<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
The PKCS8 file containing the encrypted private key can be<br>
either in PEM or DER format, so the backward compatibility<br>
is not really broken. The API for loading the key from<br>
PEM/DER files takes in a password argument already, so<br>
no API changes are needed to use PKCS8 files.<br>
<br>
-Tej<br>
<br>
<br>
<span type="cite">Aleksey Sanin wrote:</span>
<p> </p>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title>
<title></title>
</title>
<div> The changes you suggest would break the backward compatibility<br>
(xmlsec command line options are also an API). Probably the right<br>
way would be:<br>
<br>
1) define new xmlSecKeyDataFormatPkcs8 item in xmlSecKeyDataFormat enum<br>
2) implement PKCS8 keys loading in xmlSecCryptoAppKeyLoad<br>
3) fix xmlSecAppCryptoSimpleKeysMngrKeyAndCertsLoad to load DER certs<br>
when Pkcs8 format is specified<br>
4) Add new "privkeyPkcs8Param" for "--privkey-pkcs8" option<br>
5) update tests scripts<br>
<br>
xmlsec-nss might not support loading PEM and DER private key but other<br>
implementations might still find use for it.<br>
<br>
Aleksey<br>
</div>
_______________________________________________ xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a> <a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a> </blockquote>
</body>
</html>