<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body>
Hi, Tej!<br>
<br>
Thanks a lot for the work you are doing! I did a quick look other your <br>
patch and it looks pretty good and I'll try to review it other weekend.<br>
However, I've already spotted one big problem: the new files you've <br>
wrote still have my copyright string :) Probably it's a good idea to <br>
change it :) Also this is a large patch and I have to ask you the usual<br>
question: are you and your company OK with releasing this code<br>
under MIT license as part of XMLSec library? I would appreciate<br>
if you can send a patch to AUTHORS and/or Copyright files (if needed).<br>
<br>
I also would like to post to the list the issues and questions for your
patch <br>
you've sent to me this morning. Also please find my comments interlaced<br>
with your text.<br>
<br>
Aleksey<br>
<br>
<br>
Tejkumar Arora wrote:<br>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif"><font size="2"></font></font>There are some
hurdles to cross before I can submit <br>
some more work: <br>
1) ability to import private key in p8 file. I've had very <br>
lengthy discussions on this with the NSS team. I'm currently <br>
trying a workaround. If the workaround fails, the backup <br>
plan is to use a pre-populated NSS db, and make changes to <br>
the test scripts for NSS. For appls that import CRLs, <br>
it looks like I might be forced to use a NSS db anyway <br>
(i.e. NSS_NoDB_Init isn't working). </blockquote>
Fine with me. I think it's a right approach to use NSS keysdb<br>
for default NSS keys manager (see also 5c) from your list :) ). <br>
Thought I think that an ability to import PKCS#8 file would be nice.<br>
<br>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"> 2) NSS
needs to expose a function to convert an arbitrarily long <br>
decimal string to a DER integer (for finding certs by Issuer & <br>
cert serial number) <br>
3) RSAOAEP support needs to be implemented in NSS <br>
4) Finding a cert by subject key id needs to be fixed in NSS <br>
5) I need to finish up <br>
a) pkcs12 file loading - I'll need help from NSS team on this. <br>
This isn't used by test harness now but need to do it. <br>
b) custom key store for NSS crypto lib (which will allow finding <br>
keys/certs loaded from files, or pre-existing in NSS db <br>
c) sort out the issue of multiple token passwords, besides <br>
key file passwords <br>
d) finish up (except for rsa-oaep) key transport support (equivalent
of kt* kw* in src/openssl).<br>
<br>
Aleksey, For your particular attention: <br>
1) I made some gratuitous changes (e.g. remove "Evp" from NSS function <br>
names) </blockquote>
Sure, this is a right thing to do :)<br>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><br>
2) added error code to several error messages </blockquote>
Also a very good idea :)<br>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><br>
3) you had a comment about not being able to make PK11_GetBestSlot
work. <br>
Turns out that RIPEMD160-HMAC is not supported in NSS - there <br>
are symbols in the headers, but no code... that's when <br>
PK11_GetBestSlot returned NULL </blockquote>
Ha! I spent some time thinking why it does not work :) <br>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"> 4) The
CRL you have in the example file (signature-x509-crt-crl.xml) <br>
is signed by a CA cert, whose x509v3 extensions indicate that the <br>
cert is not to be used for CRL signing. NSS does strict checking, <br>
and importing the CRL failed. I had to get around it by passing a <br>
flag to bypass strict checks. It is probably a good idea to <br>
change your test harness to use a proper cert. </blockquote>
It's more difficult than it sounds. I got this file from Merlin and I
don't have<br>
private key or the signer cert/private key. Thus I doubt I can do
something abou this.<br>
Can you do following:<br>
- add XMLSEC_KEYINFO_FLAGS_X509DATA_SKIP_STRICT_CHECKS to keyinfo.h<br>
- add a command line option to the xmlsec command line tool to set
this flag<br>
in the xmlSecKeyInfoCtx for reading<br>
<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>