<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I've started working on moving some of the old commands forward using PKEY calls. My intention is for them to still print out a deprecated message when run but for them to not actually be removed by the no-deprecated configure option.<div class=""><br class=""></div><div class="">Having them print equivalent pkey command looks to be somewhat problematic. There isn’t a 1:1 conversion and some of the legacy options simply aren’t supported.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I’m hoping to have a preliminary PR up later this week.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli</div><div class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 2 Mar 2020, at 9:41 pm, Matt Caswell <<a href="mailto:matt@openssl.org" class="">matt@openssl.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><br class="">On 28/02/2020 23:43, Dr Paul Dale wrote:<br class=""><blockquote type="cite" class="">Any suggestions for a consensus on this thread?<br class=""></blockquote><br class="">I think we can probably agree that:<br class=""><br class="">- Command option deprecations should be handled better<br class="">- We should look at whether we can resurrect some of the "old" commands<br class="">(possibly by writing them as wrappers for genpkey, pkey and pkeyutl)<br class=""><br class="">I am slightly concerned that the latter option (rewriting as wrappers)<br class="">may turn into a big black hole of effort. It *might* be easier to just<br class="">rewrite them as-is to use EVP. Whichever approach we take, I don't think<br class="">this should be a goal for alpha1.<br class=""><br class="">Matt<br class=""><br class=""><blockquote type="cite" class=""><br class="">Pauli<br class="">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia<br class=""><br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">On 24 Feb 2020, at 5:08 pm, Dr Paul Dale <<a href="mailto:paul.dale@oracle.com" class="">paul.dale@oracle.com</a><br class=""><<a href="mailto:paul.dale@oracle.com" class="">mailto:paul.dale@oracle.com</a>>> wrote:<br class=""><br class="">Most of the conversions to using PKEY were straightforward. One<br class="">didn’t require any changes (dsa but my memory is suspect). One seemed<br class="">quite difficult. Some I didn’t check.<br class=""><br class="">Modifying the commands so that they continue to work and print (to<br class="">stderr) an alternative pkey based command might be workable too.<br class=""><br class=""><br class="">Pauli<br class="">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia<br class=""><br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">On 24 Feb 2020, at 5:53 am, Viktor Dukhovni<br class=""><<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a> <<a href="mailto:openssl-users@dukhovni.org" class="">mailto:openssl-users@dukhovni.org</a>>> wrote:<br class=""><br class=""><blockquote type="cite" class="">On Feb 22, 2020, at 4:53 AM, Richard Levitte <<a href="mailto:levitte@openssl.org" class="">levitte@openssl.org</a><br class=""><<a href="mailto:levitte@openssl.org" class="">mailto:levitte@openssl.org</a>>> wrote:<br class=""><br class="">Something that could be done is to take all those aged commands and<br class="">rewrite them as wrappers for genpkey, pkey and pkeyutl. Simply create<br class="">and populate a new argv and call genpkey_main(), pkey_main() or<br class="">pkeyutl_main().<br class=""></blockquote><br class="">Agreed, that sounds quite reasonable at first blush, and could be<br class="">fantastic<br class="">if it can be made to work (no immediate obstacles come to mind).<br class=""><br class="">-- <br class="">Viktor.<br class=""><br class=""></blockquote><br class=""></blockquote><br class=""></blockquote></div></div></blockquote></div><br class=""></div></body></html>