<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
<font face="Arial,sans-serif"><font size="2">The new patch is attached.<br>
<br>
<span type="cite">Aleksey Sanin wrote:</span> </font></font>
<p><font face="Arial,sans-serif" size="2"> </font></p>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;"><font
face="Arial,sans-serif" size="2"> Hi, Tej!<br>
<br>
Thanks a lot for the work you are doing! I did a quick look other your <br>
patch and it looks pretty good and I'll try to review it other weekend.<br>
However, I've already spotted one big problem: the new files you've <br>
wrote still have my copyright string :) Probably it's a good idea to <br>
change it :) </font></blockquote>
<font size="2"><font face="Arial,sans-serif">ok, if you insist :).<br>
<br>
</font></font>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;"><font
face="Arial,sans-serif" size="2">Also this is a large patch and I have
to ask you the usual<br>
question: are you and your company OK with releasing this code<br>
under MIT license as part of XMLSec library? I would appreciate<br>
if you can send a patch to AUTHORS and/or Copyright files (if needed).</font></blockquote>
<font size="2"><font face="Arial,sans-serif">This activity is approved
by my boss :). The main thing is that my<br>
colleagues, who are intimately involved with NSS & mozilla know
about<br>
this.<br>
<br>
I've patched both files.... <br>
<br>
Wan-Teh, What do you think of the following addition to "Copyright"
file:<br>
<br>
<i><b>Portions of the Software were created using source code and/or
APIs<br>
governed by the Mozilla Public License (MPL). The MPL is available<br>
at <a class="moz-txt-link-freetext" href="http://www.mozilla.org/MPL/MPL-1.1.html">http://www.mozilla.org/MPL/MPL-1.1.html</a>. The MPL permits such<br>
portions to be distributed with code not governed by MPL, as long<br>
as the requirements of MPL are fulfilled for such portions.</b></i><br>
<br>
</font></font>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;"><font
face="Arial,sans-serif" size="2"><br>
<br>
I also would like to post to the list the issues and questions for your
patch <br>
you've sent to me this morning. Also please find my comments interlaced<br>
with your text.<br>
<br>
Aleksey<br>
<br>
<br>
Tejkumar Arora wrote:<br>
</font>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif" size="2">There are some hurdles to cross
before I can submit <br>
some more work: <br>
1) ability to import private key in p8 file. I've had very <br>
lengthy discussions on this with the NSS team. I'm currently <br>
trying a workaround. If the workaround fails, the backup <br>
plan is to use a pre-populated NSS db, and make changes to <br>
the test scripts for NSS. For appls that import CRLs, <br>
it looks like I might be forced to use a NSS db anyway <br>
(i.e. NSS_NoDB_Init isn't working). </font></blockquote>
<font face="Arial,sans-serif" size="2"> Fine with me. I think it's a
right approach to use NSS keysdb<br>
for default NSS keys manager (see also 5c) from your list :) ). <br>
Thought I think that an ability to import PKCS#8 file would be nice.<br>
<br>
</font>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif" size="2"> 2) NSS needs to expose a function to
convert an arbitrarily long <br>
decimal string to a DER integer (for finding certs by Issuer & <br>
cert serial number) <br>
3) RSAOAEP support needs to be implemented in NSS <br>
4) Finding a cert by subject key id needs to be fixed in NSS <br>
5) I need to finish up <br>
a) pkcs12 file loading - I'll need help from NSS team on this. <br>
This isn't used by test harness now but need to do it. <br>
b) custom key store for NSS crypto lib (which will allow finding <br>
keys/certs loaded from files, or pre-existing in NSS db <br>
c) sort out the issue of multiple token passwords, besides <br>
key file passwords <br>
d) finish up (except for rsa-oaep) key transport support (equivalent
of kt* kw* in src/openssl).<br>
<br>
Aleksey, For your particular attention: <br>
1) I made some gratuitous changes (e.g. remove "Evp" from NSS function <br>
names) </font></blockquote>
<font face="Arial,sans-serif" size="2"> Sure, this is a right thing to
do :)<br>
</font>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif" size="2"><br>
2) added error code to several error messages </font></blockquote>
<font face="Arial,sans-serif" size="2"> Also a very good idea :)<br>
</font>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif" size="2"><br>
3) you had a comment about not being able to make PK11_GetBestSlot
work. <br>
Turns out that RIPEMD160-HMAC is not supported in NSS - there <br>
are symbols in the headers, but no code... that's when <br>
PK11_GetBestSlot returned NULL </font></blockquote>
<font face="Arial,sans-serif" size="2"> Ha! I spent some time thinking
why it does not work :) <br>
</font>
<blockquote type="cite" cite="mid3F036DA3.3030109@netscape.com"><font
face="Arial,sans-serif" size="2"> 4) The CRL you have in the example
file (signature-x509-crt-crl.xml) <br>
is signed by a CA cert, whose x509v3 extensions indicate that the <br>
cert is not to be used for CRL signing. NSS does strict checking, <br>
and importing the CRL failed. I had to get around it by passing a <br>
flag to bypass strict checks. It is probably a good idea to <br>
change your test harness to use a proper cert. </font></blockquote>
<font face="Arial,sans-serif" size="2"> It's more difficult than it
sounds. I got this file from Merlin and I don't have<br>
private key or the signer cert/private key. Thus I doubt I can do
something abou this.<br>
Can you do following:<br>
- add XMLSEC_KEYINFO_FLAGS_X509DATA_SKIP_STRICT_CHECKS to keyinfo.h<br>
- add a command line option to the xmlsec command line tool to set
this flag<br>
in the xmlSecKeyInfoCtx for reading</font></blockquote>
<font size="2"><font face="Arial,sans-serif">done. by default, strict
checks are on. In the test harness, I turned<br>
off strict checks with --X509-skip-strict-checks (I know the name is
long ;) ).<br>
<br>
</font></font><font face="Arial,sans-serif"><font size="2"> <span
type="cite"
style="-moz-user-select: all ! important; white-space: nowrap;">