Re: libp11: deprecation of PKCS11_generate_key

On Wed, Dec 2, 2020 at 1:06 PM William Roberts <[email protected]> wrote:
>
> On Wed, Dec 2, 2020 at 12:53 PM William Roberts
> <[email protected]> wrote:
> >
> > On Wed, Dec 2, 2020 at 9:29 AM Eliot Roxbergh via Opensc-devel
> > <[email protected]> wrote:
> > >
> > > Regarding the deprecation of PKCS11_generate_key in libp11
> > > (pkcs11_engine),
> > >
> > > To generate keypairs in an HSM, I am currently using OpenSSL and
> > > libp11. This is possible from OpenSSL by calling the pkcs11 engine with
> > > control command "KEYPAIR_GEN_CTRL". However, since this functionality (
> > > PKCS11_generate_key) is said to be deprecated in libp11 0.5.0, I ask if
> > > there is another way of doing this.
> > >
> > > As far as I understand, unlike the other functions which are to be
> > > deprecated, to generate keys inside of the HSM is not supported
> > > directly by OpenSSL. There must be something I am missing.
> >
> > The deprecated function used to generate the key material and the store them
> > to the card. The routine was re-implemented and taken off the deprecated list
> > when the implementation was changed to create the key on the HSM directly
> > via the PKCS11 call C_GenerateKeyPair. This was done in this PR:
> >   - https://github.com/OpenSC/libp11/pull/188/files
> >
> > What's really confusing to me, is that it got re-deprecated again in a
> > subsequent commit:
> >   - https://github.com/OpenSC/libp11/commit/c1c2753176421a148d02296a893a2fbe6374172f
> >
> > Even though the implementation looks right:
> >   - https://github.com/OpenSC/libp11/commit/c1c2753176421a148d02296a893a2fbe6374172f#diff-deee9b449d96805726eeedbf74c24211ebcb3ed246f6fc3ac063d675b6fe5b7fR132
> >
> > I'm wondering if a bad merge or something occurred, and that
> > DEPRECATED should go away?
> >
> > >
> > > Naturally, it would be possible to generate the keys outside of the HSM
> > > and then store them therein, but this is of course not acceptable for
> > > security reasons.
> >
> > Yeah, that's less than ideal, and that's the old implementation that
> > was changed by PR #188
>
> This seems like a bug, thus I filed one:
>   - https://github.com/OpenSC/libp11/issues/377
>
> I have a PR here:
>   - https://github.com/OpenSC/libp11/pull/378
>
> Lets see what the maintainers have to say.
>
> >
> > >
> > > Best regards,
> > > Eliot Roxbergh

Eliot, FYI the fix I proposed has been merged. It should make it out
on a subsequent release.

> > >
> > > _______________________________________________
> > > Opensc-devel mailing list
> > > [email protected]
> > > https://lists.sourceforge.net/lists/listinfo/opensc-devel