{"action":"created","issue":{"url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/40","repository_url":"https://api.github.com/repos/opencryptoki/openssl-ibmca","labels_url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/40/comments","events_url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/40/events","html_url":"https://github.com/opencryptoki/openssl-ibmca/pull/40","id":327125346,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkxMDAyMjk0","number":40,"title":"ECC support","user":{"login":"p-steuer","id":19472850,"node_id":"MDQ6VXNlcjE5NDcyODUw","avatar_url":"https://avatars0.githubusercontent.com/u/19472850?v=4","gravatar_id":"","url":"https://api.github.com/users/p-steuer","html_url":"https://github.com/p-steuer","followers_url":"https://api.github.com/users/p-steuer/followers","following_url":"https://api.github.com/users/p-steuer/following{/other_user}","gists_url":"https://api.github.com/users/p-steuer/gists{/gist_id}","starred_url":"https://api.github.com/users/p-steuer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/p-steuer/subscriptions","organizations_url":"https://api.github.com/users/p-steuer/orgs","repos_url":"https://api.github.com/users/p-steuer/repos","events_url":"https://api.github.com/users/p-steuer/events{/privacy}","received_events_url":"https://api.github.com/users/p-steuer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-28T22:12:51Z","updated_at":"2018-06-06T12:43:05Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/pulls/40","html_url":"https://github.com/opencryptoki/openssl-ibmca/pull/40","diff_url":"https://github.com/opencryptoki/openssl-ibmca/pull/40.diff","patch_url":"https://github.com/opencryptoki/openssl-ibmca/pull/40.patch"},"body":"this is joergs ecc engine code. i got it running with both openssl 1.0.2 (on rhel 7.5) and openssl 1.1.0 (internal driver) and impemented the fallback behavior.\r\n\r\nI tested the following cenarios:\r\n- verified hw usage using openssl speed and icastats/lszcrypt\r\n- sw-fallback if curve is not supported by hw\r\n- sw-fallback if hw is disabled (hit device-driver bug)\r\n\r\nI also did some s_serve/s_client tests with ECDHE-ECDSA ciphersuites with both openssl 1.0.2 and 1.1.0, having engine enabled on both sides or on one side only.\r\n\r\nSo please review and try to provide some additional test coverage. Im still think the code might not be free of memleaks. will look into that tomorrow."},"comment":{"url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/comments/395054772","html_url":"https://github.com/opencryptoki/openssl-ibmca/pull/40#issuecomment-395054772","issue_url":"https://api.github.com/repos/opencryptoki/openssl-ibmca/issues/40","id":395054772,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTA1NDc3Mg==","user":{"login":"p-steuer","id":19472850,"node_id":"MDQ6VXNlcjE5NDcyODUw","avatar_url":"https://avatars0.githubusercontent.com/u/19472850?v=4","gravatar_id":"","url":"https://api.github.com/users/p-steuer","html_url":"https://github.com/p-steuer","followers_url":"https://api.github.com/users/p-steuer/followers","following_url":"https://api.github.com/users/p-steuer/following{/other_user}","gists_url":"https://api.github.com/users/p-steuer/gists{/gist_id}","starred_url":"https://api.github.com/users/p-steuer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/p-steuer/subscriptions","organizations_url":"https://api.github.com/users/p-steuer/orgs","repos_url":"https://api.github.com/users/p-steuer/repos","events_url":"https://api.github.com/users/p-steuer/events{/privacy}","received_events_url":"https://api.github.com/users/p-steuer/received_events","type":"User","site_admin":false},"created_at":"2018-06-06T12:43:05Z","updated_at":"2018-06-06T12:43:05Z","author_association":"CONTRIBUTOR","body":"okay, i integrated and pushed all feedback i got. Some remarks:\r\n\r\n- i didnt find too many violations of the coding style doc, anyone else can have a second look ?\r\n- the > 4k rsa problem is addressed in PR #41 \r\n- haralds comment about the BIND stuff is not related to the ecc feature and should be adressed in a seperate PR, probably not within the coming release\r\n- regarding eduardos comment about libica dependency: ibmca includes the libica header ica_api.h and was always dependent of a libica release i.e. you could have an old engine version with new libica but not vice versa. We always advice our distro partners to update both packages (This is also the reason why the BIND stuff mentioned by harald has never been a problem, b/c engine and libica are on sync). i mean we ensure engine is compatible with all openssl versions, doing the same for libica would require a lot of work since engine uses libica data structures (just comment out ica_api.h include and try to build, from my point of view it would even make sense to package libica and engine together to ensure compatability and give up on dlopen-ing libica.so).\r\n\r\nI wait for your review and/or testing feedback."}}
{"actor":{"display_login":"p-steuer"}}