Jason Burrell wrote:
> > NSS supports PKCS#11 which most hardware crypto accelerators
> (including
> > things like smartcards and offloading coprocessors) use. As far as I
> > know, the only OpenSSL PKCS#11 library is external to it, from the
> > OpenSC people.
>
> Hmm... Are the relevant kernel drivers and interfaces in place for
> PKCS#11 for any of the crypto offload engines discussed (Kirkwood,
> Tegra, Freescale)? Can somebody point me at the relevant interface docs?
>
>
> Generally, the CPU-based "crypto" hardware is actually just a few
> acceleration functions, so you don't usually access it through PKCS#11.
> I know NSS supports the Intel AES instructions directly (not via
> PKCS#11), so it should be possible to add others as well.
Accelerating instructions are something for the compilers and assemblers
to deal with. I was specifically talking about asynchronous offload
engines that ARM SoCs often to have.
> So are you saying that the number of organizations that _don't_ use
> OpenSSH, OpenLDAP, mod_ssl, etc. is greater than those that do (limiting
> the field here to those that use some unix-like OS)? That would surprise
> me if it really is the case.
>
>
> I don't have figures as to the number of deployments of any of those
> tools, but only OpenSSH is listed as not yet supporting NSS anyway.
>
> I do think there are many deployments of OpenSSL that aren't following
> its license's advertising requirements. As you stated, OpenSSH is used
> pretty much everywhere, but I don't even remember the last time I saw a
> statement saying a product included software from OpenSSL, except in
> hidden about boxes, which isn't what a clear reading for the Four-clause
> BSD license states.
Just out of interest, have OpenSSL maintainers complained at having just
about every distribution on the planet break their licencing terms?
Gordan