Hello Again:
Can anyone tell me what the purpose of the RSA_public_decrypt()/
RSA_private_encrypt() pair calls that are used in the SSL3 key
change protocol is? Since they are operating on digested data
it appears that they are used to implement signing? If that is the
case why not do this directly using sign and verify calls?
Also, is it correct that this operation is being performed using the
actual SSL cert key pair and not the ephemeral key that is subsequently
exchanged? Assuming I've got this all straight then it appears to
be impossible to implement this algorithm using PKCS11 devices since
they do not allow "reverse" operations on public keys.
TIA,
eric gilbertson
[EMAIL PROTECTED]
______________________________________________________________________
Hello Again:
Having done a top level rebuild the problem I described earlier
went away. I'm now back to the real issue of why B_DecryptFinal()
would return an invalid data error (0x20c) when decrypting data
encrypted by a PKCS11 token?
This occurs during the key exchange handshake in SSL3 when a weak
crypto client talks to a strong crypto server. The decryption works
when using software signing and the token is able to decrypt data sent
to it from the browser (e.g. when talking strong to strong where the
handshake is not executed), so I'm pretty sure the problem is specific
to the decryption of hardware encrypted data. I'd further speculate that
the problem is something to to with some an incompatable data encoding but
then I don't see why the token would be able to decrypt client encrypted
data. The key type is RSA and the mechanism is CKM_RSA_PKCS. The problem
occurs with both Chrysalis and nCipher tokens on NT and Solaris.
Any solution pointers are greatly appreciated.
TIA,
Eric Gilbertson
[EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
