ANN: Native X.509, RSA and HSM Support for mORMot 2 on FPC

[abouchez]

Today, almost all computer security relies on asymmetric cryptography and X.509 certificates as file or hardware modules.
And the RSA algorithm is still used to sign the vast majority of those certificates. Even if there are better options (like ECC-256), RSA-2048 seems the actual standard, at least still allowed for a few years.

We just added pure pascal RSA cryptography and X.509 certificates support in mORMot 2.
Last but not least, we also added Hardware Security Modules support via the PKCS#11 standard.
Until now, we were mostly relying on OpenSSL, but a native embedded solution would be smaller in code size, better for reducing dependencies, and easier to work with (especially for HSM). The main idea is to offer only safe algorithms and methods, so that you can write reliable software, even if you are no cryptographic expert.

I have seen an attempt to RSA cryptography in FPC FCL trunk (I started from it), but it was far from finished, not OOP oriented, slow, and not following coding best practice required for modern cryptography.
So I rewrote everything from scratch, and added some i386/x86_64 asm for good performance.
Everything has low-level set of classes, but also high-level interfaces with an unique cryptography catalog, so that you can e.g. switch from OpenSSL to mORMot engines just by using the right factory.
AFAIK there was no complete and up-to-date OpenSource X.509 cross-platform support for FPC, including a full PKI with CSR, CRL and PKCS#11 support, including RSA and ECC-256 efficient pure pascal code.

More information in our blog article about this almost unique features set in FPC (and Delphi):
https://blog.synopse.info/?post/2023/12/09/Native-X.509-and-RSA-Support
 

[AlexTP]

Great work. I hope someday FPC authors will grab your code.

[WayneSherman]

We just added pure pascal RSA cryptography and X.509 certificates support in mORMot 2.
Last but not least, we also added Hardware Security Modules support via the PKCS#11 standard.
Until now, we were mostly relying on OpenSSL, but a native embedded solution would be smaller in code size, better for reducing dependencies, and easier to work with (especially for HSM).

Congratulations on this accomplishment and thank you.

[avra]

Amazing news. Thank you! 

[Thaddy]

Our member Xor-el also did a ative FreePascal software version a couple of years ago. No HSM support, though.
But I will check out the new version of mORMot and test it a couple of times.

Unfortunately our Nigerian friend with the unpronouncable name Ugochukwu Mmaduekwe shows little activity for some time. Code is good, though.

[Zoran]

Unfortunately our Nigerian friend with the unpronouncable name Ugochukwu Mmaduekwe shows little activity for some time. Code is good, though.

The well written code does not need any interventions.

[abouchez]

Our member Xor-el also did a ative FreePascal software version a couple of years ago. No HSM support, though.

AFAICT in this library: no RSA support, no X.509 certificate support, no X.509 CSR support, no X.509 CRL support, no PKI support, no HSM support..
So nothing in common with what we just published. 

[abouchez]

The well written code does not need any interventions.

I do not know in which world you are living?

[Zoran]

The well written code does not need any interventions.

I do not know in which world you are living?

Isn't it an obvious fact? If the code is written perfectly...

[abouchez]

Isn't it an obvious fact? If the code is written perfectly...

This should be a smart phone or an artificial intelligence, then....