<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
<br>
<span type="cite">Aleksey Sanin wrote:</span>
<p> </p>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title>
<title></title>
</title>
<div> <br>
<blockquote type="cite" cite="mid3EDE5328.7040904@netscape.com">
However, the very idea behind making this change is to eliminate the<br>
"unhygenic" practice of using private keys in the clear... <br>
</blockquote>
I don't see big difference between using private key in clear and
private <br>
key in pkcs8 file with no password or with "password" password. If
someone<br>
do not understand what is s/he doing then someone always find a way to
screw up<br>
him/herself :)</div>
</blockquote>
If you give people a safe with a provision to lock it, but they want to<br>
leave it unlocked, not much you can do about it :).<br>
But if you refuse to give them a safe without a locking provision,
atleast<br>
you're doing your part in discouraging bad habits....<br>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<div><br>
<br>
<blockquote type="cite" cite="mid3EDE5328.7040904@netscape.com"> But
if you insist....<br>
</blockquote>
I insist on keeping xmlsec backward compatible now. I don't know who use<br>
and what kind of scripts are based on a fact that "--privkey-der" loads
a clear<br>
text private key. Changing the library/utility behaiviour w/o warning
seems<br>
wrong to me. And for me, the issue does not seem important enough to go <br>
to xmlsec 2.0 :)</div>
</blockquote>
Agree. This change is one of those "best practices" thing, and isn't<br>
critical. To some extent it helps crypto engines, that are religious
about not<br>
supporting bad habits, leverage the test harness fully.<br>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<div><br>
<br>
<blockquote type="cite" cite="mid3EDE5328.7040904@netscape.com"> How
do --privkey-der-pkcs8 and --privkey-pem-pkcs8 sound?.<br>
</blockquote>
What about simple "--pkcs8-pem" and "--pkcs8-der"? What else besides<br>
private key could be there?</div>
</blockquote>
Nothing else.<br>
The difference between --privkey and --pkcs8 is marginal really.<br>
I lean towards --privkey because it becomes immediately obvious<br>
what the arg is. "pkcs8" may not be common knowledge. <br>
<br>
In either case, your test scripts will need another parameter in order<br>
to support all pvt key formats (der, pem, pkcs8 der, pkcs8 pem).<br>
<br>
I'll send the changes in a few days.<br>
<br>
-Tej<br>
<br>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<div><br>
<br>
Aleksey<br>
<br>
<br>
<br>
<br>
</div>
</blockquote>
</body>
</html>