Re: libp11: deprecation of PKCS11_generate_key

On Wed, Dec 2, 2020 at 9:29 AM Eliot Roxbergh via Opensc-devel
<[email protected]> wrote:
>
> Regarding the deprecation of PKCS11_generate_key in libp11
> (pkcs11_engine),
>
> To generate keypairs in an HSM, I am currently using OpenSSL and
> libp11. This is possible from OpenSSL by calling the pkcs11 engine with
> control command "KEYPAIR_GEN_CTRL". However, since this functionality (
> PKCS11_generate_key) is said to be deprecated in libp11 0.5.0, I ask if
> there is another way of doing this.
>
> As far as I understand, unlike the other functions which are to be
> deprecated, to generate keys inside of the HSM is not supported
> directly by OpenSSL. There must be something I am missing.

The deprecated function used to generate the key material and the store them
to the card. The routine was re-implemented and taken off the deprecated list
when the implementation was changed to create the key on the HSM directly
via the PKCS11 call C_GenerateKeyPair. This was done in this PR:
  - https://github.com/OpenSC/libp11/pull/188/files

What's really confusing to me, is that it got re-deprecated again in a
subsequent commit:
  - https://github.com/OpenSC/libp11/commit/c1c2753176421a148d02296a893a2fbe6374172f

Even though the implementation looks right:
  - https://github.com/OpenSC/libp11/commit/c1c2753176421a148d02296a893a2fbe6374172f#diff-deee9b449d96805726eeedbf74c24211ebcb3ed246f6fc3ac063d675b6fe5b7fR132

I'm wondering if a bad merge or something occurred, and that
DEPRECATED should go away?

>
> Naturally, it would be possible to generate the keys outside of the HSM
> and then store them therein, but this is of course not acceptable for
> security reasons.

Yeah, that's less than ideal, and that's the old implementation that
was changed by PR #188

>
> Best regards,
> Eliot Roxbergh
>
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel