<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
Hi Aleksey,<br>
<br>
You have a neat test harness that would be great to leverage for<br>
all the crypto engines. The harness fits like a glove for openssl, but<br>
not so well for other engines because the test drivers (*.sh) use<br>
PEM files <b><i>exclusively </i></b>for keys & certs. DER (for
public keys & certs),<br>
or PKCS12 (for pvt keys & certs) formats are not used at all by<br>
the test drivers. I don't know about GNUTLS, or MSCrypto but NSS
certainly <br>
has no support for PEM format. I'm sure, however, that all the engines<br>
support DER & PKCS12 formats.<br>
<br>
I have noticed that some of the PEM files have DER counterparts.<br>
Perhaps you have already begun the process of making the test harness <br>
usable for all engines?.<br>
<br>
The best approach would be to convert all PEM format files to <br>
DER or PKCS12 format (using the openssl x509 or openssl pkcs12 commands)<br>
and use those in the test drivers. This will require addition of a
couple of<br>
options to xmlsec: --pubkey-der, and --privkey-der.<br>
<br>
The next step would be to modify the test drivers to use <b><i></i></b>DER
and/or PKCS12<br>
formats <i><b>only. </b></i>We can leave the current drivers
untouched and create a <br>
new incarnation using the generic formats (testDSig-gen.sh,
testEnc-gen.sh.....).<br>
Or we can just maintain 1 copy for all the engines. I'm a bit
skeptical about<br>
using 1 version of the scripts for all engines.... I'm not sure at this
point whether<br>
NSS will require the use of --crypto-config option. If NSS_NoDB_Init
is sufficient<br>
for all the operations required by the tests, then --crypto-config will
not be needed,<br>
otherwise it will be. To support testing with hardware tokens however,
--crypto-config <b><i><br>
WILL</i></b> be needed by NSS. I cannot speak for MSCrypto or GNUTLS -
anyone have<br>
comments?.<br>
<br>
I would like to help with this, but first I wanted to solicit feedback
on<br>
the issue.<br>
<br>
thanks,<br>
-Tej<br>
<br>
</body>
</html>