Skip to content

Conversation

mcr
Copy link
Contributor

@mcr mcr commented Aug 13, 2025

This code uses the openssl 3.x OSSL_STORE_* APIs to load key objects.
The older d2i_* and PEM_read_* do not interact at all with providers.
This does not solve generating keys using a provider.

@rhenium
Copy link
Member

rhenium commented Aug 27, 2025

"handle" seems to be a TPM terminology. Since OpenSSL's man page for OSSL_STORE_open() only says that it takes an URI, "uri" would be a better name here.

This needs changes:

  • Please add tests.
  • The code formatting should match the existing style.
  • OSSL_STORE_INFO_get1_PKEY() appears to handle private keys only, not public keys or parameters-only pkeys.
  • The second parameter pwd is unused.
  • OSSL_STORE and OSSL_STORE_INFO are not freed.

@rhenium
Copy link
Member

rhenium commented Aug 27, 2025

The older d2i_* and PEM_read_* do not interact at all with providers.

ruby/openssl uses OSSL_DECODER with OpenSSL 3 instead of d2i_*() and PEM_read_*() functions. It does actually interact with providers, as long as the provider supports encoding the key reference into DER/PEM.

Support for OSSL_STORE_open() would be useful. This should resolve #722.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants