thanks!
Unfortunately there is no pkcs11 wrapper for this device.
There are a few commands implementing RSA operations (generate keyPair,
PreMaster decrypt) and I have to use them to perform server-side SSL handshake.
OpenSC looks very interesting for my task.
Pavel
- openssl-users openssl-users-boun...@openssl.org: -
Re: [openssl-users] External hardware for SSL handshake (overriding
PreMasterSecret decrypt)
On 27/05/2015 15:26, Pavel Abramov wrote:
Hi,
I have a task to use external Security Module to perform RSA functions in my
WEB-server (nginx/httpd using OpenSSL for HTTPS).
The goal is to store Server private key components and establish SSL Handshake
using Hardware module. It is not an SSL hardware accelerator.
This device has proprietary API (binary protocol over TCP/UDP, a few commands
like generate RSA key pair, premaster decrypt using key#123).
What is the easiest way to do it? Will be very grateful for keywords/advices.
Should I write my ENGINE ? Or is there any other way?
I need only 2 functions to perform using hardware:
- RSA key generation (private component will be saved in hardware module)
- PreMaster decrypt from client during SSL handshake
How to override only these 2 functions?
---
If there is a generic engine wrapping pkcs11 or a similar
API, it may or may not be easier to implement (or reuse
if already provided) a hardware specific pkcs11 (or
similar) driver.
I am unsure if there is or is not a well maintained
pkcs11 engine for OpenSSL, either in the OpenSSL project
or elsewhere. Maybe the opensc project has one, but I
don't know if that would be general or specific to opensc
pkcs11 drivers.
Keywords to search for:
pkcs11, pkcs11 engine, opensc project, openssl engine.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
___
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
___
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
