the root module requires module version score_bazel_platforms@0.1.2, but got score_bazel_platforms@1.1.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'score_process_description', the root module requires module version score_process_description@2.1.1, but got score_process_description@2.1.2 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
Analyzing: 0 targets (2 packages loaded)
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 13.528s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

[sunildevda]

@prabakaranklst first glance the changes looks good and welcoming. thanks :).  could you join our weekly Security meeting tomorrow and give a short walk through the changes? I have not seen you in our security meetings so far or may be i missed it. let me know if you have any questions about the security group.

[prabakaranklst]

@sunildevda This is my first PR in this repo. I can join the meeting tomorrow.

[github-actions]

Documentation preview for this pull request is available at:
pr-181: https://eclipse-score.github.io/inc_security_crypto/pr-181/

[prabakaranklst]

Updating test cases to use NIST test vectors...

[prabakaranklst]

@sunildevda I have updated AES-CBC & ECDSA tests utilizing NIST test vectors. Please let me know whom to assign for review or please assign the reviewers.

[sunildevda]

@prabakaranklst have added Athul (@ChansAlive ) and Oliver (@OliverHeilwagen ) as reviewer from ETAS