On Sun, May 24, 2009, Martin Kaiser wrote: > Hello Steve, > > Thus wrote Dr. Stephen Henson (st...@openssl.org): > > > The best approach IMHO is to have a new "pss" public key algorithm to handle > > the case of PSS only keys and pass the ASN1 structures down to the specific > > method API via the ctrl mechanism. > > Hm, not sure if I understand this. Do you suggest having a new value for > EPV_PKEY's type field to indicate pss? (Can't figure out quickly if type > contains a NID_... value) PSS parameters would then be added to rsa_st? > > A while ago, I tried a new THIS_IS_PSS flag for EVP_PKEY's rsa_st. It > worked but I'm not sure if it was a good approach. > > Probably, the EVP_PKEY_CTX was introduced to store such information... >
EVP_PKEY_CTX was introduced (by me!) to contain parameters relating to a specific cryptographic operation. Fixed parameters should go in EVP_PKEY. PSS can have both so we'd need a new EVP_PKEY type and/or expand the RSA structure too. Use of the ctrl mechanism will require some changes to ASN1_item_sign and ASN1_item_verify. The current code uses EVP_Sign*() and EVP_Verify*() which isn't flexible enough the new EVP_Digest*() API will need to be used instead. Check out the CMS code for an example, cms_sd.c passes a CMS SignerInfo structure down to the EVP_PKEY_METHOD via a ctrl. The method can then inspect or modify it as appropriate. In ASN1_item_*() we'd pass algor1, algor2, and it. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
