If the database password is empty, dumping private keys
resulted in an error message.
Fix this by setting the encryption algorithm to NULL if
the password is empty.
Additionally throw the error after closing the filedescriptor.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
change storage type of passwords from char[] to QByteArray
Create PwDialog class and drop passWrite and passRead
Create Passwd class derived from QBytearray
move PKCS12 password input to PwDialog
Some distributions ship an OpenSSL installation without
EC Support.
XCA evaluates the OPENSSL_NO_EC flag to disable EC
Thanks to Andreas Piesk for his patch
Since OpenSSL 1.0.0 PEM_write_PrivateKey() always
writes a PKCS#8 structure.
PEM Export function PEM_write_PrivateKey() replaced by
PEM_write_#KEY#PrivateKey() depending on the KEY type.
Keys: Sort Keysize numerical
Certs: CA, fingerprints, start date (notBefore)
Crl: CRL number , Last update
Requests, Crls, Templates, Certs: All subject items and the full name
- add tokenInfo.model to the card information, revamp tokenInfo
- add driverInfo()
- use token_info.label (card_label) as token descriptor for reading passwords
- use only CKA_LABEL as internal name
- replace occurances of "Smart Card" by "Token"
- Support for creating keys on a token
- Store existing keys on a token
- delete keys and certs from a token
- update docs
- fixes to not crash if Smart card support is missing
- select correct list of hash algos by
reading PKCS11 mechanisms per slot and save them among with
the card in the db
- remove debugging code
- allow to configure the path to the PKCS#11 library
- copy pkcs11 header-file into XCA lib
