<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body>
The truth is you that for RSA and DSA you have to have <br>
both public ( RSA: "modulus", "exponent" and DSA: "p", "q", <br>
"g", "y") and private (RSA: "private exponent", DSA: "x") key <br>
components to perform "private" key operations. Thus NSS *does*<br>
have public key information when it has private key. The only<br>
required thing is "export public key from private one" function.<br>
I would be really surprised if there is no one already. AFAIK, the <br>
"<a
href="http://lxr.mozilla.org/mozilla/ident?i=SECKEY_ConvertToPublicKey">SECKEY_ConvertToPublicKey</a>"
does exactly this. The only thing <br>
that xmlsec-nss has to do specially is to always have pointers to both<a
href="http://lxr.mozilla.org/mozilla/ident?i=SECKEYPublicKey"><br>
SECKEYPublicKey</a> and <a
href="http://lxr.mozilla.org/mozilla/ident?i=SECKEYPrivateKey">SECKEYPrivateKey</a>.
The conversion from <br>
private to public key could be done "on-demand" or "by default"<br>
(I would expect this to be a "fast" operation).<br>
<br>
As you mentioned in option 3) implementing option 1) would mean<br>
changing core xmlsec internals. As I've explained above, I don't see<br>
reasons for this right now.<br>
<br>
Aleksey<br>
<br>
<br>
<br>
<br>
</body>
</html>