EC keys: implement vendor optimization when private key contains CKA_EC_POINT #347
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
space88man
force-pushed
the
fix-EC-test
branch
2 times, most recently
from
84720ad to
41a049e
Compare
space88man
changed the title
simo5
requested changes
Feb 22, 2024
space88man
force-pushed
the
fix-EC-test
branch
2 times, most recently
from
e0bae67 to
82a5fe8
Compare
- always attempt to fetch CKA_EC_POINT - vendor optimization (e.g. Thales Luna) to have CKA_EC_POINT in CKO_PRIVATE_KEY - avoid HSM search for public key - libp11 equivalent: OpenSC/libp11@281ccb3 Signed-off-by: S-P Chan <[email protected]>
space88man
force-pushed
the
fix-EC-test
branch
from
82a5fe8 to
3855c4c
Compare
simo5
approved these changes
Feb 26, 2024
|
Thanks, looks good, merging! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an optimization to avoid having a copy of the EC public key on HSM: some vendor implementations add CKA_EC_POINT to CKK_EC/CKO_PRIVATE_KEY to facilitate
EVP_PKEY_eq()-type comparisons—skip round-tripping to the HSM to find_associated_obj.This optimization is in OpenSC/libp11 see: : OpenSC/libp11@281ccb3
For both PR#346 PR#347 I found a discussion on libp11 about the round-tripping issue: OpenSC/libp11#209