<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1494498174280_29791">The message is first signed then encrypted. Commands are as follows<br></div><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1494498174280_29795" style="display: block;"><div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1494498174280_29794"><div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1494498174280_29793"><div class="y_msg_container" id="yui_3_16_0_ym19_1_1494498174280_29843"><div id="yiv0785213356"><div style="color:#000;background-color:#fff;font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yui_3_16_0_ym19_1_1494498174280_29842"><div id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7283"><span><br clear="none"></span></div><pre id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7371" style="margin:0px 10px 10px;padding:0px;font-size:1em;line-height:19.6px;width:auto;background-color:rgb(245, 245, 245);"><span id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7372" style="font-family:Consolas,;">/usr/bin/openssl cms -encrypt -aes128 -in /tmp/OpenSSL5294490400891792656.eml -out /tmp/OpenSSL3519826551660167644.eml -subject 'subject' -from sender@sender.com -to recipient@recipient.com,recipient2@recipient.com -recip cert1.pem -recip cert2.pem -keyopt rsa_padding_mode:oaep</span></pre><div class="yiv0785213356qtdSeparateBR" dir="ltr" id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7284">I maybe could provide a problematic e-mail including private keys - off the list - due privacy concerns to investigate - would that be acceptable ? If so - what e-mail address can i sent it to<br clear="none"><br clear="none"></div><div class="yiv0785213356yqt3925635592" id="yiv0785213356yqt54898"><div class="yiv0785213356yahoo_quoted" id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7290" style="display:block;"> <div id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7289" style="font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"> <div id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7288" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"> <div dir="ltr" id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7287"> <font id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7286" size="2" face="Arial"> </font><hr id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7285" size="1"> <b id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7292"><span id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7291" style="font-weight:bold;">From:</span></b> Dr. Stephen Henson <steve@openssl.org><br clear="none"> <b id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7294"><span id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7293" style="font-weight:bold;">To:</span></b> Harakiri <harakiri_23@yahoo.com>; openssl-users@openssl.org <br clear="none"> <b id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7296"><span id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7295" style="font-weight:bold;">Sent:</span></b> Tuesday, May 9, 2017 1:04 AM<br clear="none"> <b id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7301"><span id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7300" style="font-weight:bold;">Subject:</span></b> Re: [openssl-users] Some S/MIME CMS encrypted messages produce invalid key length when using the debug_decrypt option<br clear="none"> </div> <div class="yiv0785213356y_msg_container" id="yiv0785213356yui_3_16_0_ym19_1_1494402797836_7302"><br clear="none">On Mon, May 08, 2017, Harakiri via openssl-users wrote:<div class="yiv0785213356yqt3747127295" id="yiv0785213356yqtfd03929"><br clear="none"><br clear="none">> Im using the cmd client openssl cms -decrypt with the "debug_decrypt" option to have the same behaviour as before the bleichenbach security patch to use decryption without recipient public keys.<br clear="none">> For some reason, some messages will produce the following error on OpenSSL 1.0.2d and even OpenSSL 1.0.2k<br clear="none">> Error decrypting CMS structure6828:error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length:evp_enc.c:593:6828:error:2E078076:CMS routines:cms_EncryptedContent_init_bio:invalid key length:cms_enc.c:163:<br clear="none">> Calling cms -decrypt without the debug_decrypt option produces no error.<br clear="none">> What is weird, is that its always basically the same source e-mail encrypted using openssl cms with aes-128-cbc and rsaesOaep and sometimes the resulting messagewill produce this error and other times it works.</div><br clear="none">> <br clear="none">> <br clear="none"><br clear="none">That's odd. What command line are you using to create the messages?<br clear="none"><br clear="none">Would it be possible to create a test case that reproduces this error?<br clear="none"><br clear="none">Steve.<br clear="none">--<br clear="none">Dr Stephen N. Henson. OpenSSL project core developer.<br clear="none">Commercial tech support now available see: <a rel="nofollow" shape="rect" target="_blank" href="http://www.openssl.org/">http://www.openssl.org</a><div class="yiv0785213356yqt3747127295" id="yiv0785213356yqtfd57057"><br clear="none"></div><br clear="none"><br clear="none"></div> </div> </div> </div></div></div></div><br><br></div> </div> </div> </div></div></body></html>