mbox

[Openvpn-devel,0/1] add engine keys keys

Message ID 1509192147.3021.6.camel@HansenPartnership.com
Headers show

Message

James Bottomley Oct. 28, 2017, 1:02 a.m. UTC 
Engine keys are an openssl concept for a key file which can only be
understood by an engine (usually because it's been wrapped by the
engine itself).  We use this for TPM engine keys, so you can either
generate them within your TPM or wrap them from existing private keys.
 Once wrapped, the keys will only function in the TPM that generated
them, so it means the VPN keys are tied to the physical platform, which
is very useful.  Engine keys have to be loaded via a specific callback,
so use this as a fallback in openvpn if an engine is specified and if
the PEM read of the private key fails.

James

---

James Bottomley (1):
  openssl: add engine method for loading the key

 src/openvpn/crypto_backend.h | 13 ++++++++++++
 src/openvpn/crypto_openssl.c | 49 ++++++++++++++++++++++++++++++++++++++++++++
 src/openvpn/ssl_openssl.c    |  6 +++++-
 3 files changed, 67 insertions(+), 1 deletion(-)

-- 
2.12.3

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot