OpenSSL 3 | Providers | Support broader range of URI schemes for loading keys
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 276
- Forks
- 200
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 7
Description
We've been using the OpenSSL::Engine to load keys from an HSM thorough a PKCS#11 interface (with the corresponding engine installed).
The Engine API was deprecated in OpenSSL 3 and there seems to be no alternatives for it at the moment using Provider API. The providers can only be loaded, but there seems to be no way to load keys using an uri (for ex. pkcs11 uri scheme)
In the migration guide, the proposed alternative is the usage of OSSL_STORE. As far as I can tell, the PKey interface only supports BIO inputs.
At the moment, I ended up writing a crude C extension that seems to do the job, but it's definitely not a production ready solution.
Are there any plans to bring back the functionality similar to Engines? Or maybe I've missed other available options?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the issue's OpenSSL::Engine and PKey references alongside the proposed OSSL_STORE approach in the OpenSSL 3 migration guide. Compare the current BIO-only path with the requested URI-based key loading, including PKCS#11, and confirm the desired API with maintainers before defining completion criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, ruby
- Domain
- cryptography
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100