From darrenm@sac.sfbay.sun.com Thu Aug 2 09:28:27 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72GSQlA019815 for ; Thu, 2 Aug 2007 09:28:26 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l72GPrvW023203; Fri, 3 Aug 2007 00:26:11 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500A0TMZKNM00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 09:26:08 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500K3LMZKV4A0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 09:26:08 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l72GQ7e6026656; Thu, 02 Aug 2007 09:26:07 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72GSLt1019810; Thu, 02 Aug 2007 09:28:21 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id l72GSLFm019806; Thu, 02 Aug 2007 09:28:21 -0700 (PDT) Date: Thu, 02 Aug 2007 09:28:21 -0700 (PDT) From: Darren J Moffat Subject: Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] To: PSARC-ext@sun.com Cc: crypto-discuss@opensolaris.org Message-id: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 5286 I'm sponsoring this case for Mark Powers. I'm marking it as Self Review since it really only adds new mechanisms to the crypto framework doesn't provide any new or changed APIs or change anything for a user, developer or administrator. Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Elliptic-Curve Cryptography for Solaris 1.2. Name of Document Author/Supplier: Author: Mark Powers 1.3 Date of This Document: 02 August, 2007 2. Project Summary 2.1. Project Description: This project will add Elliptic-Curve Cryptography (ECC) to the Solaris Encryption Framework. ECC will be available to kernel and user-level consumers. 2.2. Risks and Assumptions: 3. Business Summary 3.1. Problem Area: Larger RSA keys require considerable computational effort. This makes it difficult to use large RSA keys on devices with limited resources. ECC keys provide the same level of security and require less computational effort than larger RSA keys. 3.2. Market/Requester: Government is the primary customer. NSA announced Suite B, which includes ECC on February 16 2005. Sun has announced support for ECC: http://www.sun.com/smi/Press/sunflash/2006-02/sunflash.20060214.2.xml 3.3. Business Justification: 3.4. Competitive Analysis: Microsoft Vista supports ECC Java supports ECC 3.5. Opportunity Window/Exposure: We are late. 3.6. How will you know when you are done?: When we can use pkcs11 on Apache for ECC. 4. Technical Description: 4.1. Details: The Solaris Crypto Framework has loadable software modules that provides cryptographic algorithms for kernel consumers. These offer algorithms such as AES and RSA. The framework also has a softtoken library that implements algorithms for user-level consumers. This project introduces a new module offering ECC. It also adds ECC to the softtoken library. The low-level implemention of ECC that we will use was originally developed by Sun Labs and subsequently given to NSS. Legal approval to use this code under Mozilla Public License v. 1.1 has been obtained. Supported PKCS#11 mechanisms are: CKM_EC_KEY_PAIR_GEN, CKM_ECDSA, CKM_ECDSA_SHA1, and CKM_ECDH1_DERIVE. NSS implements 51 ECC curves, all of which will be supported. They are: secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, secp160r1, secp160r2, secp192k1, secp224k1, secp224r1, secp256k1, secp384r1, secp521r1, sect113r1, sect113r2, sect131r1, sect131r2, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, c2pnb163v1, c2pnb163v2, c2pnb163v3, c2pnb176v1, c2tnb191v1, c2tnb191v2, c2tnb191v3, c2pnb208w1, c2tnb239v1, c2tnb239v2, c2tnb239v3, c2pnb272w1, c2pnb304w1, c2tnb359v1, c2pnb368w1, c2tnb431r1, prime192v1, prime192v2, prime192v3, prime256v1 4.2. Bug/RFE Number(s): 5066901 Offer the PKCS#11 Elliptic Curve based mechanisms in Solaris 6562402 kernel software provider for Elliptic Curve mechanisms 4.3. In Scope: 4.4. Out of Scope: 4.5. Interfaces: Changes to softtoken will not affect the interface to softtoken. The only visible change will be four new PKCS#11 mechanisms that are visible when the capabilities of the softtoken are queried. The loadable module will introduce the following: /kernel/crypto/ecc /kernel/crypto/amd64/ecc /kernel/crypto/sparcv9/ecc 4.6. Doc Impact: pkcs11_softtoken(5) 4.7. Admin/Config Impact: An entry for the loadable module will be added to /etc/crypto/kcf.conf. This, however, is a private interface. 4.8. HA Impact: No impact. 4.9. I18N/L10N Impact: No impact. 4.10. Packaging & Delivery: The new loadable module will be delivered via SUNWckr. The modified softtoken will be delivered via SUNWcsl. 4.11. Security Impact: None. 4.12. Dependencies: None. 5. Reference Documents: http://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B http://www.nsa.gov/ia/industry/crypto_suite_b.cfm?MenuID=10.2.7 http://www.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html 6. Resources and Schedule: 6.1. Projected Availability: FY07 Q2 6.2. Cost of Effort: 4 months engineering 3 months testing 6.3. Cost of Capital Resources: Existing capital resources will be used. 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: ON 6.4.3. Type of CPT Review and Approval expected: FastTrack 6.4.4. Project Boundary Conditions: TBD 6.4.5. Is this a necessary project for OEM agreements: No. 6.4.6. Notes: 6.4.7. Target RTI Date/Release: onnv_78 6.4.8. Target Code Design Review Date: October 1 6.4.9. Update approval addition: N/A 6.5. ARC review type: FastTrack 7. Prototype Availability: 7.1. Prototype Availability: Yes 7.2. Prototype Cost: 2 months 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: Automatic 6.6. ARC Exposure: open From bhargava.yenduri@sun.com Thu Aug 2 10:39:15 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72HdEUn022756 for ; Thu, 2 Aug 2007 10:39:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l72Hav9B002794 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 3 Aug 2007 01:37:00 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500G0VQ9LT000@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 10:36:57 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500FP8Q9KQL00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 10:36:57 -0700 (PDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l72Hat8g011957; Thu, 02 Aug 2007 10:36:55 -0700 (PDT) Received: from [129.146.108.66] (bluesky.SFBay.Sun.COM [129.146.108.66]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72HasE10505; Thu, 02 Aug 2007 10:36:54 -0700 (PDT) Date: Thu, 02 Aug 2007 10:34:03 -0700 From: Krishna Yenduri Subject: Re: Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> To: mark.powers@sun.com Cc: PSARC-ext@sun.com, crypto-discuss@opensolaris.org, nelson.bolyard@sun.com Message-id: <46B2158B.5050406@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.4 (X11/20070703) Status: RO Content-Length: 2832 Mark, This looks good. I have a couple of comments below ... > 2. Project Summary > 2.1. Project Description: > This project will add Elliptic-Curve Cryptography (ECC) to the > Solaris Encryption Framework. ECC will be available to kernel > and user-level consumers. > One potential kernel consumer is kernel SSL since TLS can use ECC cipher suites. > 3.6. How will you know when you are done?: > When we can use pkcs11 on Apache for ECC. > Does this mean this project will modify OpenSSL PKCS #11 engine to add the support for ECC mechanisms? You might want to test with Sun Java System web server too. > 4. Technical Description: > 4.1. Details: > The Solaris Crypto Framework has loadable software modules that > provides cryptographic algorithms for kernel consumers. These offer > algorithms such as AES and RSA. The framework also has a softtoken > library that implements algorithms for user-level consumers. This > project introduces a new module offering ECC. It also adds ECC to > the softtoken library. > > The low-level implemention of ECC that we will use was originally > developed by Sun Labs and subsequently given to NSS. Legal approval > to use this code under Mozilla Public License v. 1.1 has been > obtained. > > Supported PKCS#11 mechanisms are: CKM_EC_KEY_PAIR_GEN, CKM_ECDSA, > CKM_ECDSA_SHA1, and CKM_ECDH1_DERIVE. I assume this list is for the softtoken library. What mechanisms will the kernel ecc software provider support? Thanks, -Krishna > NSS implements 51 ECC curves, > all of which will be supported. They are: > > secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, secp160r1, > secp160r2, secp192k1, secp224k1, secp224r1, secp256k1, secp384r1, > secp521r1, sect113r1, sect113r2, sect131r1, sect131r2, sect163k1, > sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, > sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, > sect571r1, c2pnb163v1, c2pnb163v2, c2pnb163v3, c2pnb176v1, c2tnb191v1, > c2tnb191v2, c2tnb191v3, c2pnb208w1, c2tnb239v1, c2tnb239v2, c2tnb239v3, > c2pnb272w1, c2pnb304w1, c2tnb359v1, c2pnb368w1, c2tnb431r1, prime192v1, > prime192v2, prime192v3, prime256v1 > > 4.2. Bug/RFE Number(s): > 5066901 Offer the PKCS#11 Elliptic Curve based mechanisms in Solaris > 6562402 kernel software provider for Elliptic Curve mechanisms > > 4.3. In Scope: > > 4.4. Out of Scope: > > 4.5. Interfaces: > Changes to softtoken will not affect the interface to softtoken. > The only visible change will be four new PKCS#11 mechanisms that > are visible when the capabilities of the softtoken are queried. > The loadable module will introduce the following: > /kernel/crypto/ecc > /kernel/crypto/amd64/ecc > /kernel/crypto/sparcv9/ecc > > From mark.powers@sun.com Thu Aug 2 11:01:21 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72I1KPq023779 for ; Thu, 2 Aug 2007 11:01:20 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72Hx6ea007705 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 2 Aug 2007 10:59:06 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500I0HRAIX500@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 10:59:06 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500ASERAHPCE0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 10:59:05 -0700 (PDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l72Hx4Ke024020; Thu, 02 Aug 2007 10:59:04 -0700 (PDT) Received: from [10.7.250.42] (punchin-client-10-7-250-42.SFBay.Sun.COM [10.7.250.42]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72Hx3E10657; Thu, 02 Aug 2007 10:59:03 -0700 (PDT) Date: Thu, 02 Aug 2007 11:58:57 -0600 From: Mark Powers Subject: Re: Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B2158B.5050406@sun.com> To: Krishna Yenduri Cc: PSARC-ext@sun.com, crypto-discuss@opensolaris.org, nelson.bolyard@sun.com Message-id: <46B21B61.9070604@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> User-Agent: Thunderbird 1.5.0.8 (X11/20061204) Status: RO Content-Length: 3298 Krishna Yenduri wrote: > Mark, > > This looks good. I have a couple of comments below ... > >> 2. Project Summary >> 2.1. Project Description: >> This project will add Elliptic-Curve Cryptography (ECC) to the >> Solaris Encryption Framework. ECC will be available to kernel >> and user-level consumers. >> > > One potential kernel consumer is kernel SSL since TLS can use ECC cipher > suites. Didn't think of that one. > >> 3.6. How will you know when you are done?: >> When we can use pkcs11 on Apache for ECC. >> > > Does this mean this project will modify OpenSSL PKCS #11 engine to > add the support for ECC mechanisms? You might want to test with Sun Java > System web server too. Perhaps I'm naive, but I thought by offering ECC mechanisms in libpkcs11 and telling the webserver to use pkcs11, that everything would work. > >> 4. Technical Description: >> 4.1. Details: >> The Solaris Crypto Framework has loadable software modules that >> provides cryptographic algorithms for kernel consumers. These offer >> algorithms such as AES and RSA. The framework also has a softtoken >> library that implements algorithms for user-level consumers. This >> project introduces a new module offering ECC. It also adds ECC to >> the softtoken library. >> >> The low-level implemention of ECC that we will use was originally >> developed by Sun Labs and subsequently given to NSS. Legal approval >> to use this code under Mozilla Public License v. 1.1 has been >> obtained. >> >> Supported PKCS#11 mechanisms are: CKM_EC_KEY_PAIR_GEN, CKM_ECDSA, >> CKM_ECDSA_SHA1, and CKM_ECDH1_DERIVE. > > I assume this list is for the softtoken library. What mechanisms will > the kernel > ecc software provider support? Same mechanisms and curves as in the softtoken library. > > Thanks, > -Krishna > > >> NSS implements 51 ECC curves, >> all of which will be supported. They are: >> >> secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, >> secp160r1, >> secp160r2, secp192k1, secp224k1, secp224r1, secp256k1, >> secp384r1, >> secp521r1, sect113r1, sect113r2, sect131r1, sect131r2, >> sect163k1, >> sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, >> sect233r1, >> sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, >> sect571k1, >> sect571r1, c2pnb163v1, c2pnb163v2, c2pnb163v3, c2pnb176v1, >> c2tnb191v1, >> c2tnb191v2, c2tnb191v3, c2pnb208w1, c2tnb239v1, c2tnb239v2, >> c2tnb239v3, >> c2pnb272w1, c2pnb304w1, c2tnb359v1, c2pnb368w1, c2tnb431r1, >> prime192v1, >> prime192v2, prime192v3, prime256v1 >> >> 4.2. Bug/RFE Number(s): >> 5066901 Offer the PKCS#11 Elliptic Curve based mechanisms in Solaris >> 6562402 kernel software provider for Elliptic Curve mechanisms >> 4.3. In Scope: >> >> 4.4. Out of Scope: >> 4.5. Interfaces: >> Changes to softtoken will not affect the interface to softtoken. >> The only visible change will be four new PKCS#11 mechanisms that >> are visible when the capabilities of the softtoken are queried. >> The loadable module will introduce the following: >> /kernel/crypto/ecc >> /kernel/crypto/amd64/ecc >> /kernel/crypto/sparcv9/ecc >> >> > From sommerfeld@Sun.COM Thu Aug 2 11:03:58 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72I3w3f023842 for ; Thu, 2 Aug 2007 11:03:58 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l72I1XuX016976; Fri, 3 Aug 2007 02:01:43 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500J03REU3000@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 11:01:42 -0700 (PDT) Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500FPAREUQV10@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 11:01:42 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail1bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l72I1elI005229; Thu, 02 Aug 2007 14:01:40 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l72I1dGd029482; Thu, 02 Aug 2007 14:01:39 -0400 (EDT) Date: Thu, 02 Aug 2007 14:01:38 -0400 From: Bill Sommerfeld Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@Sun.COM, crypto-discuss@opensolaris.org Message-id: <1186077698.29012.18.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.10.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> Status: RO Content-Length: 573 On Thu, 2007-08-02 at 09:28 -0700, Darren J Moffat wrote: > I'm sponsoring this case for Mark Powers. I'm marking it as Self Review > since it really only adds new mechanisms to the crypto framework > doesn't provide any new or changed APIs or change anything for a user, > developer or administrator. what's the case boundary? in particular, is this expected to automatically enable use of certificates which either contain, or are signed by, an ECC key, or is additional work to consumers of this interface required beyond plugging the algorithms in? - Bill From bhargava.yenduri@sun.com Thu Aug 2 11:08:35 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72I8Y43023976 for ; Thu, 2 Aug 2007 11:08:34 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72I6KF0020541 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 2 Aug 2007 11:06:20 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500L23RMI2I00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:06:18 -0600 (MDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500D9RRMF86A0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:06:16 -0600 (MDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l72I6FO4018272; Thu, 02 Aug 2007 11:06:15 -0700 (PDT) Received: from [129.146.108.66] (bluesky.SFBay.Sun.COM [129.146.108.66]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72I6EE10911; Thu, 02 Aug 2007 11:06:14 -0700 (PDT) Date: Thu, 02 Aug 2007 11:03:20 -0700 From: Krishna Yenduri Subject: Re: Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B21B61.9070604@sun.com> To: Mark Powers Cc: PSARC-ext@sun.com, crypto-discuss@opensolaris.org, nelson.bolyard@sun.com Message-id: <46B21C68.5030206@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> <46B21B61.9070604@sun.com> User-Agent: Thunderbird 2.0.0.4 (X11/20070703) Status: RO Content-Length: 1048 Mark Powers wrote: >>> 3.6. How will you know when you are done?: >>> When we can use pkcs11 on Apache for ECC. >>> >> >> Does this mean this project will modify OpenSSL PKCS #11 engine to >> add the support for ECC mechanisms? You might want to test with Sun Java >> System web server too. > > Perhaps I'm naive, but I thought by offering ECC mechanisms in libpkcs11 > and telling the webserver to use pkcs11, that everything would work. No. It does not. Apache web server depends on the OpenSSL PKCS #11 engine to be able to use libpkcs11. This means we have to extend the engine for the new ECC mechanisms, for Apache to work. >>> >>> Supported PKCS#11 mechanisms are: CKM_EC_KEY_PAIR_GEN, CKM_ECDSA, >>> CKM_ECDSA_SHA1, and CKM_ECDH1_DERIVE. >> >> I assume this list is for the softtoken library. What mechanisms will >> the kernel >> ecc software provider support? > > Same mechanisms and curves as in the softtoken library. We don't need the CKM_EC_KEY_PAIR_GEN mechanism in kernel land, if it helps. -Krishna From Darren.Moffat@sun.com Thu Aug 2 11:24:12 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72IOBKs024612 for ; Thu, 2 Aug 2007 11:24:12 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72ILrLC044900 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 2 Aug 2007 12:21:55 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500L01SCKUX00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:21:56 -0600 (MDT) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500DI2SCI88A0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:21:55 -0600 (MDT) Received: from d1-emea-10.sun.com ([192.18.2.120]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l72ILsKV008244 for ; Thu, 02 Aug 2007 18:21:54 +0000 (GMT) Received: from conversion-daemon.d1-emea-10.sun.com by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JM500B01SBZJK00@d1-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 19:21:54 +0100 (BST) Received: from [129.156.173.21] by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JM500CH8SCHY500@d1-emea-10.sun.com>; Thu, 02 Aug 2007 19:21:54 +0100 (BST) Date: Thu, 02 Aug 2007 19:21:53 +0100 From: Darren J Moffat Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B21C68.5030206@sun.com> Sender: Darren.Moffat@sun.com To: Krishna Yenduri Cc: Mark Powers , PSARC-ext@sun.com, Nelson.Bolyard@sun.com, crypto-discuss@opensolaris.org Message-id: <46B220C1.2060501@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> <46B21B61.9070604@sun.com> <46B21C68.5030206@sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070605) Status: RO Content-Length: 1209 Krishna Yenduri wrote: > Mark Powers wrote: >>>> 3.6. How will you know when you are done?: >>>> When we can use pkcs11 on Apache for ECC. >>>> >>> Does this mean this project will modify OpenSSL PKCS #11 engine to >>> add the support for ECC mechanisms? You might want to test with Sun Java >>> System web server too. >> Perhaps I'm naive, but I thought by offering ECC mechanisms in libpkcs11 >> and telling the webserver to use pkcs11, that everything would work. > > No. It does not. > > Apache web server depends on the OpenSSL PKCS #11 engine to be able > to use libpkcs11. This means we have to extend the engine for the new > ECC mechanisms, for Apache to work. Updating the OpenSSL "pkcs11" ENGINE is a separate project by a sparate project team- there are sensitive legal issues with some of the OpenSSL ECC code that doesn't impact this case since it uses code from NSS. For Sun Java System Web Server I believe it already supports ECC keys and certs via NSS and since NSS can use the Solaris libpkcs11 it can use this case's work (though there is little point since it would likely end up being no faster since it is the same software implementation). -- Darren J Moffat From Darren.Moffat@sun.com Thu Aug 2 11:30:02 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72IU24b024879 for ; Thu, 2 Aug 2007 11:30:02 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72IRj3s046882; Thu, 2 Aug 2007 12:27:46 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500L0HSMBEZ00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 11:27:47 -0700 (PDT) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500FQHSM4QM30@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Aug 2007 11:27:41 -0700 (PDT) Received: from d1-emea-09.sun.com ([192.18.2.119]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l72IRd3s008359; Thu, 02 Aug 2007 18:27:39 +0000 (GMT) Received: from conversion-daemon.d1-emea-09.sun.com by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JM500J01SGV0H00@d1-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Thu, 02 Aug 2007 19:27:39 +0100 (BST) Received: from [129.156.173.21] by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JM5003SBSM3KC10@d1-emea-09.sun.com>; Thu, 02 Aug 2007 19:27:39 +0100 (BST) Date: Thu, 02 Aug 2007 19:27:39 +0100 From: Darren J Moffat Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <1186077698.29012.18.camel@thunk> Sender: Darren.Moffat@sun.com To: Bill Sommerfeld Cc: Darren J Moffat , PSARC-ext@sun.com, crypto-discuss@opensolaris.org Message-id: <46B2221B.50300@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <1186077698.29012.18.camel@thunk> User-Agent: Thunderbird 2.0.0.0 (X11/20070605) Status: RO Content-Length: 923 Bill Sommerfeld wrote: > On Thu, 2007-08-02 at 09:28 -0700, Darren J Moffat wrote: >> I'm sponsoring this case for Mark Powers. I'm marking it as Self Review >> since it really only adds new mechanisms to the crypto framework >> doesn't provide any new or changed APIs or change anything for a user, >> developer or administrator. > > what's the case boundary? Provision of the raw algorithms in the crypto framework. > in particular, is this expected to automatically enable use of > certificates which either contain, or are signed by, an ECC key, or is > additional work to consumers of this interface required beyond plugging > the algorithms in? Updates to KMF maybe required to be able to create and manipulate certificates that have Elliptic Curve keys. As for "applications", say IKE, they need to be aware of an Elliptic Curve cipher suite to be able to use what this case provides. -- Darren J Moffat From wyllys.ingersoll@sun.com Thu Aug 2 11:33:40 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72IXeQN024959 for ; Thu, 2 Aug 2007 11:33:40 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72IVOv2029889; Thu, 2 Aug 2007 11:31:25 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500K05SSBI500@nwk-avmta-2.sfbay.sun.com>; Thu, 02 Aug 2007 11:31:23 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500JQ6SSAES10@nwk-avmta-2.sfbay.sun.com>; Thu, 02 Aug 2007 11:31:23 -0700 (PDT) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l72IVLL2446033 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 02 Aug 2007 11:31:21 -0700 (PDT) Date: Thu, 02 Aug 2007 14:31:04 -0400 From: Wyllys Ingersoll Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B2221B.50300@Sun.COM> To: Darren J Moffat Cc: Bill Sommerfeld , PSARC-ext@sun.com, Darren J Moffat , crypto-discuss@opensolaris.org Message-id: <46B222E8.4090506@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <1186077698.29012.18.camel@thunk> <46B2221B.50300@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070521) Status: RO Content-Length: 530 Darren J Moffat wrote: >> in particular, is this expected to automatically enable use of >> certificates which either contain, or are signed by, an ECC key, or is >> additional work to consumers of this interface required beyond plugging >> the algorithms in? >> > > Updates to KMF maybe required to be able to create and manipulate > certificates that have Elliptic Curve keys. > Correct. KMF would require changes to support ECC certs and keys. The libraries and tools (pktool) would all need some changes. -Wyllys From bhargava.yenduri@sun.com Thu Aug 2 11:34:19 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72IYILl024974 for ; Thu, 2 Aug 2007 11:34:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l72IW3Ac003668 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 3 Aug 2007 02:32:04 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500L09STEOP00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 11:32:02 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500FROSTBQU30@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 11:31:59 -0700 (PDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l72IVup5001109; Thu, 02 Aug 2007 11:31:57 -0700 (PDT) Received: from [129.146.108.66] (bluesky.SFBay.Sun.COM [129.146.108.66]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72IVuE11249; Thu, 02 Aug 2007 11:31:56 -0700 (PDT) Date: Thu, 02 Aug 2007 11:29:05 -0700 From: Krishna Yenduri Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B220C1.2060501@Sun.COM> To: Darren J Moffat Cc: Mark Powers , psarc-ext@sun.com, Nelson.Bolyard@sun.com, crypto-discuss@opensolaris.org Message-id: <46B22271.1080606@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> <46B21B61.9070604@sun.com> <46B21C68.5030206@sun.com> <46B220C1.2060501@Sun.COM> User-Agent: Thunderbird 2.0.0.4 (X11/20070703) Status: RO Content-Length: 1615 Darren J Moffat wrote: > Krishna Yenduri wrote: >> Mark Powers wrote: >>>>> 3.6. How will you know when you are done?: >>>>> When we can use pkcs11 on Apache for ECC. >>>>> >>>> Does this mean this project will modify OpenSSL PKCS #11 engine to >>>> add the support for ECC mechanisms? You might want to test with Sun >>>> Java >>>> System web server too. >>> Perhaps I'm naive, but I thought by offering ECC mechanisms in >>> libpkcs11 >>> and telling the webserver to use pkcs11, that everything would work. >> >> No. It does not. >> >> Apache web server depends on the OpenSSL PKCS #11 engine to be able >> to use libpkcs11. This means we have to extend the engine for the new >> ECC mechanisms, for Apache to work. > > Updating the OpenSSL "pkcs11" ENGINE is a separate project by a > sparate project team- there are sensitive legal issues with some of > the OpenSSL ECC code that doesn't impact this case since it uses code > from NSS. Then section 3.6 needs to be changed. And the above dependency/issue needs to be called out. > For Sun Java System Web Server I believe it already supports ECC keys > and certs via NSS and since NSS can use the Solaris libpkcs11 it can > use this case's work (though there is little point since it would > likely end up being no faster since it is the same software > implementation). Yes. One would typically only do this if there is hardware acceleration available. The software implementation helps as a fallback in this case. For example, if the hardware returned a CRYPTO_BUSY error code, metaslot will use softtoken. -Krishna From mark.powers@Sun.COM Thu Aug 2 11:54:01 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72Is1i4025662 for ; Thu, 2 Aug 2007 11:54:01 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72Ipk0H026835 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 2 Aug 2007 11:51:47 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500N0RTQA4C00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 11:51:46 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500FARTQ3QL40@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 11:51:39 -0700 (PDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l72Ipanr010843; Thu, 02 Aug 2007 11:51:37 -0700 (PDT) Received: from [10.7.250.42] (punchin-client-10-7-250-42.SFBay.Sun.COM [10.7.250.42]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72IpZE11511; Thu, 02 Aug 2007 11:51:36 -0700 (PDT) Date: Thu, 02 Aug 2007 12:51:29 -0600 From: Mark Powers Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B22271.1080606@sun.com> To: Krishna Yenduri Cc: Darren J Moffat , PSARC-ext@Sun.COM, Nelson.Bolyard@Sun.COM, crypto-discuss@opensolaris.org Message-id: <46B227B1.1060402@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> <46B21B61.9070604@sun.com> <46B21C68.5030206@sun.com> <46B220C1.2060501@Sun.COM> <46B22271.1080606@sun.com> User-Agent: Thunderbird 1.5.0.8 (X11/20061204) Status: RO Content-Length: 1929 Krishna Yenduri wrote: > Darren J Moffat wrote: >> Krishna Yenduri wrote: >>> Mark Powers wrote: >>>>>> 3.6. How will you know when you are done?: >>>>>> When we can use pkcs11 on Apache for ECC. >>>>>> >>>>> Does this mean this project will modify OpenSSL PKCS #11 engine to >>>>> add the support for ECC mechanisms? You might want to test with >>>>> Sun Java >>>>> System web server too. >>>> Perhaps I'm naive, but I thought by offering ECC mechanisms in >>>> libpkcs11 >>>> and telling the webserver to use pkcs11, that everything would work. >>> >>> No. It does not. >>> >>> Apache web server depends on the OpenSSL PKCS #11 engine to be able >>> to use libpkcs11. This means we have to extend the engine for the new >>> ECC mechanisms, for Apache to work. >> >> Updating the OpenSSL "pkcs11" ENGINE is a separate project by a >> sparate project team- there are sensitive legal issues with some of >> the OpenSSL ECC code that doesn't impact this case since it uses code >> from NSS. > > Then section 3.6 needs to be changed. And the above dependency/issue > needs to be called out. > >> For Sun Java System Web Server I believe it already supports ECC keys >> and certs via NSS and since NSS can use the Solaris libpkcs11 it can >> use this case's work (though there is little point since it would >> likely end up being no faster since it is the same software >> implementation). s/Apache/Sun Java System Web Server/ All I want to do is to use ECC for something useful. I could "call it done" when all test vectors pass, but I thought I could take it one step further and try a web server in addition to test vectors. > > Yes. One would typically only do this if there is hardware > acceleration available. The software implementation > helps as a fallback in this case. For example, if the hardware > returned a CRYPTO_BUSY error code, metaslot > will use softtoken. > > -Krishna > > > > From bhargava.yenduri@sun.com Thu Aug 2 12:06:41 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l72J6fOp026186 for ; Thu, 2 Aug 2007 12:06:41 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l72J4QBK000812 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 2 Aug 2007 12:04:26 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JM500M0FUBC5F00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:04:24 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JM500J48UBBEV40@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 02 Aug 2007 12:04:23 -0700 (PDT) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l72J4KWZ028110; Thu, 02 Aug 2007 12:04:20 -0700 (PDT) Received: from [129.146.108.66] (bluesky.SFBay.Sun.COM [129.146.108.66]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id l72J4JE11758; Thu, 02 Aug 2007 12:04:20 -0700 (PDT) Date: Thu, 02 Aug 2007 12:01:28 -0700 From: Krishna Yenduri Subject: Re: [crypto-discuss] Elliptic-Curve Cryptography for Solaris [PSARC/2007/446 Self Review] In-reply-to: <46B227B1.1060402@sun.com> To: Mark Powers Cc: Darren J Moffat , PSARC-ext@sun.com, Nelson.Bolyard@sun.com, crypto-discuss@opensolaris.org Message-id: <46B22A08.9010302@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200708021628.l72GSLFm019806@sac.sfbay.sun.com> <46B2158B.5050406@sun.com> <46B21B61.9070604@sun.com> <46B21C68.5030206@sun.com> <46B220C1.2060501@Sun.COM> <46B22271.1080606@sun.com> <46B227B1.1060402@sun.com> User-Agent: Thunderbird 2.0.0.4 (X11/20070703) Status: RO Content-Length: 1830 Mark Powers wrote: > Krishna Yenduri wrote: >> Darren J Moffat wrote: >>> Krishna Yenduri wrote: >>>> Mark Powers wrote: >>>>>>> 3.6. How will you know when you are done?: >>>>>>> When we can use pkcs11 on Apache for ECC. >>>>>>> >>>>>> Does this mean this project will modify OpenSSL PKCS #11 engine to >>>>>> add the support for ECC mechanisms? You might want to test with >>>>>> Sun Java >>>>>> System web server too. >>>>> Perhaps I'm naive, but I thought by offering ECC mechanisms in >>>>> libpkcs11 >>>>> and telling the webserver to use pkcs11, that everything would work. >>>> >>>> No. It does not. >>>> >>>> Apache web server depends on the OpenSSL PKCS #11 engine to be able >>>> to use libpkcs11. This means we have to extend the engine for the new >>>> ECC mechanisms, for Apache to work. >>> >>> Updating the OpenSSL "pkcs11" ENGINE is a separate project by a >>> sparate project team- there are sensitive legal issues with some of >>> the OpenSSL ECC code that doesn't impact this case since it uses >>> code from NSS. >> >> Then section 3.6 needs to be changed. And the above dependency/issue >> needs to be called out. >> >>> For Sun Java System Web Server I believe it already supports ECC >>> keys and certs via NSS and since NSS can use the Solaris libpkcs11 >>> it can use this case's work (though there is little point since it >>> would likely end up being no faster since it is the same software >>> implementation). > > s/Apache/Sun Java System Web Server/ > > All I want to do is to use ECC for something useful. I could "call it > done" > when all test vectors pass, but I thought I could take it one step > further > and try a web server in addition to test vectors. And I agree that is a good goal because there could be interoperability issues that show up. -Krishna