Rich Salz wrote:
>
> On Tue, 13 Apr 1999, Dr Stephen Henson wrote:
> > I was thinking more along the lines of the PKCS#11 (but cut down a bit)
> > to handle this kind of thing where you treat each 'object' as a set of
> > 'attributes' and can search for objects that match a given attribute.
> > Something like:
> >
> > int search(X509DB *db, int obj_type, int attr_type, void *attr,
> > int attrlen, STACK **ret);
>
> Perhaps it makes sense to look at existing APIs which handle this kind
> of thing such as CDSA, Gutman's API, CAPI2 keystores, etc...
> The API is (getting so) big that adopting existing ones, even if
> not perfect, should be a goal.
I think the best you could get is a "look and feel" (ugh!) of some other
API because the stuctures used would not be compatible (or it would use
handles instead of the structures directly: I think handles will be
needed anyway). CAPI2 I know about but it has separate techniques for
private keys, certificates and CRLs (and no 'login' API). I'll look into
the others.
PKCS#11 is the nearest to what I would regard as our needs that I've
seen so far but some things (like the ability to search for arbitrary
multiple matching attributes) aren't needed.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
