<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:171845135;
mso-list-type:hybrid;
mso-list-template-ids:735066440 -54373594 1074331673 1074331675 1074331663 1074331673 1074331675 1074331663 1074331673 1074331675;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:54.0pt;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:90.0pt;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:126.0pt;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:162.0pt;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:198.0pt;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:234.0pt;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:270.0pt;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:306.0pt;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:342.0pt;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IN" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi</span>,<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">we could not get the pointer reference to the examples of safe primes or using probable primes which you mentioned (i.e. The man page in section 7 (EVP_PKEY_DH) has examples)<o:p></o:p></p>
<p class="MsoNormal">And also we wanted to check the usage of OSSL_PARAM_construct_xxx. Appreciate if you can pass on the web link.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Secondly, we referred to the apps/speed.c , and we are not clear on two things.<o:p></o:p></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo1"><span style="mso-fareast-language:EN-US">What “<b>ffdh_params</b>” should we use in our application when we call to EVP_PKEY_CTX_set_dh_nid ( I see an array of {"ffdh2048",
NID_ffdhe2048, 2048},…. Been used in the example)<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo1"><span style="mso-fareast-language:EN-US">In our present DH logic, we have public/private keys ( BIGNUM *pub_key, BIGNUM *priv_key) obtained from DH, how to get pub/priv keys using
EVP_PKEY_new() ? <o:p></o:p></span></li></ol>
<p class="MsoListParagraph" style="margin-left:54.0pt"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Sunil<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> openssl-users <openssl-users-bounces@openssl.org>
<b>On Behalf Of </b>openssl-users-request@openssl.org<br>
<b>Sent:</b> 09 December 2020 02:01<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> openssl-users Digest, Vol 73, Issue 6<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">NOTICE: This email was received from an EXTERNAL sender<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><br>
Send openssl-users mailing list submissions to<br>
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openssl-users-request@openssl.org">openssl-users-request@openssl.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openssl-users-owner@openssl.org">openssl-users-owner@openssl.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Use OpenSSL to decrypt TLS session from PCAP files<br>
(Matt Caswell)<br>
2. Re: Use OpenSSL to decrypt TLS session from PCAP files<br>
(John Baldwin)<br>
3. DH_generate_key (Narayana, Sunil Kumar)<br>
4. RE: DH_generate_key (Sands, Daniel)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 8 Dec 2020 15:46:00 +0000<br>
From: Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>><br>
To: <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
Subject: Re: Use OpenSSL to decrypt TLS session from PCAP files<br>
Message-ID: <<a href="mailto:8f9c7ad4-f3cb-38a1-0968-61833bb77462@openssl.org">8f9c7ad4-f3cb-38a1-0968-61833bb77462@openssl.org</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
<br>
<br>
On 08/12/2020 15:28, Oren Shpigel wrote:<br>
> Hi, thanks for the answer.<br>
> <br>
> I know wireshark and ssldump have this capability, but I'm looking for a<br>
> way to do it in my own software in C++, (using OpenSSL, if possible, but<br>
> open to other suggestions as well).<br>
<br>
Unfortunately OpenSSL does not support this capability. It obviously<br>
supports all the required low-level crypto primitives to do it - but you<br>
would have to put them together yourself, as well as do all the packet<br>
parsing, etc. This would be ... difficult. :-)<br>
<br>
Matt<br>
<br>
<br>
> <br>
> On Tue, Dec 8, 2020 at 4:32 PM Dr. Matthias St. Pierre<br>
> <<a href="mailto:Matthias.St.Pierre@ncp-e.com%20%3cmailto:Matthias.St.Pierre@ncp-e.com">Matthias.St.Pierre@ncp-e.com <mailto:Matthias.St.Pierre@ncp-e.com</a>>> wrote:<br>
> <br>
> Do you need to integrate the decryption into your own software, or<br>
> are you just looking for a possibility to monitor and view the<br>
> traffic?____<br>
> <br>
> If it?s the latter, try and take a look at the SSL decryption<br>
> support that Wireshark provides. ____<br>
> <br>
> __?__<br>
> <br>
> <a href="https://wiki.wireshark.org/TLS____">
https://wiki.wireshark.org/TLS____</a><br>
> <br>
> <a href="https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/____">
https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/____</a><br>
> <br>
> __?__<br>
> <br>
> __?__<br>
> <br>
> hth,____<br>
> <br>
> Matthias____<br>
> <br>
> __?__<br>
> <br>
> Disclaimer: I haven?t used it for TLS myself, only for IPsec, and I<br>
> can?t tell how up-to-date it is, in particular whether it is TLS 1.3<br>
> ready.____<br>
> <br>
> __?__<br>
> <br>
> ?<br>
> <br>
> *NCP engingeering GmbH* ** *Dr. Matthias St. Pierre*<br>
> <br>
> Senior Software Engineer<br>
> <a href="mailto:matthias.st.pierre@ncp-e.com">matthias.st.pierre@ncp-e.com</a> <<a href="mailto:matthias.st.pierre@ncp-e.com">mailto:matthias.st.pierre@ncp-e.com</a>><br>
> Phone: +49 911 9968-0<br>
> <a href="http://www.ncp-e.com">
www.ncp-e.com</a> <<a href="http://www.ncp-e.com">http://www.ncp-e.com</a>><br>
> <br>
> *<br>
> Follow us on:*?Facebook <<a href="https://www.facebook.com/NCPengineering">https://www.facebook.com/NCPengineering</a>> |<br>
> Twitter <<a href="https://twitter.com/NCP_engineering">https://twitter.com/NCP_engineering</a>>?| Xing<br>
> <<a href="https://www.xing.com/companies/ncpengineeringgmbh">https://www.xing.com/companies/ncpengineeringgmbh</a>>?| YouTube<br>
> <<a href="https://www.youtube.com/user/NCPengineeringGmbH">https://www.youtube.com/user/NCPengineeringGmbH</a>> | LinkedIn<br>
> <<a href="http://www.linkedin.com/company/ncp-engineering-inc.?trk=cws-cpw-coname-0-0">http://www.linkedin.com/company/ncp-engineering-inc.?trk=cws-cpw-coname-0-0</a>><br>
> <br>
> *Headquarters Germany: *NCP engineering GmbH ? Dombuehler Str. 2 ?<br>
> 90449 ? Nuremberg<br>
> *North American HQ:* NCP engineering Inc. ? 601 Cleveland Str.,<br>
> Suite 501-25 ? Clearwater, FL 33755<br>
> <br>
> Authorized representatives: Peter Soell, Patrick Oliver Graf, Beate<br>
> Dietrich<br>
> Registry Court: Lower District Court of Nuremberg<br>
> Commercial register No.: HRB 7786 Nuremberg, VAT identification No.:<br>
> DE 133557619<br>
> <br>
> This e-mail message including any attachments is for the sole use of<br>
> the intended recipient(s) and may contain privileged or confidential<br>
> information. Any unauthorized review, use, disclosure or<br>
> distribution is prohibited. If you are not the intended recipient,<br>
> please immediately contact the sender by reply e-mail and delete the<br>
> original message and destroy all copies thereof.<br>
> <br>
> <<a href="https://www.ncp-e.com/de/aktuelles/events/veranstaltungen">https://www.ncp-e.com/de/aktuelles/events/veranstaltungen</a>><<a href="https://www.ncp-e.com/de/aktuelles/events/veranstaltungen">https://www.ncp-e.com/de/aktuelles/events/veranstaltungen</a>><br>
> <br>
> <br>
> *From**:*openssl-users <<a href="mailto:openssl-users-bounces@openssl.org%0b">openssl-users-bounces@openssl.org<br>
</a>> <<a href="mailto:openssl-users-bounces@openssl.org">mailto:openssl-users-bounces@openssl.org</a>>> *On Behalf Of *Oren Shpigel<br>
> *Sent:* Tuesday, December 8, 2020 3:15 PM<br>
> *To:* <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a> <<a href="mailto:openssl-users@openssl.org">mailto:openssl-users@openssl.org</a>><br>
> *Subject:* Use OpenSSL to decrypt TLS session from PCAP files____<br>
> <br>
> __?__<br>
> <br>
> Hi,?____<br>
> <br>
> I generated a PCAP file with TLS session, and I have the matching<br>
> private key used by my HTTPS server.<br>
> The TLS session is not using DH for key exchange, so it should be<br>
> possible to decrypt.<br>
> I know OpenSSL can be used to connect to a socket to "actively"<br>
> handle the TLS session, but is there a way to "passively" decode and<br>
> decrypt a session?<br>
> How can I "feed" the packets (both directions) into the OpenSSL<br>
> library?____<br>
> <br>
> Thanks!____<br>
> <br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Tue, 8 Dec 2020 09:17:54 -0800<br>
From: John Baldwin <<a href="mailto:jhb@FreeBSD.org">jhb@FreeBSD.org</a>><br>
To: Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>>, <a href="mailto:openssl-users@openssl.org">
openssl-users@openssl.org</a><br>
Subject: Re: Use OpenSSL to decrypt TLS session from PCAP files<br>
Message-ID: <<a href="mailto:a13039b5-4e75-543a-fbcf-bcf7caf1c3d0@FreeBSD.org">a13039b5-4e75-543a-fbcf-bcf7caf1c3d0@FreeBSD.org</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 12/8/20 7:46 AM, Matt Caswell wrote:<br>
> <br>
> <br>
> On 08/12/2020 15:28, Oren Shpigel wrote:<br>
>> Hi, thanks for the answer.<br>
>><br>
>> I know wireshark and ssldump have this capability, but I'm looking for a<br>
>> way to do it in my own software in C++, (using OpenSSL, if possible, but<br>
>> open to other suggestions as well).<br>
> <br>
> Unfortunately OpenSSL does not support this capability. It obviously<br>
> supports all the required low-level crypto primitives to do it - but you<br>
> would have to put them together yourself, as well as do all the packet<br>
> parsing, etc. This would be ... difficult. :-)<br>
<br>
You could use a memory BIO or the like to feed the reconstructed data<br>
stream into to handle the TLS bits though? You are still stuck with<br>
writing your own TCP stack (effectively)? I think openvpn does something<br>
like this when I looked (it used memory BIOs to and then manually<br>
read/wrote their contents on its tunnel socket).<br>
<br>
-- <br>
John Baldwin<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 8 Dec 2020 17:43:47 +0000<br>
From: "Narayana, Sunil Kumar" <<a href="mailto:sanarayana@rbbn.com">sanarayana@rbbn.com</a>><br>
To: "<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
Subject: DH_generate_key<br>
Message-ID:<br>
<<a href="mailto:SN6PR03MB40618D30CCD11C458E2B2EB2B0CD0@SN6PR03MB4061.namprd03.prod.outlook.com">SN6PR03MB40618D30CCD11C458E2B2EB2B0CD0@SN6PR03MB4061.namprd03.prod.outlook.com</a>><br>
<br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Dear openssl team,<br>
<br>
While migrating from 1.0.2 to 3.0, we found that DH_generate_key() has be deprecated. And as per the man page, it is advised to use EVP_PKEY_derive_init<<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html</a>>
& EVP_PKEY_derive<<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html</a>><br>
our application creates a new DH and using DH_generate_key() creates pub_key/priv_key and uses it. how can we replace this exactly with EVP.<br>
And please suggest what EVP API's should we use to generate pub/priv keys ?<br>
<br>
Application code<br>
<br>
dh = DH_new();<br>
dh->p = BN_bin2bn(modSize, octet_len, NULL);<br>
dh->g = BN_bin2bn(H235Bits_generator, H235Bits_generator_len / 8, NULL);<br>
<br>
if ( ! DH_generate_key(dh) )<br>
{<br>
return FAILURE;<br>
}<br>
n = (unsigned) BN_num_bytes(dh->pub_key);<br>
<br>
BN_bn2bin(dh->pub_key, p);<br>
n = (unsigned) BN_num_bytes(dh->priv_key);<br>
<br>
<br>
Instead above logic can we do this ? is derive generated pub/priv keys ?<br>
<br>
//create ctx<br>
Ctx = EVP_PKEY_CTX_new_from_name (NULL, "DM", NULL);<br>
EVP_PKEY_derive_init (ctx)<br>
<br>
<br>
Regards,<br>
Sunil<br>
<br>
<br>
-----------------------------------------------------------------------------------------------------------------------<br>
Notice: This e-mail together with any attachments may contain information of Ribbon Communications Inc. that<br>
is confidential and/or proprietary for the sole use of the intended recipient. Any review, disclosure, reliance or<br>
distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended<br>
recipient, please notify the sender immediately and then delete all copies, including any attachments.<br>
-----------------------------------------------------------------------------------------------------------------------<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20201208/9e8c0a5b/attachment-0001.html">https://mta.openssl.org/pipermail/openssl-users/attachments/20201208/9e8c0a5b/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Tue, 8 Dec 2020 20:30:22 +0000<br>
From: "Sands, Daniel" <<a href="mailto:dnsands@sandia.gov">dnsands@sandia.gov</a>><br>
To: "<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
Subject: RE: DH_generate_key<br>
Message-ID:<br>
<<a href="mailto:0223126022f1463f903459929b4902c6@ES08AMSNLNT.srn.sandia.gov">0223126022f1463f903459929b4902c6@ES08AMSNLNT.srn.sandia.gov</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Dear openssl team,<br>
<br>
While migrating from 1.0.2 to 3.0, we found that DH_generate_key() has be deprecated. And as per the man page, it is advised to use EVP_PKEY_derive_init<<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html</a>>
& EVP_PKEY_derive<<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html</a>><br>
our application creates a new DH and using DH_generate_key() creates pub_key/priv_key and uses it. how can we replace this exactly with EVP.<br>
And please suggest what EVP API?s should we use to generate pub/priv keys ?<br>
<br>
Application code<br>
<br>
dh = DH_new();<br>
dh->p = BN_bin2bn(modSize, octet_len, NULL);<br>
dh->g = BN_bin2bn(H235Bits_generator, H235Bits_generator_len / 8, NULL);<br>
<br>
if ( ! DH_generate_key(dh) )<br>
{<br>
return FAILURE;<br>
}<br>
n = (unsigned) BN_num_bytes(dh->pub_key);<br>
<br>
BN_bn2bin(dh->pub_key, p);<br>
n = (unsigned) BN_num_bytes(dh->priv_key);<br>
<br>
<br>
Instead above logic can we do this ? is derive generated pub/priv keys ?<br>
<br>
<br>
<br>
<br>
The man page in section 7 (EVP_PKEY_DH) has examples for generating using safe primes or using probable primes. Seems better since you don?t have to use the BN API anymore, but a little more complicated because you have to call OSSL_PARAM_construct_xxx for
parameters and assign them to an array.<br>
<br>
From there, you can use EVP_PKEY_derive_init, EVP_PKEY_derive_set_peer, and EVP_PKEY_derive to get your shared secret. See apps/speed.c in the OSSL3 source code for an example. Look for the text EVP_PKEY_DH<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20201208/3c2fdbaf/attachment.html">https://mta.openssl.org/pipermail/openssl-users/attachments/20201208/3c2fdbaf/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 73, Issue 6<br>
********************************************<o:p></o:p></p>
</div>
</body>
</html>