Re: Thoughts on a new mscng backend
Dmitry Belyavsky <[email protected]> Wed, 9 May 2018 16:30:02 +0300
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <CADqLbzL81FTus9Mb8TwjqzeFURbtjRJCFczau_ar4JWubwJVGA@mail.gmail.com> |
--===============0972242469== Content-Type: multipart/alternative; boundary="00000000000077995b056bc5e6e9" --00000000000077995b056bc5e6e9 Content-Type: text/plain; charset="UTF-8" No, there is no GOST CNG-based backend. On Mon, May 7, 2018 at 7:59 PM, Aleksey Sanin <[email protected]> wrote: > Thank you! > > Aleksey > > On 5/7/18 12:23 AM, Dmitry Belyavsky wrote: > > I'll ask whether there is any CNG-based GOST implementation. > > > > On Sat, May 5, 2018 at 5:08 AM, Aleksey Sanin <[email protected] > > <mailto:[email protected]>> wrote: > > > > Thanks for all the code you've wrote! > > > > I think the only area missing is GOST algorithms support. It > > requires special configs/dlls on Windows so I don't know if > > it is even available for MSCNG. May be someone on the list > > has direct knowledge and can chime in? > > > > I was planning to ask you what would be the right time to do > > an xmlsec release. Sounds like in a couple weeks is the right > > timeline. I think it would be great to have others play with > > mscng to find out any issues. But otherwise, it looks great! > > > > Aleksey > > > > On 5/4/18 8:33 AM, Miklos Vajna wrote: > > > Hi, > > > > > > On Thu, Jan 04, 2018 at 03:24:51PM -0800, Aleksey Sanin > > <[email protected] <mailto:[email protected]>> wrote: > > >> That sounds like a great plan! I would recommend to use the > > >> skeleton folder to start. > > > > > > Thanks for all the reviews, current master looks reasonable to me > > when I > > > compare 'make check' output of the mscrypto and mscng backends: > > > > > > - 0 tests pass only on mscrypto > > > - 126 tests pass on both mscrypto and mscng > > > - 3 tests pass only on mscng (ecdsa signing with sha1/256/512) > > > > > > I wonder what else is missing so it could be claimed that the mscng > > > backend is more or less a drop-in replacement for the mscrypto one. > > > There are two things I can think of: > > > > > > - mscrypto supports reading your OS-level certificates and use that > > > during e.g. signing. > > > > > > - There are a few functions which are part of the mscrypto public > API > > > (e.g. xmlSecMSCryptoX509StoreAdoptKeyStore()) and there is no > mscng > > > equivalent yet. Those are probably interesting as e.g. > LibreOffice > > > uses those functions. > > > > > > I plan to get to these two in the next few weeks. But is there > > anything > > > else larger missing? > > > > > > Thanks, > > > > > > Miklos > > > > > > > > > > > > _______________________________________________ > > > xmlsec mailing list > > > [email protected] <mailto:[email protected]> > > > http://www.aleksey.com/mailman/listinfo/xmlsec > > <http://www.aleksey.com/mailman/listinfo/xmlsec> > > > > > _______________________________________________ > > xmlsec mailing list > > [email protected] <mailto:[email protected]> > > http://www.aleksey.com/mailman/listinfo/xmlsec > > <http://www.aleksey.com/mailman/listinfo/xmlsec> > > > > > > > > > > -- > > SY, Dmitry Belyavsky > -- SY, Dmitry Belyavsky --00000000000077995b056bc5e6e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">No, there is no GOST CNG-based backend.</div><div class=3D= "gmail_extra"><br><div class=3D"gmail_quote">On Mon, May 7, 2018 at 7:59 PM= , Aleksey Sanin <span dir=3D"ltr"><<a href=3D"mailto:[email protected]= " target=3D"_blank">[email protected]</a>></span> wrote:<br><blockquot= e class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc sol= id;padding-left:1ex">Thank you!<br> <br> Aleksey<br> <span class=3D""><br> On 5/7/18 12:23 AM, Dmitry Belyavsky wrote:<br> > I'll ask whether there is any CNG-based GOST implementation.<br> > <br> > On Sat, May 5, 2018 at 5:08 AM, Aleksey Sanin <<a href=3D"mailto:al= [email protected]">[email protected]</a><br> </span><span class=3D"">> <mailto:<a href=3D"mailto:[email protected]= om">[email protected]</a>>> wrote:<br> > <br> >=C2=A0 =C2=A0 =C2=A0Thanks for all the code you've wrote!<br> > <br> >=C2=A0 =C2=A0 =C2=A0I think the only area missing is GOST algorithms su= pport. It<br> >=C2=A0 =C2=A0 =C2=A0requires special configs/dlls on Windows so I don&#= 39;t know if<br> >=C2=A0 =C2=A0 =C2=A0it is even available for MSCNG. May be someone on t= he list<br> >=C2=A0 =C2=A0 =C2=A0has direct knowledge and can chime in?<br> > <br> >=C2=A0 =C2=A0 =C2=A0I was planning to ask you what would be the right t= ime to do<br> >=C2=A0 =C2=A0 =C2=A0an xmlsec release. Sounds like in a couple weeks is= the right<br> >=C2=A0 =C2=A0 =C2=A0timeline. I think it would be great to have others = play with<br> >=C2=A0 =C2=A0 =C2=A0mscng to find out any issues. But otherwise, it loo= ks great!<br> > <br> >=C2=A0 =C2=A0 =C2=A0Aleksey<br> > <br> >=C2=A0 =C2=A0 =C2=A0On 5/4/18 8:33 AM, Miklos Vajna wrote:<br> >=C2=A0 =C2=A0 =C2=A0> Hi,<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> On Thu, Jan 04, 2018 at 03:24:51PM -0800, Alek= sey Sanin<br> </span><div><div class=3D"h5">>=C2=A0 =C2=A0 =C2=A0<<a href=3D"mailto= :[email protected]">[email protected]</a> <mailto:<a href=3D"mailto:= [email protected]">[email protected]</a>>> wrote:<br> >=C2=A0 =C2=A0 =C2=A0>> That sounds like a great plan! I would rec= ommend to use the<br> >=C2=A0 =C2=A0 =C2=A0>> skeleton folder to start.<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> Thanks for all the reviews, current master loo= ks reasonable to me<br> >=C2=A0 =C2=A0 =C2=A0when I<br> >=C2=A0 =C2=A0 =C2=A0> compare 'make check' output of the msc= rypto and mscng backends:<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> - 0 tests pass only on mscrypto<br> >=C2=A0 =C2=A0 =C2=A0> - 126 tests pass on both mscrypto and mscng<br= > >=C2=A0 =C2=A0 =C2=A0> - 3 tests pass only on mscng (ecdsa signing wi= th sha1/256/512)<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> I wonder what else is missing so it could be c= laimed that the mscng<br> >=C2=A0 =C2=A0 =C2=A0> backend is more or less a drop-in replacement = for the mscrypto one.<br> >=C2=A0 =C2=A0 =C2=A0> There are two things I can think of:<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> - mscrypto supports reading your OS-level cert= ificates and use that<br> >=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0during e.g. signing.<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> - There are a few functions which are part of = the mscrypto public API<br> >=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0(e.g. xmlSecMSCryptoX509StoreAdopt= Ke<wbr>yStore()) and there is no mscng<br> >=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0equivalent yet. Those are probably= interesting as e.g. LibreOffice<br> >=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0uses those functions.<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> I plan to get to these two in the next few wee= ks. But is there<br> >=C2=A0 =C2=A0 =C2=A0anything<br> >=C2=A0 =C2=A0 =C2=A0> else larger missing?<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> Thanks,<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> Miklos<br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0> ______________________________<wbr>___________= ______<br> >=C2=A0 =C2=A0 =C2=A0> xmlsec mailing list<br> </div></div>>=C2=A0 =C2=A0 =C2=A0> <a href=3D"mailto:[email protected]= om">[email protected]</a> <mailto:<a href=3D"mailto:[email protected]"= >[email protected]</a>><br> >=C2=A0 =C2=A0 =C2=A0> <a href=3D"http://www.aleksey.com/mailman/list= info/xmlsec" rel=3D"noreferrer" target=3D"_blank">http://www.aleksey.com/<w= br>mailman/listinfo/xmlsec</a><br> <span class=3D"">>=C2=A0 =C2=A0 =C2=A0<<a href=3D"http://www.aleksey.= com/mailman/listinfo/xmlsec" rel=3D"noreferrer" target=3D"_blank">http://ww= w.aleksey.com/<wbr>mailman/listinfo/xmlsec</a>><br> >=C2=A0 =C2=A0 =C2=A0><br> >=C2=A0 =C2=A0 =C2=A0______________________________<wbr>________________= _<br> >=C2=A0 =C2=A0 =C2=A0xmlsec mailing list<br> </span>>=C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:[email protected]">xmlsec= @aleksey.com</a> <mailto:<a href=3D"mailto:[email protected]">xmlsec@al= eksey.com</a>><br> >=C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.aleksey.com/mailman/listinfo/= xmlsec" rel=3D"noreferrer" target=3D"_blank">http://www.aleksey.com/<wbr>ma= ilman/listinfo/xmlsec</a><br> <div class=3D"HOEnZb"><div class=3D"h5">>=C2=A0 =C2=A0 =C2=A0<<a href= =3D"http://www.aleksey.com/mailman/listinfo/xmlsec" rel=3D"noreferrer" targ= et=3D"_blank">http://www.aleksey.com/<wbr>mailman/listinfo/xmlsec</a>><b= r> > <br> > <br> > <br> > <br> > -- <br> > SY, Dmitry Belyavsky<br> </div></div></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br>= <div class=3D"gmail_signature" data-smartmail=3D"gmail_signature">SY, Dmitr= y Belyavsky</div> </div> --00000000000077995b056bc5e6e9-- --===============0972242469== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls bWFuL2xpc3RpbmZvL3htbHNlYwo= --===============0972242469==--