<html><head><title></title></head><body><!-- rte-version 0.2 9947551637294008b77bce25eb683dac --><div class="rte-style-maintainer" style="font-family: Arial, 'BB.Proportional'; white-space: pre-wrap; font-size: small;"data-color="global-default" bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium" bbg-font-family="normal">Thank you for your responses, PKCS#11 could be the right way to go. I am hoping there is flexibility as per what functionality I want to delegate (just need the decrypt piece).<div style="">If I had to implement a fully fledged PKCS#11 module that would be an overkill. I hope that's not the case?<div style=""><br><br><div class="rte-style-maintainer" style="font-size: small; font-family: 'Courier New', Courier, 'BB.FixedWidth';"bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium" bbg-font-family="fixed-width"><div class="bbg-rte-fold-content" data-header="From: dwmw2@infradead.org At: Mar 17 2015 16:02:44" data-digest="From: dwmw2@infradead.org At: Mar 17 2015 16:02:44" style=""><div class="bbg-rte-fold-summary">From: dwmw2@infradead.org At: Mar 17 2015 16:02:44</div><div>To: <a href="mailto:tgyonjyan@bloomberg.net" spellcheck="false" data-destination="mailto:tgyonjyan@bloomberg.net">Tigran Gyonjyan (BLOOMBERG/ 731 LEX)</a>, <a href="mailto:openssl-dev@openssl.org"spellcheck="false" data-destination="mailto:rte:bind">openssl-dev@openssl.org</a><br>Subject: Re: [openssl-dev] Using openssl with a remote private key<br></div></div><blockquote>On Tue, 2015-03-17 at 15:44 +0000, Tigran Gyonjyan (BLOOMBERG/ 731 LEX)<br>wrote:<br>> <br>> <br>> Recently I had to work on an openssl project where due to security<br>> requirements I had to place the private key for the server certificate<br>> on another machine. In order to be able to make openssl ignore the<br>> fake private key in the certificate I had to "hack" some data<br>> structures to delegate the handshake decrypt to the remote machine so<br>> that the handshake could succeed.<br>> <br>> <br>> I was wondering if this capability to delegate the decrypt function<br>> can be useful enough to incorporate into the official version.<br>> In cases when the client and the server are located on user's machine<br>> it is a risk to keep the private key on that machine.<br>> <br>> <br>> Let me know if there is a better solution for this problem.<br><br>Yes, PKCS#11. Which is *all* about delegating the decrypt function.<br><br>If you install the OpenSC ENGINE_pkcs11 (which *really* ought to be part<br>of OpenSSL, either in ENGINE form or preferably just native PKCS#11<br>support like libp11), you can configure it to use a key in PKCS#11. And<br>it's relatively simple to have a PKCS#11 provider which does the RPC to<br>the remote machine or wherever the key is actually stored.<br><br>I have patches outstanding to ENGINE_pkcs11 which make it Just Workâ˘<br>with PKCS#11 tokens which are configured in the system's p11-kit<br>configuration, and accept standard PKCS#11 URIs for them instead of the<br>bizarre format it currently requires.<br><br>-- <br>dwmw2<br><br></blockquote><br></div></div></div></div></body></html>