[NOTE: the following are my thoughts and my thoughts only. Other
members of the OpenSSL development team may have the same opinions, or
different ones]
OK, I've started to take a look at the PKCS#11 patches the have been
contributed. As far as I've been able to see, there are three
contributions, which I will call the "Advorum", the "Eracom" and the
"Trustway" contributions.
I'll honestly say that I have a problem with all of them, at least as
far as I understand them (I don't know PKCS#11 that well, but I do
understand the ENGINE framework and the internals of OpenSSL :-)).
The "Eracom" and "Trustway" contributions are engines, and that's a
good thing, but are tied to a specific PKCS#11 implementation. The
"Advorum" contribution seems to be more generic (i.e. it's
specifically designed to be able to talk with any PKCS#11 libary that
comes in it's way). However, it's not designed as an engine according
to the ENGINE framework. Instead, it's hooked into the SSL library
(it seems to be only useable from there, unless one calls the provided
PKCS11 functions. I can see no hooks in the EVP layer or anything
equally useful).
I've seen some bickering between the different contributors on the
openssl-users lists (IIRC), and I'd like to suggest the you guys stop
the bickering and try to cooperate.
My wish (and the only thing I'll consider as something PKCS#11-related
to put into OpenSSL) is for something having the generality that the
"Advorum" contribution seems to be designed as, but as an engine (as
pure as possible. Ideally, the only changes should be in the
crypto/engine directory). If there are changes needed in the
algorithm methods, the EVP layer or the ENGINE framework, I'd like
to see it implemented in a *general* way instead of something PKCS#11-
specific, and that it's discussed with us, so we can handle it in an
appropriate way. Who knows, we might need additions to the ENGINE
framework that haven't been thought of yet (public key generation
routines, for example).
I base everything I've said on the study of the following files:
Advorum: pkcs11.openssl.adnovum.20010615.patch.gz
pkcs11.openssl.adnovum.20010615.tar.gz
pkcs11-adnovum-20011212.tar.gz
Eracom: ERACopenssl-engine-0.9.6b.patch.gz
Trustway: openssl-engine-0.9.6c-tw.patch
Note: the contributions will not appear in 0.9.6. That branch of
OpenSSL is in freeze, and will only be updated with bug-fixes.
0.9.7 is a different matter, I'm currently looking at things that I
can insert as demo engines to be built as dynamic libraries that can
get loaded through the "dynamic" engine.
For 0.9.8, we're discussing a change that will make the "dynamic"
engine obsolete and enhance the support of dynamically loadable
engines.
--
Richard Levitte \ Spannv�gen 38, II \ [EMAIL PROTECTED]
Redakteur@Stacken \ S-168 35 BROMMA \ T: +46-8-26 52 47
\ SWEDEN \ or +46-708-26 53 44
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
