On Mon, Jul 09, 2012, MauMau wrote: > > > >Hello, > > > >Please let me ask you for information and ideas about how to use > >OpenSSL effectively to implement encryption for data storage. > > > >I'm designing an encryption feature for a certain kind of data > >management system. I want to implement the following features, > >which I think are common to disk and database encryption. > > > > > >[Characteristics of the target storage encryption] > >1.Only a daemon program reads and writes data in data files on > >behalf of users. > > > >2.The daemon encrypts regular files on file systems (e.g. ext4 on > >Linux, NTFS on Windows) using AES128-XTS or AES256-XTS when it > >writes out those files. It decrypts data when the when it reads > >the data from files. > > > >3.All files in a directory are encrypted with the same "data > >encryption key." Individual directories have their own data > >encryption keys. > > > >4.The data encryption keys are encrypted with a "master encryption > >key" and stored in a file in the same directory where the target > >data files are placed. > > > >5.The data encryption keys and the master encryption key are > >randomly generated. > > > >6.The master encryption key is stored in a location that the > >administrator specifies. Currently, I'm thinking of a regular > >file for ease of use. In addition, I want to support HSM in the > >near future. > > > >7.The administrator sometimes changes the master encryption key. > >Re-keying operation retains the old master encryption keys in the > >same file. > > > > > >[Questions] > >Q1: > >I want to encrypt the master encryption key with an > >administrator-supplied password. I'm considering storing the > >master encryption keys in SecretBag entries of a PKCS#12 file, > >i.e. use one SecretBag per one master encryption key. > > > >How can I store and retrieve information from/to SecretBags after > >pkcs12_create()/pkcs12_parse()? I couldn't find appropriate > >medium-level API to manipulate SecretBags despite the below > >statement in Changelog. I would be grateful if you could give me > >the pointers to sample programs as well. > >
That isn't possible with the current PKCS#12 API and I'm not aware of a standard that describes this. An alternative would be to use public key encryption instead. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
