Using RSA keys by reference in the pkcs#11 engine (II.)

UPDATE (2009-11-12): The feature is in Nevada build 129 now, and I've blogged about that.

UPDATE (2007-11-21): I fixed some bugs, there is a newer version of the patch: pkcs11_engine-0.9.8g.patch.2007-11-21. See the README for changes.

I've updated the recent patch because I was exporting some private attributes from the key store into the RSA structure; and that wasn't needed of course. Now only public attributes are exported and everything else performed in the token. The patch was also updated for the new OpenSSL 0.9.8f.

The next version will hopefully contain a proper URI for referencing the key and also a way to specify an external program for setting the PIN.

The patch is pkcs11_engine-0.9.8f.patch.2007-10-15; please see README for more information.



Where can I see the report and/or the patch for you "Prevent ssh from using a trusted X11 cookie if creation of an untrusted cookie fails" ?

I been looking all over the internet but can't find it :(

Posted by Kmilo on November 02, 2007 at 05:29 PM CET #

hi Kmilo, you can find the fix in a single commit to OpenSSH CVS:;r2=1.167;f=h

in OpenSolaris, the change was part of the whole X11 untrusted forwarding resync; that's why SunSSH wasn't affected.

Posted by Jan on November 03, 2007 at 04:32 AM CET #

This is a great patch, it works wonderfully for RSA keys !

I am, however, having troubles with symmetric keys in that after a call to EVP_CIPHER_CTX_cleanup() subsequent use of that context after re-initialization fails during EVP_CipherFinal_ex() with the error:
error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt

This doesn't happen with the built-in cipher processing.

Posted by Brett on November 30, 2007 at 11:56 AM CET #

Brett, any piece of code ready to compile I could try and see the problem? If you are interested please contact me directly. Thanks.

Posted by Jan on December 03, 2007 at 05:08 AM CET #

In hw_pk11.c at the end of pk11_choose_slot() the free(pSlotList)
should be OPENSSL_free(pSlotList) !

Posted by Francis Dupont on January 31, 2008 at 09:52 AM CET #

Following the directions in the README file we are trying to install the '0.9.8g' patch on a Solaris 10 box (SunOS ruff 5.10 Generic_120011-14 sun4v sparc SUNW,Sun-Fire-T200) but get the following:

% patch -p1 < ../pkcs11_engine-0.9.8g.patch.2007-11-21
Looks like a new-style context diff.
File to patch:


Posted by Dave Hostetter on February 25, 2008 at 09:14 AM CET #

on Solaris, use gpatch(1) please.

Posted by Jan on February 25, 2008 at 09:18 AM CET #

to Francis:

6667273 OpenSSL engine should not use free() but OPENSSL_free()

was filed. Thanks.

Posted by Jan on February 25, 2008 at 09:31 AM CET #

Dear Jan,
I am working on a research about using OpenSSL hardware keystore/token. Especially I would like to use OpenSSL (patched with this patch) and Solaris Crypto Framework to access the keystore of a SUN Crypto Accelerator 6000. I found a bug report from SUN about this: but I am not sure if this means that there is a problem with the SUN Crypto Framework handling hardware keystores or if this bug report is now almost solved by your patch.
My questions: Does your patch support key generation through pkcs#11 API or "importing" or do you maybe know if this is an issue with OpenSolaris-libraries?
Thank you very much for your work, I will provide you with feedback as soon as I start with prototyping.


Posted by René on July 17, 2008 at 07:39 AM CEST #

to René: 6479874 in Defer state means that we don't have that support in the PKCS#11 engine shipped with Solaris. If you want that support you must use beta code in this patch.

there is no support for generating the keys in the token, as well as no support for handling symmetric keys. Also, only RSA is supported, not DSA nor DH. The reason is that the ENGINE API supports only loading pub/priv RSA keys. The OpenSSL ENGINE API would have to be extended to support other operations.

Posted by Jan on July 17, 2008 at 07:51 AM CEST #


I'm also interested in using the OpenSSL pkcs11 engine to access the Sun Crypto 6000 HSM keystore by reference. In your latest patch update for OpenSSL 0.9.8j, the readme still states that support for this is experimental and currently disabled. My interest is supporting RedHat Linux ES5 with your engine patch. From what I can tell, the experimental code is ifdef'd for Sun builds.

Our application uses the OpenSSL interface to export SSL decryption operations and would like to maintain this using the pkcs11 engine and the Sun Crypto 6000 HSM keystore. So far, I've got it working with the pkcs11 engine but no provision to use the HSM keystore private key.

Any updated information with regards to this would be much appreciated.


Posted by George on March 25, 2009 at 05:36 PM CET #

Post a Comment:
  • HTML Syntax: NOT allowed

Jan Pechanec


« June 2016