How to access passphrase within external provider?

[baentsch]

The documentation regarding the proper use of cbarg within a provider when implementing OSSL_FUNC_encoder_encode_fn is very brief; the code itself seems to suggest it is a (stack-based) struct ossl_passphrase_data_st, which seems to be inaccessible to (external) providers. Internal/libcrypto-based providers can (and do) make use of internal APIs to get access to passphrase information. However, this API set is not available to (external) providers, right?

So what mechanism is suggested to be used by external providers to obtain access to the passphrase, e.g., as set for encrypting private keys? Thanks in advance.

[levitte]

The cbarg is passed to the password callback (OSSL_PASSPHRASE_CALLBACK). It's entirely up to that passphrase callback to define what cbarg actually is. To anyone else, it's simply a pointer that's passed on.

What are you trying to achieve? I might have an idea or two how to do that.

[levitte]

If you have an issue for this in your project, please point at it... it might be easier to discuss ideas there.

[baentsch]

If you have an issue for this in your project, please point at it

OK, it's all part of open-quantum-safe/oqs-provider#2 . Will create suitable code pointers there and reference you.

[mattcaswell]

Is this issue resolved now?

[levitte]

Yes

[baentsch]

For the benefit of anyone looking for information in issues here's the solution in a nutshell: The OSSL_PASSPHRASE_CALLBACK pwcb function needs to be called in the encoder with parameters as documented here to prompt for or retrieve an already set passphrase. Thanks to @levitte for the explanation.