Re: [OpenCA-Devel] Persistent data storage in OpenCA::Token::* ?

[Michael B. <mic...@cm...>]

Martin Bartosch wrote:

> I have implemented a caching mechanism that stores a successful
> infrastructure and key-online check of the HSM, but this is
> basically useless because a new instance seems to be created
> for each private key operation. So the infrastructure check
> is always performed.

We fork for every new GUI connection. We do not use persistent HTTP 
connections. So one click == one new process.

> Would it help to use a different token mode? (Currently it's 'daemon'.)

No.

> As I only need to determine the last time of a successful invocation,
> it would suffice to create an empty file in the temporary directory
> and stat() it to check how much time has elapsed since last write
> access to the file, but unfortunately I don't have the TMP directory
> configuration variable accessible in the module either.

What?! TMPDIR should be available. This variable must be present because 
OpenCA::OpenSSL needs this directory to write and use requests, 
certificates and signatures (incl. data). The token nCipher simply 
passes the parameter to the openssl module but if you copy TMPDIR then 
it is available.

Michael
-- 
_______________________________________________________________

Michael Bell                    Humboldt-Universitaet zu Berlin

Tel.: +49 (0)30-2093 2482       ZE Computer- und Medienservice
Fax:  +49 (0)30-2093 2704       Unter den Linden 6
mic...@cm...   D-10099 Berlin
_______________________________________________________________