Parsec: One API for Hardware-Backed Security
Shriira Press
One API for hardware-backed cryptography, so your applications stop caring whether the key lives in a TPM, an HSM, a secure enclave, or software.
Welcome to Parsec: One API for Hardware-Backed Security.
Parsec — the Platform AbstRaction for SECurity — is a CNCF sandbox project that solves a quietly painful problem: every secure element, every Trusted Platform Module, every PKCS#11 hardware security module, and every trusted execution environment speaks its own dialect, so an application that wants to sign a token or generate a key ends up welded to one piece of hardware. Parsec inserts a small Rust service between your applications and that hardware, exposing a single platform-neutral API for key management, signing, verification, encryption, and random generation. Behind that API sits a set of pluggable providers — software, TPM, PKCS#11, CryptoAuthLib, and trusted-service backends — that translate the same request to whatever security facility is actually present. This book walks through the problem Parsec exists to solve, the wire protocol and PSA-derived operations, the service's internal dataflow, the provider model, the authenticators that give each application its own isolated key namespace, the client-library experience, and how to deploy and operate Parsec in real systems. By the end you will understand both why Parsec is shaped the way it is and how to put it to work.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press