I am on a trade-off between the use of OpenSSL or NSS in an embedded Linux application that makes use of a TPM (HSM).
EDIT: I need a SSH server and Apache using TLS, both using the keys protected by the TPM.
I am looking for satisfying the following constraints:
- Good support of PKCS#11 (at least management of Elliptic Curve keys)
- Not too many dependencies
- Cross compilation friendly
As far as I could find, NSS natively supports PKCS#11, and OpenSSL needs an external engine, libengine-pkcs11-openssl, which supports only RSA keys. So an OpenSSL choice would lead me to add functionalities to this engine. Are there other PKCS11 engines available for OpenSSL with better support than this one?
Concerning dependencies, NSS requires the Netscape Portable Runtime (NSPR). In total, NSS and its dependencies have 2.5 x more lines of code than OpenSSL. This is a drawback and possibly a show-stopper for embedded applications, except if parts of it useless for the application can be easily dropped from the compilation via some defines. Is it possible?
Concerning cross-compilation, the wikipedia comparison says NSS is cumbersome. Does someone have a how-to to propose or a link please?
More generally, advice of people having experienced one or both of them with a TPM is welcome.