Add a allow_export flag to restrict exporting

[hug-dev]

On some PKCS11 implementations, it is not allowed to create a key that
can be exported. For that reason, prevent creating exportable keys from
the configuration file so that clients can have a better return value.

This probably should be written in the book as well, as a new possible return value for generate key.

Fix #462

[ionut-arm]

But you're not exactly solving the problem in #462 - you're still setting the attributes for keys that have export as false.

[hug-dev]

As per the investigation in here, I checked that those attributes are actually allowed (in Layerscape) but they can't be set to unsecure mode (exportable=true, sensitive=false). It would still work if they explicitely set to the secure mode. That's why I "simplified" what we planned to this.
I believe Yubico will follow the same logic (as per this)

[ionut-arm]

Oh, it's because we have a bug 😬 I was wondering wth is going on, because what you're saying and what Sahil reported are at odds - most keys we generate for tests have export set to false, so it made no sense that create_and_destroy would fail if what you said above were true.

However, see if you can spot something wrong with this:

parsec/src/providers/pkcs11/utils.rs

Line 97 in 6018d25

priv_template.push(Attribute::Sensitive((usage_flags.export).into()));

[wiktor-k]

Folks, if we only patch the entire world of buggy PKCS#11 drivers then this PR could be obsoleted! 🥳

[ionut-arm]

Folks, if we only patch the entire world of buggy PKCS#11 drivers then this PR could be obsoleted! 🥳

Unfortunately not, see my comment above ☹️ we set SENSITIVE and EXTRACTABLE to the same boolean value, when they should be "opposites"

[wiktor-k]

Oh, right. That's totally something to improve. And what a coincidence that buggy PKCS#11 drivers exposed a bug in parsec :) Fortunately this one is easy to fix.

[hug-dev]

Should I add the fix in this PR?

Would have been funny if you did not spot the inverted logic and the double bug in Parsec and there made the key secure

[ionut-arm]

Should I add the fix in this PR?

I think so - it's only one line and related to what's going on in here (and it was discovered via the same conversation).

[wiktor-k]

Continuous Integration / Integration tests using Cypto Trusted Service provider

I think there's a typo in the test name that failed ^^ :)

[ionut-arm]

👍🏻