gost-engine + rutoken + openvpn #457

Activity

1. SergeyOgly commented on Jun 4, 2024

   

   SergeyOgly

   on Jun 4, 2024

   More actions

   Доброе.
   gost-engine + rutoken + openvpn(>2.6) - только c использованием RSA сертификата завелось.
   Небольшое исследование показало, что для начала необходима реализация OSSL_OP_KEYMGMT в gostprov для сертификатов ГОСТ
2. SergeyOgly commented on Jun 4, 2024

   

   SergeyOgly

   on Jun 4, 2024

   More actions

   Использовать rtengine не вариант, т.к. у них нет реализованного криптопровайдера, а в openvpn новее 2.5.6 cipher берутся из криптопровайдеров.

   Собери openvpn с поддержкой engine, будет как то так:

   2024-05-31 11:23:29 Note: cipher 'kuznyechik-cbc' in --data-ciphers is not supported by ovpn-dco, disabling data channel offload.
   2024-05-31 11:23:29 OpenVPN 2.6.10 [git:unknown/unknown] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on May 24 2024
   2024-05-31 11:23:29 Windows version 10.0 (Windows 10 or greater), amd64 executable
   2024-05-31 11:23:29 library versions: OpenSSL 3.1.1 30 May 2023, LZO 2.10
   2024-05-31 11:23:29 DCO version: 1.1.1
   2024-05-31 11:23:29 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
   2024-05-31 11:23:29 Need hold release from management interface, waiting...
   2024-05-31 11:23:30 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:51716
   2024-05-31 11:23:30 MANAGEMENT: CMD 'state on'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'log on all'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'echo on all'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'bytecount 5'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'state'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'hold off'
   2024-05-31 11:23:30 MANAGEMENT: CMD 'hold release'
   2024-05-31 11:23:30 PKCS#11: Adding PKCS#11 provider 'rtpkcs11ecp.dll'
   2024-05-31 11:23:30 Initializing OpenSSL support for engine 'gost'

   по идее должен и rtengine загрузиться

   👍React with 👍1Reacted by Maxim