<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
<br>
For someone who has private keys in the clear and wants to continue<br>
to use private keys in the clear - I agree that the new xmlsec <i>command</i><br>
will be incompatible (for openssl users atleast).<br>
<br>
However, the very idea behind making this change is to eliminate the<br>
"unhygenic" practice of using private keys in the clear... <br>
<br>
But if you insist....<br>
<br>
How do --privkey-der-pkcs8 and --privkey-pem-pkcs8 sound?.<br>
<br>
-Tej<br>
<br>
<span type="cite">Aleksey Sanin wrote:</span>
<p> </p>
<blockquote type="cite"
style="border-left: thin solid blue; padding-left: 10px; margin-left: 0pt;">
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title>
<title></title>
</title>
<div> You do break compatibility. Because there are PEM/DER clear text <br>
key files and there are PKCS8 PEM/DER key files. The only thing that<br>
you have to convert keys in test/* folder shows that.<br>
<br>
Probably it would be better to introduce something like "--pkcs8-key"
option<br>
with similar switches "pem/der" format.<br>
<br>
Aleksey<br>
<br>
Tejkumar Arora wrote:<br>
<blockquote type="cite" cite="mid3EDE4C85.80404@netscape.com">
<title>
<title></title>
</title>
The PKCS8 file containing the encrypted private key can be<br>
either in PEM or DER format, so the backward compatibility<br>
is not really broken. The API for loading the key from<br>
PEM/DER files takes in a password argument already, so<br>
no API changes are needed to use PKCS8 files.<br>
<br>
-Tej<br>
<br>
</blockquote>
</div>
</blockquote>
</body>
</html>