Subject: mod_ssl and Sun Crypto Card

From: "Yu, Ming" <[email-masked]>
Date: Thu, 6 Nov 2003 13:40:21 -0500

I have a SunFire system that has a Sun Crypto Card 1000 pre-installed.  The
mod_ssl came with the card only supports apache 1.3.12 or apache 1.3.22.
How to configure and compile the mod_ssl so that it can support the Crypto
card?  - Thanks in advance

- Ming Yu
- Johns Hopkins Univ. APL

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Francisco Corella" <[email-masked]>
Date: Fri, 7 Nov 2003 20:23:46 -0800

Hi Goetz,

> Francisco Corella wrote:
> > I have spent several hours searching the mailing list archive looking
for
> > hardware key storage solutions compatible with mod_ssl.  NCipher
provides
> > one.  Are there any others?  I saw several emails mentioning the
existence
> > of others, but nothing concrete.  One email mentioned Broadcom in
addition
> > to NCipher, but Broadcom sells chips, and I'm looking for a PCI card.  I
> > have concacted several manufacturers of SSL accelerators but haven't
been
> > able to get any answers concerning key storage except from NCipher.
>
> OpenSSL comes with build in support for different
> crypto hardware (called ENGINE, in crypto/engine/).
> But support for additional crypto engines may be added on run time.
>
> Please search the OpenSSL web pages.

I think I understand, at least in principle, how to use hardware crypto with
mod_ssl.  But there are two ways of doing it, depending of where you keep
the server key:

(a) You may keep the server key in a file specified by the directive
SSLCertificateKeyFile, and send the key to the hardware for each operation
that requires use of the key.  Or,

(b) You may keep the server key in the hardware, and tell the hardware what
key to use for each operation in some ad-hoc fashion.

My understanding is that most hardware crypto uses option (a).  I know that
nCipher lets you use option (a) or option (b), but using option (b) requires
buying the tamperproof card called "nForce", which is very expensive,
instead of the vanilla "nFast" card.

What I was asking is whether there is other crypto hardware out there that
lets you use option (b).  I'm hoping to find something less expensive than
nForce.

Francisco

---

From: Goetz Babin-Ebell <[email-masked]>
Date: Mon, 10 Nov 2003 17:38:15 +0100

Hello Francisco,

> lets you use option (b).  I'm hoping to find something less expensive than

Eracom has a crypto card.
It is accessed with a PKCS#11 interface.

There are several PKCS#11 ENGINE implementations for OpenSSL
available.
(One from Bull, one from eracom, may be others)

Have a look at one of these.

Bye

Goetz

-- 
Goetz Babin-Ebell, TC TrustCenter AG, http://www.trustcenter.de
Sonninstr. 24-28, 20097 Hamburg, Germany
Tel.: +49-(0)40 80 80 26 -0,  Fax: +49-(0)40 80 80 26 -126