<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Nicola-</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for your response. It does help, but at the same time it also raises questions and maybe conflicts with what I thought I was doing correct earlier in this thread. I'm talking mostly about where I landed in this post:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://www.mail-archive.com/openssl-users@openssl.org/msg87538.html" id="LPlnk249911">https://www.mail-archive.com/openssl-users@openssl.org/msg87538.html</a><br>
</div>
<div id="LPBorder_GTaHR0cHM6Ly93d3cubWFpbC1hcmNoaXZlLmNvbS9vcGVuc3NsLXVzZXJzQG9wZW5zc2wub3JnL21zZzg3NTM4Lmh0bWw." class="LPBorder794101" contenteditable="false" style="width: 100%; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;">
<table id="LPContainer794101" role="presentation" style="padding: 12px 36px 12px 12px; width: 100%; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td style="width: 100%;">
<div id="LPTitle794101" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;">
<a target="_blank" id="LPUrlAnchor794101" href="https://www.mail-archive.com/openssl-users@openssl.org/msg87538.html" style="text-decoration: none; color: var(--themePrimary);">Re: Questions about using Elliptic Curve ciphers in OpenSSL</a></div>
<div id="LPDescription794101" style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;">
Thank you for your response Thulasi, this helped. I'm posting this back to the OpenSSL users list in case it helps anyone else, and in case anyone can help with my additional questions.</div>
<div id="LPMetadata794101" style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;">
www.mail-archive.com</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am only using named curves. You also said:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"...<span style="color: rgb(50, 49, 48); font-family: arial, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">you don't really need at all to generate a ecparam file (which only contains the name): the private key file already contains
the very same name and fully contains what you need to perform ECDSA signatures that can be validated against a matching certificate."</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(50, 49, 48); font-family: arial, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(50, 49, 48); font-family: arial, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">Let me apply that and start from the beginning and outline everything (I think) I need to do in that case:</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
1 - Generate a certificate and private key pair. Using the OpenSSL command line:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<pre style="font-family: courier, "courier new", monospace; font-size: 14px; overflow-wrap: break-word; margin: 0px; background-color: rgb(255, 255, 255)">openssl req -nodes -sha256 -newkey ec:<(openssl ecparam -name prime256v1)
-keyout mykeyout.pem -new -out mycertfileout.pem -config /etc/ssl/openssl.cnf
-x509 -days 365 -outform pem</pre>
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Note: the "ec:" parameter basically substitutes the openssl command above with the file I had created and used in this command. Also, the "-genkey" parameter I included in the ecparam command was probably not needed, or potentially bad?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2 - Call the SSL_CTX_use_PrivateKey_file() and SSL_CTX_use_certificate_file() to use the certificate and private key pair. (Same as before)</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
3 - Call the APIs to set the curves and allow the server to pick the appropriate curves for the client:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<pre style="font-family: courier, "courier new", monospace; font-size: 14px; overflow-wrap: break-word; margin: 0px; background-color: rgb(255, 255, 255)">status = SSL_CTX_set1_curves_list(ctx, "P-521:P-384:P-256");
status = SSL_CTX_set_ecdh_auto(ctx, 1);</pre>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Do I have this right? Is the only difference combining the two commands into one in Step 1 above, instead of the intermediate ecparams file? Or is there something else I'm missing on the generation of certificate/private key
pairs?</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Thanks,</div>
<div style="color: rgb(0, 0, 0);"><br>
Jason</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=""><span style="color: rgb(50, 49, 48); font-family: arial, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255); display: inline !important;"></span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Nicola Tuveri <nic.tuv@gmail.com><br>
<b>Sent:</b> Tuesday, February 18, 2020 2:50 PM<br>
<b>To:</b> Jason Schultz <jetson23@hotmail.com><br>
<b>Cc:</b> Kyle Hamilton <aerowolf@gmail.com>; openssl-users <openssl-users@openssl.org><br>
<b>Subject:</b> Re: Questions about using Elliptic Curve ciphers in OpenSSL</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="x_gmail_default" style="font-family:arial,sans-serif">The ec parameters are public anyway, so there is no real need to store such files somewhere with restricted reading access.<br>
<br>
On the other hand, I want to reiterate that if you are using (and this is highly recommended) one of the named curves (e.g. NIST P-256) you don't really need at all to generate a ecparam file (which only contains the name): the private key file already contains
the very same name and fully contains what you need to perform ECDSA signatures that can be validated against a matching certificate.<br>
<br>
In the same way, for the ECDHE part, pick curves that you want to support (most TLS 1.2 and 1.3 clients will be happy to support P-256 and X25519 key exchanges) from the named curves: also in this case there is no need to generate a separate ecparam file.<br>
<br>
Hope this helps!<br>
<br>
Best regards,<br>
<br>
Nicola Tuveri<br>
<br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Tue, 18 Feb 2020 at 15:27, Jason Schultz <<a href="mailto:jetson23@hotmail.com">jetson23@hotmail.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
This comment does spark another question though. Do I need to protect the ecparam file I created for us in generating the private key? I know the private key should reside in /etc/ssl/private/ as that directory has no read access. Right now I have the ecparam
generated file in /etc/ssl/dsaparams/, which is readable. Should that file also reside in /etc/ssl/private/ so it's protected?</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div>
<div id="x_gmail-m_-4969425567052503997appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_-4969425567052503997divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Kyle Hamilton <<a href="mailto:aerowolf@gmail.com" target="_blank">aerowolf@gmail.com</a>><br>
<b>Sent:</b> Sunday, February 16, 2020 10:49 PM<br>
<b>To:</b> Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank">jetson23@hotmail.com</a>><br>
<b>Cc:</b> Thulasi Goriparthi <<a href="mailto:thulasi.goriparthi@gmail.com" target="_blank">thulasi.goriparthi@gmail.com</a>>; openssl-users <<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a>><br>
<b>Subject:</b> Re: Questions about using Elliptic Curve ciphers in OpenSSL</font>
<div> </div>
</div>
<div>
<div dir="auto">
<div>Be aware that you just posted your certificate's private key, and thus you should regenerate a new keypair/certificate to use. Otherwise, anyone who can manipulate traffic to your machine can execute a man-in-the-middle attack.</div>
<div dir="auto">
<div dir="auto"><br>
</div>
<div dir="auto">-Kyle H</div>
<br>
<br>
<div dir="auto">
<div dir="ltr">On Fri, Feb 14, 2020, 07:40 Jason Schultz <<a href="mailto:jetson23@hotmail.com" target="_blank">jetson23@hotmail.com</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div>
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thank you for your response Thulasi, this helped. I'm posting this back to the OpenSSL users list in case it helps anyone else, and in case anyone can help with my additional questions. While waiting for responses, I've been able to find out how my certificate
and keys were generated. I'd like to walk through that to hopefully verify I'm handling things correctly.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
First, here is how my EC parameters file was generated:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
openssl ecparam -name prime256v1 -genkey -out myecparamsfile.pem</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
And the resulting file:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0in; font-family:"Courier New"">M640A-SAIL:/etc/ssl # openssl ecparam -in
<span style="font-family:"Courier New"; background-color:rgb(255,255,255); display:inline">
myecparamsfile</span>.pem -text</p>
<p style="margin:0in; font-family:"Courier New"">ASN1 OID: prime256v1</p>
<p style="margin:0in; font-family:"Courier New"">NIST CURVE: P-256</p>
<p style="margin:0in; font-family:"Courier New"">-----BEGIN EC PARAMETERS-----</p>
<p style="margin:0in; font-family:"Courier New"">BggqhkjOPQMBBw==</p>
<p style="margin:0in; font-family:"Courier New"">-----END EC PARAMETERS-----</p>
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0in; font-family:"Courier New""> # openssl ecparam -in myecparamsfile.pem -text</p>
<p style="margin:0in; font-family:"Courier New"">ASN1 OID: prime256v1</p>
<p style="margin:0in; font-family:"Courier New"">NIST CURVE: P-256</p>
<p style="margin:0in; font-family:"Courier New"">-----BEGIN EC PARAMETERS-----</p>
<p style="margin:0in; font-family:"Courier New"">BggqhkjOPQMBBw==</p>
<p style="margin:0in; font-family:"Courier New"">-----END EC PARAMETERS-----</p>
<br>
</div>
<div>
<div id="x_gmail-m_-4969425567052503997x_m_7334009758260241939x_appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Is this good so far? Do I need the -genkey?</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Then I take this file and use it when I generate my certificate and private key pair, here is the openssl command I used:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>openssl req -nodes -sha256 -newkey ec:/etc/ssl/private/myecparamsfile.pem -keyout mykeyout.pem -new -out mycertfileout.pem -config /etc/ssl/openssl.cnf -x509 -days 365 -outform pem<br>
</span>
<div>Generating a EC private key<br>
</div>
<div>writing new private key to 'mykeyout.pem'<br>
</div>
<div><parameter input snipped></div>
<div><br>
</div>
<div>And the resulting key:</div>
<div><br>
</div>
<div><span># cat mykeyout.pem<br>
</span>
<div>-----BEGIN PRIVATE KEY-----<br>
</div>
<div>MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgbfUwVhomun9Q5IAY<br>
</div>
<div>xTOAn+sDoXZ+k4UWkvUyfshPBJ6hRANCAAQsakFVUTV4JmfVJH31XOvHVhhBodnV<br>
</div>
<div>8evYCJSd2Jgo4uOomCSh3oekKL+Tia+LOmynygfvmneOX2YadoNr9uzH<br>
</div>
<div>-----END PRIVATE KEY-----<br>
</div>
<span></span><br>
</div>
<div><span># openssl ec -noout -text -in mykeyout.pem<br>
</span>
<div>read EC key<br>
</div>
<div>Private-Key: (256 bit)<br>
</div>
<div>priv:<br>
</div>
<div> 6d:f5:30:56:1a:26:ba:7f:50:e4:80:18:c5:33:80:<br>
</div>
<div> 9f:eb:03:a1:76:7e:93:85:16:92:f5:32:7e:c8:4f:<br>
</div>
<div> 04:9e<br>
</div>
<div>pub:<br>
</div>
<div> 04:2c:6a:41:55:51:35:78:26:67:d5:24:7d:f5:5c:<br>
</div>
<div> eb:c7:56:18:41:a1:d9:d5:f1:eb:d8:08:94:9d:d8:<br>
</div>
<div> 98:28:e2:e3:a8:98:24:a1:de:87:a4:28:bf:93:89:<br>
</div>
<div> af:8b:3a:6c:a7:ca:07:ef:9a:77:8e:5f:66:1a:76:<br>
</div>
<div> 83:6b:f6:ec:c7<br>
</div>
<div>ASN1 OID: prime256v1<br>
</div>
<div>NIST CURVE: P-256<br>
</div>
<span></span><br>
</div>
<div>And certificate:</div>
<div><br>
</div>
<div><span>M740A-PMM1:/etc/ssl # openssl x509 -text -in mycertfileout.pem<br>
</span>
<div>Certificate:<br>
</div>
<div> Data:<br>
</div>
<div> Version: 3 (0x2)<br>
</div>
<div> Serial Number:<br>
</div>
<div> e2:2f:c6:e4:bf:f1:de:20<br>
</div>
<div> Signature Algorithm: ecdsa-with-SHA256<br>
</div>
<div> Issuer: C=US, ST=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">NY</span>, L=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">Loc</span>,
O=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">Org</span>, OU=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">test</span>, CN=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">My
Name/emailAddress=</span><span style="margin:0px; font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">test@example</span><span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">.com</span><br>
</div>
<div> Validity<br>
</div>
<div> Not Before: Feb 13 16:11:39 2020 GMT<br>
</div>
<div> Not After : Feb 12 16:11:39 2021 GMT<br>
</div>
<div> Subject: C=US, ST=NY, L=Loc, O=Org, OU=test, CN=My Name/emailAddress=<span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline">test@example</span>.com<br>
</div>
<div> Subject Public Key Info:<br>
</div>
<div> Public Key Algorithm: id-ecPublicKey<br>
</div>
<div> Public-Key: (256 bit)<br>
</div>
<div> pub:<br>
</div>
<div> 04:2c:6a:41:55:51:35:78:26:67:d5:24:7d:f5:5c:<br>
</div>
<div> eb:c7:56:18:41:a1:d9:d5:f1:eb:d8:08:94:9d:d8:<br>
</div>
<div> 98:28:e2:e3:a8:98:24:a1:de:87:a4:28:bf:93:89:<br>
</div>
<div> af:8b:3a:6c:a7:ca:07:ef:9a:77:8e:5f:66:1a:76:<br>
</div>
<div> 83:6b:f6:ec:c7<br>
</div>
<div> ASN1 OID: prime256v1<br>
</div>
<div> NIST CURVE: P-256<br>
</div>
<div> X509v3 extensions:<br>
</div>
<div> X509v3 Subject Key Identifier:<br>
</div>
<div> D6:8A:F3:3B:4E:A1:F8:F8:34:C1:1B:7A:EC:BF:9B:58:7F:68:4A:D9<br>
</div>
<div> X509v3 Authority Key Identifier:<br>
</div>
<div> keyid:D6:8A:F3:3B:4E:A1:F8:F8:34:C1:1B:7A:EC:BF:9B:58:7F:68:4A:D9<br>
</div>
<div><br>
</div>
<div> X509v3 Basic Constraints:<br>
</div>
<div> CA:TRUE<br>
</div>
<div> Signature Algorithm: ecdsa-with-SHA256<br>
</div>
<div> 30:44:02:20:37:f0:f7:f7:4a:b4:8e:8f:64:72:e4:d1:31:9f:<br>
</div>
<div> a1:36:c5:5d:f3:42:4c:24:37:75:cf:b6:55:b0:66:1b:6e:63:<br>
</div>
<div> 02:20:39:18:81:f8:6c:86:3a:57:74:05:cc:99:6c:d9:dc:6a:<br>
</div>
<span> a2:20:98:4c:66:a1:97:d1:c7:ea:42:b4:01:1a:f7:b2</span><br>
</div>
<div><span><br>
</span></div>
<div>Then I call the APIs as described in my first email to use them:</div>
<div><br>
</div>
<div>
<pre style="font-family:courier,"courier new",monospace; font-size:14px; margin:0px; background-color:rgb(255,255,255)">ctx = SSL_CTX_new(TLS_method());</pre>
<pre style="font-family:courier,"courier new",monospace; font-size:14px; margin:0px; background-color:rgb(255,255,255)">status = SSL_CTX_use_PrivateKey_file(ctx,<keyfile>,SSL_FILETYPE_PEM);
status = SSL_CTX_use_certificate_file(ctx, ,<certfile>,SSL_FILETYPE_PEM);</pre>
<br>
</div>
<div>
<pre style="font-family:courier,"courier new",monospace; font-size:14px; margin:0px; background-color:rgb(255,255,255)">// Verify the cert and key are a pair
status = SSL_CTX_check_private_key(ctx);</pre>
<br>
</div>
<div>Then call the APIs to set the curves and allow the server to pick the appropriate curve for the client:</div>
<div><br>
</div>
<div>
<pre style="font-family:courier,"courier new",monospace; font-size:14px; margin:0px; background-color:rgb(255,255,255)">status = SSL_CTX_set1_curves_list(ctx, "P-521:P-384:P-256");
status = SSL_CTX_set_ecdh_auto(ctx, 1);</pre>
<br>
</div>
<div>That should be it, right? The EC parameters file has been used to generate the private key, it does not need to be read in by an API call.</div>
<div><br>
</div>
<div>With the steps above, I get a successful TLS connection from a client using ECDHE-ECDSA-AES256-GCM-SHA384.</div>
<div><br>
</div>
<div>And yes, I think my main confusion was on what to do with the DH parameters file. I thought using ECDHE key exchange was similar to DSA with DH. With ECDHE, I don't need to read in a parameters file at all.</div>
<div><br>
</div>
<div>If there's anything wrong above, please let me know, otherwise, thanks for all the help!</div>
<div><br>
</div>
<span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_-4969425567052503997x_m_7334009758260241939x_divRplyFwdMsg" dir="ltr">
<font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Thulasi Goriparthi <<a href="mailto:thulasi.goriparthi@gmail.com" rel="noreferrer" target="_blank">thulasi.goriparthi@gmail.com</a>><br>
<b>Sent:</b> Wednesday, February 12, 2020 8:29 AM<br>
<b>To:</b> <a href="mailto:jetson23@hotmail.com" rel="noreferrer" target="_blank">
jetson23@hotmail.com</a> <<a href="mailto:jetson23@hotmail.com" rel="noreferrer" target="_blank">jetson23@hotmail.com</a>><br>
<b>Cc:</b> <a href="mailto:rsalz@akamai.com" rel="noreferrer" target="_blank">rsalz@akamai.com</a> <<a href="mailto:rsalz@akamai.com" rel="noreferrer" target="_blank">rsalz@akamai.com</a>><br>
<b>Subject:</b> Re: Questions about using Elliptic Curve ciphers in OpenSSL</font>
<div> </div>
</div>
<div>
<div dir="auto">To clarify further, EC keys can be generated from either explicit (group) parameters or named curves which are standardized numbers to specific group parameters.
<div dir="auto"><br>
</div>
<div dir="auto">Explicit/Custom EC parameters are not recommended/convenient/usual. Your key contains parameters in the form of a named curve (p-256).</div>
<div dir="auto"><br>
</div>
<div dir="auto">You are probably getting confused between dhparam used to generate ephemeral keys for DHE based key exchange and EC curve selection for ECDHE based key exchange. </div>
<div dir="auto"><br>
</div>
<div dir="auto">Curve selection for ECDHE will be done from the list of curves offered by the client and can be different from the curve used in the server's certificate(ECDSA).</div>
<div dir="auto"><br>
</div>
<div dir="auto">Thanks,</div>
<div dir="auto">Thulasi.</div>
<br>
<br>
<div dir="auto">
<div dir="ltr">On Tue, 11 Feb, 2020, 23:24 Salz, Rich via openssl-users, <<a href="mailto:openssl-users@openssl.org" rel="noreferrer" target="_blank">openssl-users@openssl.org</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div lang="EN-US">
<div>
<p style="margin-top:0px; margin-bottom:0px">I believe you just load your ECDSA cert and the other stuff – Dhparams!! – is not needed.<u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p style="margin-top:0px; margin-bottom:0px"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>