122700 - unable to import DSA private key through JCA interface

Status: REOPENED

(NSS :: Libraries, defect, P2)

Description

[Jamie Nicolson]

When importing DSA private keys, NSS requires that the public value also be provided. This parameter is not part of the JCA interface, so there is no way to provide it. This bug prevents us from being able to import DSA keys through the JCA interface.

It is worth noting that the PKCS #11 interface doesn't require the public value either. This is an NSS peculiarity.

Comment 1

[Jamie Nicolson]

This is a JCA compatibility bug. It is not a must-fix for NSS 3.4.

Comment 2

[Wan-Teh Chang]

Assigned the bug to Bob.

Comment 3

[Robert Relyea]

(Sigh) PKCS #11 doesn't require it, but our particular Database Module does.
When importing DSA keys into a netscape key3.db, the public key value is
required (no way around it), so this is a permanent restriction for 3.x. Future
database formats will be able to support the PKCS #11 limitted values and will
allow import of DSA private keys from JCA.

NOTE: you should be able to import DSA private keys into a token which supports
DSA without this restriction.

bob

Comment 4

[Wan-Teh Chang]

Bob,

What I conclude from your comment is that this is
really a restriction of our database format (key3.db)
(as opposed to the NSS 3.x API).  If so, perhaps we
should leave this bug open but target it Future?

Comment 5

[Robert Relyea]

That would be reasonable. A new Database format would certainly want to conform
more closely with the needs of JCS and PKCS #11.

Comment 6

[Wan-Teh Chang]

Changed the QA contact to Bishakha.