Add advisory for pkcs11

[ionut-arm]

#1280

Feedback is more than welcome, I think the Impact section is a bit verbose :[

cc @5225225

[ionut-arm]

Also, depending on what happens with mheese/rust-pkcs11#57 I might add the unmaintained flag.

[tarcieri]

Did a quick pass. Looks good so far 👍

[5225225]

Also, notably, the security issues in the crate will become not as significant soon since the incorrect use of transmute_copy will just panic :)

Looks good to me though (other than the date, which I noted). I checked and the guideline for an unmaintained advisory is 90 days. So while I think the crate is pretty clearly unmaintained, it might be best to just put this out. Besides, "unmaintained" is a 'weaker' advisory than "wow this will segfault if you touch it wrong".

The impact section does seem verbose... Maybe at least split it into 2 paragraphs, 1 being the background knowledge about PKCS11 and its API, the second one being "so what does this mean for me who uses this library?" That or remove the background info entirely and only leave the sentences that are directly relevant to "why should I, as a pkcs11 user, care?".

I feel everything before "The raw pointers can be easily created in Rust, [...]" can either be split out into a new paragraph or removed.

[tarcieri]

@5225225 an unmaintained crate advisory can be filed separate to this one, and marked informational = "unmaintained"

This advisory is debatably informational = "unsound", but IMO given PKCS#11's purpose is a hardware interface for public key cryptography, this falls under the category of crypto-failure and thus deserves a proper security advisory

[ionut-arm]

Alright, shuffled some of the text around and made it shorter, also added informational = "unsound" and crypto-failure category - let me know if it looks more accurate/better now.

[5225225]

Looks good to me! Definitely cleaner now.

[tarcieri]

LGTM.

@ionut-arm if you want to remove "Draft" I can merge.

Also if someone's interested it would be good to remove pkcs11 from the RCIG's Awesome Rust Cryptography list since it appears it's unmaintained: https://github.com/The-DevX-Initiative/RCIG_Coordination_Repo/blob/main/Awesome_Rust_Cryptography.md

[5225225]

Also if someone's interested it would be good to remove pkcs11 from the RCIG's Awesome Rust Cryptography list since it appears it's unmaintained

I'll make a PR to do that.

[ionut-arm]

@ionut-arm if you want to remove "Draft" I can merge.

Done!

Also if someone's interested it would be good to remove pkcs11 from the RCIG's Awesome Rust Cryptography list since it appears it's unmaintained: https://github.com/The-DevX-Initiative/RCIG_Coordination_Repo/blob/main/Awesome_Rust_Cryptography.md

I'll make a PR to do that.

Thank you!