Subject: RE: SSL Hardware acceleration questions . . .

From: [email-masked]
Date: Fri, 8 Mar 2002 10:15:58 +0000

Lynn,
     Thanx for your reply - I don't know if Oracle iAS (which uses
Apache/MOD_SSL/OpenSSL) uses the engine version, unfortunately as it is a
packaged product recompilation is not possible, I'll bung a call into
Oracle.  How do I identify if the engine version is in use? (I'll have a
look at the docs)
     How much benifit was the card?
Mikey

lgazis <[email-masked]> on 07/03/2002 21:48:29

Please respond to [email-masked]

To:   "[email-masked]'" <[email-masked]>
cc:

Subject:  RE: SSL Hardware acceleration questions . . .

Fairly easy.  For those hardware accelerators which are supported by the
OpenSSL engine version, all you need to do is to compile modSSL with the
engine version of OpenSSL (present as a separate version of OpenSSL from
OpenSSL 0.9.6 on), and include a line in httpd.conf setting SSLCryptoDevice
to the engine you wish to use.

I've set this up on Solaris, HP UX, AIX, Linux, and FreeBSD.

Lynn Gazis

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, March 07, 2002 9:37 AM
To: [email-masked]
Subject: SSL Hardware acceleration questions . . .

Dear all,
     Has anyone had any experience with hardware acceleration?
specifically:

How easy is it to get MOD_SSL to be configured with hardware SSL cards (any
cards to avoid/recommend).
We have Sun hardware (so Sun/Sonicwall ?)

Does anything need to be recompiled? which versions of OpenSSL are
supported etc.
Any specific experiences with iAS would be excellent.

What are the performance advantages?
Anything tio watch out for?

TIA
Mikey

All telephone calls are recorded and may be monitored.

E-mail communication is not secure and may be intercepted
by a third party. This message is confidential to the intended addressee.
If you are not the intended addressee, please inform us immediately and
then
delete this message. Virgin One account does not accept responsibility for
changes made to this message after it was sent. Although Virgin One account
believes this e-mail is free of any virus or other defect which may affect
a
computer, it is the responsibility of the recipient to ensure that it is
virus free and Virgin One account does not accept any responsibility for
any
loss or damage arising from its use.

The Virgin One account is a secured personal bank account with The Royal
Bank
of Scotland plc administered by Virgin Direct Personal Finance Ltd. It is
an
Introducer representative only of Virgin Money Personal Financial Service
Ltd,
which is authorised by the Financial Services Authority for life insurance,
pension and unit trust business and represents only the Virgin Money
marketing
group.

Registered office: Waterhouse Square, 138-142 Holborn, London EC1N 2TH, UK.
Registered in England no 3414708.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Imran Badr" <[email-masked]>
Date: Wed, 5 Jun 2002 19:18:26 -0700

Hi,
I am sorry if this question has been asked before in this group. I wanted to
find out what would be required to use private keys stored in hardware with
apache and modssl ? Modssl code looks for private key file in the host
machine and calls use_private_key() sort of function of openssl to store
private key in ssl context. Is it possible to use modssl with apache when
keys are created in tamper proof hardware and never leaves that? Is there
any patch to do that?

Thanks for any advice.
Imran.

---

From: Francois Desarmenien <[email-masked]>
Date: Sat, 8 Jun 2002 14:56:22 +0200

Le Wed, 5 Jun 2002 19:18:26 -0700

> keys are created in tamper proof hardware and never leaves that? Is there

mod_ssl relies on OpenSSL and OpenSSL-engine handles access for some
cryto cards.

F.

---

From: "Imran Badr" <[email-masked]>
Date: Tue, 11 Jun 2002 12:54:44 -0700

Engine support inlcudes offloading RSA/DSA operations but I haven't found
any way to notify moddssl that the key is in hardware key storage. Modssl
always looks for disk files for private key and certificate files and I
haven't figured out how to use hardware key storage. Apache will never start
if those files are not in disk.

Thanks for the reply.
Imran.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Francois Desarmenien
Sent: Saturday, June 08, 2002 5:56 AM
To: [email-masked]
Subject: Re: Hardware key storage

F.

---

From: "Peter Viertel" <[email-masked]>
Date: Wed, 12 Jun 2002 10:06:19 +0100

Whether this can be done is something you should talk to the vendor of 
your HSM about. If you're still looking for one to buy, I can confirm 
that it can be done with nCipher's gear using openssl-engine and some 
extra binaries they provide, I personally have experience with Solaris 
and using an HSM protected key. They trick mod_ssl into running with a 
dummy key, and then openssl engine offloads the key transforms via their 
CHIL api.

At http://www.ncipher.com/resources/index.html you will find their 
whitepapers on the subject.

I work for an nCipher Solutions partner, so my view here is obviously 
biased, there are other HSM vendors apparently.

-PeterV.

Imran Badr wrote:

>>I am sorry if this question has been asked before in this group. I wanted
>>    
>>
>to
>  
>
>>find out what would be required to use private keys stored in hardware
>>    
>>
>with
>  
>