<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 27/05/2015 15:26, Pavel Abramov
wrote:<br>
</div>
<blockquote
cite="mid:OF818F4F58.2DC44D05-ON43257E52.0049CA88-43257E52.0049CA99@LocalDomain"
type="cite">
<pre wrap="">Hi,
I have a task to use external Security Module to perform RSA functions in my WEB-server (nginx/httpd using OpenSSL for HTTPS).
The goal is to store Server private key components and establish SSL Handshake using Hardware module. It is not an SSL hardware accelerator.
This device has proprietary API (binary protocol over TCP/UDP, a few commands like "generate RSA key pair", "premaster decrypt using key#123").
What is the easiest way to do it? Will be very grateful for keywords/advices.
Should I write my ENGINE ? Or is there any other way?
I need only 2 functions to perform using hardware:
- RSA key generation (private component will be saved in hardware module)
- PreMaster decrypt from client during SSL handshake
How to override only these 2 functions?
</pre>
</blockquote>
<tt>If there is a generic engine wrapping pkcs11 or a similar <br>
API, it may or may not be easier to implement (or reuse <br>
if already provided) a hardware specific pkcs11 (or <br>
similar) driver.</tt><br>
<br>
<tt>I am unsure if there is or is not a well maintained <br>
pkcs11 engine for OpenSSL, either in the OpenSSL project<br>
or elsewhere. Maybe the opensc project has one, but I <br>
don't know if that would be general or specific to opensc <br>
pkcs11 drivers.<br>
</tt><br>
<tt>Keywords to search for: </tt><tt><br>
</tt><tt>pkcs11, pkcs11 engine, opensc project, openssl engine.</tt><tt><br>
<br>
</tt>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>