On 5/29/26 6:10 PM, Andrew Cagney wrote:
Just a side note. It seems that there's a bug in libreswan's `ipsec
initnss` where it forgets to rebuild pkcs11.txt. As a consequence:
rm /var/lib/ipsec/*.db # not pkcs11.txt
ipsec initnss
will recreate the DB described in pkcs11.txt; or perhaps that's a feature.
Unless you have some external tokens loaded, the typical choice is
between the NSS Certificate DB module and the NSS Generic Crypto
Services. Both can do all the crypto the other can do, only the NSS
Certificate DB can store token objects, but may require a password
before you access it (depending on if you have set a db password). NSS
Generic Crypto Services does not require a password, and thus most
operations use it. If you need to store a key, NSS can usually move it
in this case. If you are in FIPS mode there is only one module, as you
need to authenticate before you do any crypto operation.
So it looks like we are still using the ecSlotList for mlkem instead of
adding a new mlkem slot list (sigh).
bob
--
You received this message because you are subscribed to the Google Groups
"[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/6bf8dc99-d299-4a4a-8588-ea8bdb57e69d%40redhat.com.
