| Newsgroups |
gmane.comp.mozilla.crypto |
| Message-ID |
<[email protected]> |
This is a multi-part message in MIME format.
--------------GU7D0t0zqIYhlEZ8CRcXz3Mz
Content-Type: text/plain; charset="UTF-8"; format=flowed
On 5/29/26 6:10 PM, Andrew Cagney wrote:
> Just a side note. It seems that there's a bug in libreswan's `ipsec
> initnss` where it forgets to rebuild pkcs11.txt. As a consequence:
>
> rm /var/lib/ipsec/*.db # not pkcs11.txt
> ipsec initnss
>
> will recreate the DB described in pkcs11.txt; or perhaps that's a feature.
>
Unless you have some external tokens loaded, the typical choice is
between the NSS Certificate DB module and the NSS Generic Crypto
Services. Both can do all the crypto the other can do, only the NSS
Certificate DB can store token objects, but may require a password
before you access it (depending on if you have set a db password). NSS
Generic Crypto Services does not require a password, and thus most
operations use it. If you need to store a key, NSS can usually move it
in this case. If you are in FIPS mode there is only one module, as you
need to authenticate before you do any crypto operation.
So it looks like we are still using the ecSlotList for mlkem instead of
adding a new mlkem slot list (sigh).
bob
--
You received this message because you are subscribed to the Google Groups "[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/6bf8dc99-d299-4a4a-8588-ea8bdb57e69d%40redhat.com.
--------------GU7D0t0zqIYhlEZ8CRcXz3Mz
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8=
">
</head>
<body>
<div class=3D"moz-cite-prefix">On 5/29/26 6:10 PM, Andrew Cagney
wrote:<br>
</div>
<blockquote type=3D"cite"
cite=3D"mid:[email protected].=
com">
<pre wrap=3D"" class=3D"moz-quote-pre">Just a side note. It seems th=
at there's a bug in libreswan's `ipsec
initnss` where it forgets to rebuild pkcs11.txt. As a consequence:
rm /var/lib/ipsec/*.db # not pkcs11.txt
ipsec initnss
will recreate the DB described in pkcs11.txt; or perhaps that's a feature.
</pre>
</blockquote>
<p>Unless you have some external tokens loaded, the typical choice
is between the=C2=A0<span style=3D"white-space: pre-wrap">NSS Certifi=
cate DB module and the NSS Generic Crypto Services</span>.
Both can do all the crypto the other can do, only the NSS
Certificate DB can store token objects, but may require a password
before you access it (depending on if you have set a db password).
NSS Generic Crypto Services does not require a password, and thus
most operations use it. If you need to store a key, NSS can
usually move it in this case. If you are in FIPS mode there is
only one module, as you need to authenticate before you do any
crypto operation.</p>
<p>So it looks like we are still using the ecSlotList for mlkem
instead of adding a new mlkem slot list (sigh).</p>
<p>bob</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;[email protected]" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">dev-tech=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/mozill=
a.org/d/msgid/dev-tech-crypto/6bf8dc99-d299-4a4a-8588-ea8bdb57e69d%40redhat=
.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/mo=
zilla.org/d/msgid/dev-tech-crypto/6bf8dc99-d299-4a4a-8588-ea8bdb57e69d%40re=
dhat.com</a>.<br />
--------------GU7D0t0zqIYhlEZ8CRcXz3Mz--