<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Thank you! <div><br></div><div>I observe that in 1.1.x everything's fine - the structure evp_pkey_methods_st is opaque, but both getters and setters are defined and available. </div><div><br></div><div>In 1.0.2 the structure is already opaque, the setters are present, but some getters are absent. Which makes it quite hard to work with <span style="background-color: rgba(255, 255, 255, 0);">members</span> of this structure.</div><div><br></div><div>I think this is a bug, and two possible remedies INHO are: add getter functions for the members, or add/move this structure from evp-int.h to evp.h (so it's no longer opaque).</div><div><br></div><div>What is your opinion? </div><div><br></div><div>Thanks!</div><div><br><div id="AppleMailSignature">Regards,<div>Uri</div><div><br></div><div>Sent from my iPhone</div></div><div><br>On Oct 1, 2017, at 18:54, Dr. Stephen Henson <<a href="mailto:steve@openssl.org">steve@openssl.org</a>> wrote:<br><br></div><blockquote type="cite"><div><span>On Fri, Sep 29, 2017, Blumenthal, Uri - 0553 - MITLL wrote:</span><br><span></span><br><blockquote type="cite"><span>Apologies in advance for cross-posting ??? but I???m not sure which of the two mailing lists this belongs to.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>A key (say, private key) is loaded from the pkcs11 engine via privkey = ENGINE_load_private_key(engine, <whatever else>); and this operation succeeds.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>However the resulting key handle has its engine == NULL. I looked for a method or a macro to explicitly set that value to the pointer to the engine that this key is bound to, but couldn???t find any. I define new methods such as pkcs11_pkey_rsa_decrypt(), and try to make OpenSSL aware of them via:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> EVP_PKEY_METHOD *orig_pmeth = EVP_PKEY_meth_find(EVP_PKEY_RSA);</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> EVP_PKEY_METHOD *pmeth = EVP_PKEY_meth_new(EVP_PKEY_RSA, EVP_PKEY_FLAG_AUTOARGLEN);</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> EVP_PKEY_meth_copy(pmeth, orig_pmeth);</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> EVP_PKEY_meth_get_decrypt(orig_pmeth, &pdecr_init, &pdecr);</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> EVP_PKEY_meth_set_decrypt(pmeth, pdecr_init, pkcs11_pkey_rsa_decrypt);</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><span></span><br><span>There doesn't seem to be any easy way to do that for an existing method. If</span><br><span>the ENGINE has its own ASN.1 method things become easier.</span><br><span></span><br><span>A workaround might be to use a copy of an existing A workaround might be to</span><br><span>create a copy of an existing ASN.1 method but I've not tried that.</span><br><span></span><br><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>In ENGINE_set_pkey_meths(engine, pkey_meths) what should pkey_meths() actually be? Is it documented? </span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><span></span><br><span>Not currently but it similar to the cipher/digest functions but handles</span><br><span>EVP_PKEY_METHOD instead.</span><br><span></span><br><span>Steve.</span><br><span>--</span><br><span>Dr Stephen N. Henson. OpenSSL project core developer.</span><br><span>Commercial tech support now available see: <a href="http://www.openssl.org">http://www.openssl.org</a></span><br><span>-- </span><br><span>openssl-users mailing list</span><br><span>To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a></span><br></div></blockquote></div></body></html>