Re: OpenSSL provider support in openldap: OSSL_STORE_open()
Graham Leggett <[email protected]> Wed, 3 Jan 2024 18:15:56 +0000
| Newsgroups | gmane.network.openldap.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_1B307E70-FA51-4F6C-A192-DE7D306F4060 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 03 Jan 2024, at 18:02, Howard Chu <[email protected]> wrote: >> https://bugs.openldap.org/show_bug.cgi?id=3D10149 >=20 > Looks a bit like a chicken'n'egg situation, why should anyone trust = the connection that was used to > retrieve certs and keys from the designated URI? Not at all. We=E2=80=99re referring to URIs known to crypto libraries, such as = pkcs11 URLs (for smartcard interfaces) and tpmkey URIs for TPM chips. https://www.rfc-editor.org/rfc/rfc7512.html https://datatracker.ietf.org/doc/html/draft-mavrogiannopoulos-tpmuri-01 By default OpenSSL always supports the file:// URI, which points at PEM = encoded certs/keys/crls/params/etc. Other URIs might point at the MacOS keychain, or the Windows crypto api. = It=E2=80=99s up to the crypto library. Regards, Graham =E2=80=94 --Apple-Mail=_1B307E70-FA51-4F6C-A192-DE7D306F4060 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">On 03 Jan = 2024, at 18:02, Howard Chu <[email protected]> = wrote:<div><br><div><blockquote type=3D"cite"><div><div><blockquote = type=3D"cite">https://bugs.openldap.org/show_bug.cgi?id=3D10149<br></block= quote><br>Looks a bit like a chicken'n'egg situation, why should anyone = trust the connection that was used to<br>retrieve certs and keys from = the designated URI?<br></div></div></blockquote><div><br></div><div>Not = at all.</div><div><br></div><div>We=E2=80=99re referring to URIs known = to crypto libraries, such as pkcs11 URLs (for smartcard interfaces) and = tpmkey URIs for TPM chips.</div><div><br></div><div><a = href=3D"https://www.rfc-editor.org/rfc/rfc7512.html">https://www.rfc-edito= r.org/rfc/rfc7512.html</a><br></div><div></div><div><a = href=3D"https://datatracker.ietf.org/doc/html/draft-mavrogiannopoulos-tpmu= ri-01">https://datatracker.ietf.org/doc/html/draft-mavrogiannopoulos-tpmur= i-01</a></div><div><br></div><div>By default OpenSSL always supports the = file:// URI, which points at PEM encoded = certs/keys/crls/params/etc.</div><div><br></div><div>Other URIs might = point at the MacOS keychain, or the Windows crypto api. It=E2=80=99s up = to the crypto = library.</div><div><br></div></div>Regards,</div><div>Graham</div><div>=E2= =80=94</div><div><br></div></body></html>= --Apple-Mail=_1B307E70-FA51-4F6C-A192-DE7D306F4060--