openssh unix dev - Feb 2021 - PKCS#11 keys

These lines are for METHODS, i.e. RSA_METHOD and EC_KEY_METHOD. RSA keys can
share an RSA_METHOD,
and EC keys can share an EC_KEY_METHOD.  A method can be copied, for example an
OpenSSL engine
for using PKCS11, would then provide the routines in the method to not use the
default software version
of RSA signature or decrypting operations, but use PKCS11 to have these
operations done on the token or smart card.
So for RSA keys on the token, all these keys would share a copied and modified
RSA_METHOD PKCS11 method
where the rsa_idx in these keys is used to point to key specific data such as
PkCS11 slot and KeyIDs.



On 2/12/2021 10:31 AM, Dmitry Belyavskiy wrote:
> Hello,
> 
> Do I correctly understand that there can't be more than one key of each
> type of PKCS#11?
> 
> The lines
>
https://github.com/openssh/openssh-portable/blame/1bb130ed34721d46452529d094d9bbf045607d79/ssh-pkcs11.c#L191-L196
> seem to use the global variables for RSA/ECDSA pkcs11-related data
> structures.
> 
> Many thanks!
> 
-- 

  Douglas E. Engert  <DEEngert at gmail.com>

Dear Douglas,

Everything is fine with methods. But I'm speaking about the variables
rsa_idx and ec_key_idx, sorry for being unclear.
They serve as handles in a global OpenSSL table and identify a pkcs11_data
associated with a particular key, don't they?

On Sat, Feb 13, 2021 at 3:07 PM Douglas E Engert <deengert at gmail.com>
wrote:
> These lines are for METHODS, i.e. RSA_METHOD and EC_KEY_METHOD. RSA keys
> can share an RSA_METHOD,
> and EC keys can share an EC_KEY_METHOD.  A method can be copied, for
> example an OpenSSL engine
> for using PKCS11, would then provide the routines in the method to not use
> the default software version
> of RSA signature or decrypting operations, but use PKCS11 to have these
> operations done on the token or smart card.
> So for RSA keys on the token, all these keys would share a copied and
> modified RSA_METHOD PKCS11 method
> where the rsa_idx in these keys is used to point to key specific data such
> as PkCS11 slot and KeyIDs.
>
>
>
> On 2/12/2021 10:31 AM, Dmitry Belyavskiy wrote:
> > Hello,
> >
> > Do I correctly understand that there can't be more than one key of
each
> > type of PKCS#11?
> >
> > The lines
> >
>
https://github.com/openssh/openssh-portable/blame/1bb130ed34721d46452529d094d9bbf045607d79/ssh-pkcs11.c#L191-L196
> > seem to use the global variables for RSA/ECDSA pkcs11-related data
> > structures.
> >
> > Many thanks!
> >
>
> --
>
>   Douglas E. Engert  <DEEngert at gmail.com>
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>
>
-- 
Dmitry Belyavskiy