<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi all,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
thanks for the input so far.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
What I have been playing with is something like this:<br>
RSA_METHOD *meth = RSA_meth_dup(RSA_get_default_method());
<div>RSA_meth_set1_name(meth, "myrsa");</div>
<div>RSA_meth_set_sign(meth, sign);</div>
<div>RSA_meth_set_verify(meth, verify);</div>
RSA_set_default_method(meth);<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
with sign and verify being functions that I implemented.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
But non of these two is ever invoked.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If I also set the init and final callbacks, they are properly executed.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Any ideas?<br>
<br>
Br, Timo</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> openssl-users <openssl-users-bounces@openssl.org> im Auftrag von Dmitry Belyavsky <beldmit@gmail.com><br>
<b>Gesendet:</b> Montag, 11. Januar 2021 19:00<br>
<b>An:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Betreff:</b> Re: Sign without having the private key</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">Dear Timo,</div>
<div dir="ltr"><br>
</div>
<div>For 1.0* versions it was possible to provide custom RSA_METHOD and EC_METHOD and implement an IPC callback. </div>
<div>I think it still should work for 1.1.1</div>
<div><br>
</div>
<div>It may be also useful to take a look at the async API.</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, Jan 11, 2021 at 6:56 PM Timo Lange <<a href="mailto:tiolangit@outlook.com">tiolangit@outlook.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hey all,</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I have a question similar to <a href="http://openssl.6102.n7.nabble.com/private-key-not-available-for-client-cert-cb-td79369.html" id="x_gmail-m_-4558366547984505272LPlnk630154" target="_blank">
http://openssl.6102.n7.nabble.com/private-key-not-available-for-client-cert-cb-td79369.html</a>, that I am actively following, but though it differs in detail.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
What I want to achieve is the following:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
My client applications runs inside a container and needs to establish a mutual TLS connection to a server.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The client certificate is available in the container.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The root certificate, as well as the client private key is not available inside the container, but stored in a HSM.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
For sure the private key may never leave the HSM and also the root certificate should not.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The application cannot directly interfere with the HSM through standardized mechanisms as it is not accessible from inside the container.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
For doing so a proprietary interprocess-communication is required.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I now want something like a "verify callback" and a "sign callback".</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The "verify callback" would be needed in order to verify the server certificate against the root certificate. It seems to be easy using: <a href="https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_cert_verify_callback.html" id="x_gmail-m_-4558366547984505272LPlnk" target="_blank">https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_cert_verify_callback.html</a></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I need the same, something like a "sign callback" also for the private key, when a signature is required during handshake. Such that requests from openSSL to sign something can be forwarded through the inter-process-communication into the HSM. So that the actual
signing happens there.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
This would only be required during handshake. For the actual encryption symmetric keys can be used, such that the encryption takes place in the openSSL library, not in the HSM.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
I assume I need to write a custom ENGINE, but failed with all my approaches.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Can someone give me brief hint on where to start and which API to look at first?<br>
<br>
Thanks a lot!</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Timo</div>
<div></div>
<br>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail_signature">SY, Dmitry Belyavsky</div>
</div>
</div>
</div>
</body>
</html>