forked from openssl/openssl
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add readme for integrating indirect POPO.
- Loading branch information
Showing
1 changed file
with
26 additions
and
0 deletions.
There are no files selected for viewing
26 changes: 26 additions & 0 deletions
26
test/recipes/80-test_cmp_http_data/Mock/ReadMe_indirect-POPO.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
# Indirect POPO | ||
|
||
For testing Indirect POPO, checkout below branch from siemens/openssl | ||
``` | ||
https://github.com/siemens/openssl/tree/CMP_KEM_cert_indirect_popo | ||
```` | ||
# Prerequisite | ||
oqs provider is required to use PQ algorithms. | ||
To execute CMP client for KEM certificates- | ||
``` | ||
$ cd test/recipes/80-test_cmp_http_data/Mock | ||
$ openssl cmp -server 127.0.0.1:1701 -config test.cnf -section "Mock commands" -no_proxy 127.0.0.1 -cmd cr -cert signer.crt -key signer.key -certout out.test.pem -popo 2 -newkey kyber1024.priv -srvcert server.crt -out_trusted root.crt -provider oqsprovider -provider default | ||
```` | ||
Following configuration need to be adapted: | ||
- "-cert signer.crt" & "-key signer.key" is CMP protection credentials. | ||
- "-newkey kyber1024.priv" is the key of new certificates. | ||
- "-srvcert server.crt" Server cert to pin and trust directly when verifying signed CMP responses. | ||
- "out_trusted root.crt" is TA for newly enrolled certificates. | ||