[openssl-users] External hardware for SSL handshake (overriding PreMasterSecret decrypt)

[Pavel Abramov]

thanks! 

Unfortunately there is no pkcs11 wrapper for this device.
There are a few commands implementing RSA operations (generate keyPair, PreMaster decrypt) and I have to use them to perform server-side SSL handshake.



OpenSC looks very interesting for my task.




Pavel


----- "openssl-users" <openssl-users-bounces at openssl.org>: -----
Re: [openssl-users] External hardware for SSL handshake (overriding PreMasterSecret decrypt)

On 27/05/2015 15:26, Pavel Abramov wrote:
Hi, 

I have a task to use external Security Module to perform RSA functions in my WEB-server (nginx/httpd using OpenSSL for HTTPS).
The goal is to store Server private key components and establish SSL Handshake using Hardware module. It is not an SSL hardware accelerator.

This device has proprietary API (binary protocol over TCP/UDP, a few commands like "generate RSA key pair", "premaster decrypt using key#123").

What is the easiest way to do it? Will be very grateful for keywords/advices.
Should I write my ENGINE ? Or is there any other way? 

I need only 2 functions to perform using hardware: 
- RSA key generation (private component will be saved in hardware module)
- PreMaster decrypt from client during SSL handshake

How to override only these 2 functions?

-------------------------------
If there is a generic engine wrapping pkcs11 or a similar 
API, it may or may not be easier to implement (or reuse 
if already provided) a hardware specific pkcs11 (or 
similar) driver.

I am unsure if there is or is not a well maintained 
pkcs11 engine for OpenSSL, either in the OpenSSL project
or elsewhere.  Maybe the opensc project has one, but I 
don't know if that would be general or specific to opensc 
pkcs11 drivers.

Keywords to search for: 
pkcs11, pkcs11 engine, opensc project, openssl engine.

Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users