<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hello Jakob,<br>
<br>
Looking at crypt/store/store.h, do you agree that a store
implementation is the place where the functionality that you
describe below belongs?<br>
<br>
Thanks,<br>
Reinier<br>
<br>
<br>
On 8/6/15 8:44 PM, Jakob Bohm wrote:<br>
</div>
<blockquote cite="mid:55C3F16C.8020007@wisemo.com" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<blockquote class=" cite"
id="mid_20150806230618_GA26266_openssl_org"
cite="mid:20150806230618.GA26266@openssl.org" type="cite"> </blockquote>
<tt>I think what one wants as a first approximation is <br>
functions that can enumerate and load keys and <br>
certificates from "engine storage", such as smart <br>
cards (most engines would obviously load only <br>
"proxy structures/handles" when asked to load a <br>
private key).<br>
<br>
E.g. <br>
<br>
PSOME_PRIVKEY_TYPE EVP_EnumPrivKeys(T hEngine, ofs_t i);<br>
<br>
PSOME_PUBKEY_TYPE EVP_EnumPubKeys(</tt><tt><tt>T hEngine, </tt>ofs_t
i);<br>
<br>
PSOME_CERT_TYPE EVP_EnumCerts(</tt><tt><tt>T hEngine, </tt>ofs_t
i);<br>
<br>
Each will return either:<br>
<br>
The item at index i in engine storage<br>
<br>
NULL for no such item at index i<br>
<br>
(void*)(size_t)(1) for "i past last currently <br>
valid index for such items"<br>
<br>
Engines would have some leeway if they will return <br>
NULL or 1 for some values slightly past last index, <br>
and if there will be any relationships between indexes <br>
for different types.<br>
<br>
A second order approximation would be functions <br>
that can look for matching triplets: <br>
Given a public key, private key or certificate, <br>
load a matching item of one of the other 2 kinds, <br>
if present in storage, or return a "not found" <br>
error (of cause the cases of private key or cert <br>
to public key mapping are already trivial without <br>
calling the engine, the remaining 4 cases are the <br>
interesting ones, some engines can do them <br>
efficiently others would fall back to generic EVP <br>
layer loops over the first order enumeration <br>
functions and a generic EVP layer public key <br>
compare). Note, I can imagine engines that can <br>
quickly go between private keys and certs, but not <br>
from public key to either, so all 4 cases need to <br>
be exposed to the engine level, even if (PrivToCert <br>
and CertToPriv methods have defaults that call <br>
PubToCert and PubToPriv).<br>
<br>
With these two simpler approximations, application <br>
code should be able to do most of the needed real <br>
world jobs, such as figuring out which useful <br>
certificates with matching private keys are present <br>
on an inserted smart card or key fob.<br>
</tt><br>
<tt>A third item that might be wanted for some engines <br>
(such </tt><tt>as the generic "engine" that can look in <br>
/etc/ssl/certs) would be </tt><tt>a search for certs by exact <br>
subject distinguished name match, </tt><tt>with the <br>
possibility of returning more than one result (think <br>
different serials/keyids).<br>
</tt><br>
<tt>Arbitrary criteria searching would typically end up <br>
as a loop over enumeration functions anyway.<br>
<br>
Searching for chain building purposes can be built <br>
on top of all this without bloating the EVP and engine <br>
interfaces with all that code.<br>
<br>
</tt>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
openssl-users mailing list
To unsubscribe: <a class="moz-txt-link-freetext" href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a>
</pre>
</blockquote>
<br>
</body>
</html>