<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hello <span>Fabrizio</span>,</p>
<p><br>
</p>
<p>actually the whole private key and all its components are not loaded with <span>
ENGINE_load_private_key</span>. Only a part of them (modulus and public exponent).</p>
<p>These components are enough to, for example, make a key/certificate match verification.</p>
<p><br>
</p>
<p>Once a private key operation is needed (ex. signature) then your custom RSA method will be called because the key that you have previously loaded</p>
<p>is not able to perform that kind of operations. Depending on how you have written your method, one function or another will be called (rsa_sign or RSA_private_encrypt).</p>
<p><br>
</p>
<p>If you have loaded your engine correctly, the SSL methods will know when to call your rsa methods to perform their operations.<br>
</p>
<p><br>
</p>
<p>Regards,</p>
<p><br>
</p>
<p>Ignacio<br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>De:</b> openssl-users <openssl-users-bounces@openssl.org> en nombre de hokusai@gmx.ch <hokusai@gmx.ch><br>
<b>Enviado:</b> miércoles, 15 de noviembre de 2017 9:37<br>
<b>Para:</b> openssl-users@openssl.org<br>
<b>Asunto:</b> [openssl-users] Loading RSA private key from ENGINE</font>
<div> </div>
</div>
<div>
<div style="font-family:Verdana; font-size:12.0px">
<div>I am currently exporing the ENGINE capabilities. The examples are quite clear about how to link OpenSSL with methods that are available in a hardware module:<br>
- implement RSA_METHOD in MyEngine, e.g. rsaSign() wich calls rsaSign_HW()<br>
- ENGINE_register_RSA(MyEngine)<br>
--> OpenSSL will then automatically call that method when rsa signing is required.</div>
<div> </div>
<div>So far, so good.</div>
<div> </div>
<div>The gap in my understanding is how to access the private key. Assumimg that my hardware module contains a list of private keys, which cannot and shall not be exported, they will be referenced by some opaque reference or id, e.g "KEY_1"</div>
<div> </div>
<div>rsaSign_HW(dataToSign,"KEY_1")</div>
<div> </div>
<div>Now I need some way to configure SSL_CTX with "KEY_1" instead of the "real" key.</div>
<div>I'm thinking of some pseudo-code in the way:</div>
<div> </div>
<div>SSL_CTX_use_certificate(ctx, cert) // certificate from PEM file as usual<br>
SSL_CTX_use_PrivateKeyReferenceForEngine(ctx, "KEY_1") </div>
<div> </div>
<div>Also there is a engine interface that looks promising, as takes some arbitrary keyId as parameter....</div>
<div> </div>
<div>privKey = ENGINE_load_private_key(MyEngine, "KEY_1")</div>
<div> </div>
<div>.. but as far as I understand, it returns the "real" key, which is not exportable.</div>
<div><br>
Am I completety on the wrong track? What is the recommended technique?</div>
<div>Thanks for any suggestion<br>
</div>
<div>Fabrizio</div>
</div>
</div>
</div>
</div>
</body>
</html>