+0.75
a couple of questions below
>
> + OpenSSL can access RSA keys in PKCS#11 keystores using the
> + following functions of the ENGINE API:
> +
> + EVP_PKEY *ENGINE_load_private_key(ENGINE *e,
> + const char *key_id, UI_METHOD *ui_method,
> + void *callback_data)
> +
> + EVP_PKEY *ENGINE_load_public_key(ENGINE *e,
> + const char *key_id, UI_METHOD *ui_method,
> + void *callback_data)
>
given the semantics described in the case, these functions will fail for
multiple reasons: bad argument, key not found,
bad internal state (engine hasn't initialized or hasn't authenticated to
the token). Yet the return value
can be either NULL: failure or Not NULL: a matching key was retrieved.
It will be more helpful to give the app developers some info as to the
reason of failure, so that they
know what to do when the load function returns NULL.
Possibly Missing:
----------------------
1. Need to mention somewhere that the caller of the load functions is
responsible for calling EVP_PKEY_free().
2. since the private parts of the on-token keys are never read by the
engine, there is an implication on all OpenSSL
access routines, like EVP_PKEY_copy_parameters(),
EVP_PKEY_get1_RSA(), etc. The'll all gonna fail when the
pkey arg comes from a token.
Rather than chasing the dozens of functions that use RSA private keys in
openssl, maybe it suffices to
document that EVP_Decrypt() and EVP_PKEY_free() are the only routines
that can use an RSA private key by reference.
Kais.
