thanks! Unfortunately there is no pkcs11 wrapper for this device. There are a few commands implementing RSA operations (generate keyPair, PreMaster decrypt) and I have to use them to perform server-side SSL handshake. OpenSC looks very interesting for my task. Pavel ----- "openssl-users" <openssl-users-bounces at openssl.org>: ----- Re: [openssl-users] External hardware for SSL handshake (overriding PreMasterSecret decrypt) On 27/05/2015 15:26, Pavel Abramov wrote: Hi, I have a task to use external Security Module to perform RSA functions in my WEB-server (nginx/httpd using OpenSSL for HTTPS). The goal is to store Server private key components and establish SSL Handshake using Hardware module. It is not an SSL hardware accelerator. This device has proprietary API (binary protocol over TCP/UDP, a few commands like "generate RSA key pair", "premaster decrypt using key#123"). What is the easiest way to do it? Will be very grateful for keywords/advices. Should I write my ENGINE ? Or is there any other way? I need only 2 functions to perform using hardware: - RSA key generation (private component will be saved in hardware module) - PreMaster decrypt from client during SSL handshake How to override only these 2 functions? ------------------------------- If there is a generic engine wrapping pkcs11 or a similar API, it may or may not be easier to implement (or reuse if already provided) a hardware specific pkcs11 (or similar) driver. I am unsure if there is or is not a well maintained pkcs11 engine for OpenSSL, either in the OpenSSL project or elsewhere.? Maybe the opensc project has one, but I don't know if that would be general or specific to opensc pkcs11 drivers. Keywords to search for: pkcs11, pkcs11 engine, opensc project, openssl engine. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. ?http://www.wisemo.com Transformervej 29, 2860 S?borg, Denmark. ?Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded _______________________________________________ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
