<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head><body lang="EN-IN" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Matt,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> Thanks for the code sample. we understood the end to end flow to generate the DH key.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I wanted to understand one more aspect here, In our application we were obtaining two keys (pub_key/</span>
<span style="mso-fareast-language:EN-US">priv_key) from the DH_generate_key() with single values of dh->p/</span>
<span style="mso-fareast-language:EN-US">dh->g. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">But now in 3.0 equivalent, I guess we can get only one key from the p/g params right ? how to get equivalent pub_key / priv_key ? please suggest.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Sunil<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> openssl-users <openssl-users-bounces@openssl.org>
<b>On Behalf Of </b>openssl-users-request@openssl.org<br>
<b>Sent:</b> 10 December 2020 17:46<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> openssl-users Digest, Vol 73, Issue 9<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">NOTICE: This email was received from an EXTERNAL sender<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><br>
Send openssl-users mailing list submissions to<br>
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openssl-users-request@openssl.org">openssl-users-request@openssl.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openssl-users-owner@openssl.org">openssl-users-owner@openssl.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: DH_generate_key (Matt Caswell)<br>
2. Re: creating certificate by code / problems to load via<br>
openssl x509 / pem format (Andreas Tengicki)<br>
3. Re: creating certificate by code / problems to load via<br>
openssl x509 / pem format (Tomas Mraz)<br>
4. Re: DH_generate_key (Matt Caswell)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 9 Dec 2020 15:31:51 +0000<br>
From: Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>><br>
To: "Narayana, Sunil Kumar" <<a href="mailto:sanarayana@rbbn.com">sanarayana@rbbn.com</a>>,<br>
"<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
Subject: Re: DH_generate_key<br>
Message-ID: <<a href="mailto:72867e9d-4e91-faa0-d329-1f92ed723b0e@openssl.org">72867e9d-4e91-faa0-d329-1f92ed723b0e@openssl.org</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
<br>
<br>
On 08/12/2020 17:43, Narayana, Sunil Kumar wrote:<br>
> Dear openssl team,<br>
> <br>
> ?<br>
> <br>
> ??????????????? While migrating from 1.0.2 to 3.0, ?we found that<br>
> DH_generate_key() has be deprecated. And as per the man page, it is<br>
> advised to use EVP_PKEY_derive_init<br>
> <<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive_init.html</a>><br>
> ?& EVP_PKEY_derive<br>
> <<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_derive.html</a>><br>
> <br>
<br>
The reference to EVP_PKEY_derive_init/EVP_PKEY_derive is a bit<br>
misleading, because those are replacements for DH_compute_key() not<br>
DH_generate_key().<br>
<br>
The equivalents for DH_generate_key() are EVP_PKEY_keygen_init() and<br>
EVP_PKEY_gen().<br>
<br>
<a href="https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_gen.html">https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_gen.html</a><br>
<br>
<br>
<br>
> our application creates a new DH and using DH_generate_key()<br>
<br>
How do you set up the DH parameters? Do you load them from a file or<br>
generate them in your application? Or some other way? Will it break your<br>
application if you swap to using different parameters, or must you<br>
retain support for the old ones?<br>
<br>
The first step is to create an EVP_PKEY object containing the DH<br>
parameters. How to do that depends on the answers to the above questions.<br>
<br>
<br>
> creates<br>
> pub_key/priv_key and uses it. how can we replace this exactly with EVP.<br>
> <br>
<br>
<br>
As noted by Daniel in this response to your question there are examples<br>
on the EVP_PKEY-DH manual page.<br>
<br>
<a href="https://www.openssl.org/docs/manmaster/man7/EVP_PKEY-DH.html">https://www.openssl.org/docs/manmaster/man7/EVP_PKEY-DH.html</a><br>
<br>
Assuming you have set up the parameters in an EVP_PKEY object<br>
(param_key) then this is the relevant example:<br>
<br>
<br>
EVP_PKEY *key = NULL;<br>
EVP_PKEY_CTX *gctx = EVP_PKEY_CTX_new_from_pkey(NULL, param_key, NULL);<br>
<br>
EVP_PKEY_keygen_init(gctx);<br>
EVP_PKEY_gen(gctx, &key);<br>
EVP_PKEY_print_private(bio_out, key, 0, NULL);<br>
...<br>
EVP_PKEY_free(key);<br>
EVP_PKEY_CTX_free(gctx);<br>
<br>
<br>
This gives you a generated DH key in the "key" object.<br>
<br>
<br>
Matt<br>
<br>
<br>
> And please suggest what EVP API?s should we use to generate pub/priv keys ?<br>
> <br>
> ?<br>
> <br>
> _Application code_<br>
> <br>
> _?_<br>
> <br>
> ??? dh = DH_new();<br>
> <br>
> ??? dh->p = BN_bin2bn(modSize, octet_len, NULL);<br>
> <br>
> ??? dh->g = BN_bin2bn(H235Bits_generator, H235Bits_generator_len / 8, NULL);<br>
> <br>
> ?<br>
> <br>
> ??? if ( ! DH_generate_key(dh) )<br>
> <br>
> ??? {<br>
> <br>
> ??????? return FAILURE;<br>
> <br>
> ??? }<br>
> <br>
> ??? n = (unsigned) BN_num_bytes(dh->pub_key);<br>
> <br>
> ??<br>
> <br>
> ????BN_bn2bin(dh->pub_key, p);<br>
> <br>
> ??? n = (unsigned) BN_num_bytes(dh->priv_key);<br>
> <br>
> ?<br>
> <br>
> ?<br>
> <br>
> Instead above logic can we do this ? is derive generated pub/priv keys ?<br>
> <br>
> ?<br>
> <br>
> //create ctx<br>
> <br>
> Ctx = EVP_PKEY_CTX_new_from_name (NULL, ?DM?, NULL);<br>
> <br>
> EVP_PKEY_derive_init (ctx)<br>
> <br>
> ?<br>
> <br>
> ?<br>
> <br>
> Regards,<br>
> <br>
> Sunil<br>
> <br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> Notice: This e-mail together with any attachments may contain<br>
> information of Ribbon Communications Inc. that is confidential and/or<br>
> proprietary for the sole use of the intended recipient. Any review,<br>
> disclosure, reliance or distribution by others or forwarding without<br>
> express permission is strictly prohibited. If you are not the intended<br>
> recipient, please notify the sender immediately and then delete all<br>
> copies, including any attachments.<br>
> ------------------------------------------------------------------------<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 10 Dec 2020 10:39:06 +0100<br>
From: Andreas Tengicki <<a href="mailto:tengicki@autopoll.de">tengicki@autopoll.de</a>><br>
To: <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
Subject: Re: creating certificate by code / problems to load via<br>
openssl x509 / pem format<br>
Message-ID: <<a href="mailto:009adab4-57a9-4132-f6f5-43d60946faf4@autopoll.de">009adab4-57a9-4132-f6f5-43d60946faf4@autopoll.de</a>><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
The solution was to choice a EVP by signing the certificate<br>
<br>
i = X509_sign(x, CApkey, EVP_sha256());<br>
<br>
Best regards<br>
<br>
? Andreas<br>
<br>
Am 09.07.2020 um 11:09 schrieb Andreas Tengicki:<br>
><br>
> Hello,<br>
><br>
> your first help in this project, helps much, but now some weeks later, <br>
> there is a new problem, and I cannot find any tipps via google.<br>
><br>
> For all the coding a have looked into the openssl examples.<br>
><br>
> I create a private key per code, the "openssl rsa -in <br>
> test_privatekey.pem -check" is fine<br>
><br>
> I create a certificate request per code, "openssl req -text -noout <br>
> -verify -in test_request.pem" is fine<br>
><br>
> I create a certifcate via this reqeust and store it with <br>
> "PEM_write_bio_X509(out, crt);" like the others. (some more code below)<br>
><br>
> Perhaps there is something wrong, but to detect this, I will use the <br>
> validation, but it cannot load the certificate to validate it:<br>
><br>
> >> openssl x509 -in test_certificate.pem -text<br>
> unable to load certificate<br>
> 140180222239872:error:0D07209B:asn1 encoding <br>
> routines:ASN1_get_object:too long:../crypto/asn1/asn1_lib.c:91:<br>
> 140180222239872:error:0D068066:asn1 encoding <br>
> routines:asn1_check_tlen:bad object header:../crypto/asn1/tasn_dec.c:1118:<br>
> 140180222239872:error:0D07803A:asn1 encoding <br>
> routines:asn1_item_embed_d2i:nested asn1 <br>
> error:../crypto/asn1/tasn_dec.c:190:Type=ASN1_TIME<br>
> 140180222239872:error:0D08303A:asn1 encoding <br>
> routines:asn1_template_noexp_d2i:nested asn1 <br>
> error:../crypto/asn1/tasn_dec.c:627:Field=notBefore, Type=X509_VAL<br>
> 140180222239872:error:0D08303A:asn1 encoding <br>
> routines:asn1_template_noexp_d2i:nested asn1 <br>
> error:../crypto/asn1/tasn_dec.c:627:Field=validity, Type=X509_CINF<br>
> 140180222239872:error:0D08303A:asn1 encoding <br>
> routines:asn1_template_noexp_d2i:nested asn1 <br>
> error:../crypto/asn1/tasn_dec.c:627:Field=cert_info, Type=X509<br>
> 140180222239872:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 <br>
> lib:../crypto/pem/pem_oth.c:33:<br>
><br>
> Thanks for any help.<br>
><br>
> Best regards<br>
><br>
> ? Andreas<br>
><br>
> ----<br>
><br>
> ErrorHandling should be added in a second step, first debug outputs (I <br>
> have deleted for here) says everything is created<br>
><br>
> X509* certificate_create(const X509_REQ* req)<br>
> {<br>
> ? //openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.crt <br>
> -CAkey ca.key -CAcreateserial -out server.crt<br>
><br>
> ? if ((crt = X509_new()) == NULL);<br>
> ? //xca = load_cert(CAfile, CAformat, "CA Certificate");<br>
> ? BIO *bio = NULL;<br>
> ? bio = BIO_new_file(CAfile, "r");<br>
> ? xca = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);<br>
> ? BIO_free(bio);<br>
><br>
> ? upkey = X509_get0_pubkey(xca);<br>
><br>
> ? char CAkeyile[] = "ca.key";<br>
> ? int CAkeyformat = 5; //FORMAT_PEM<br>
> ? char passin[] = "xyz";<br>
><br>
> ? ENGINE *e = NULL;<br>
> ? EVP_PKEY * CApkey = NULL;<br>
> ? //CApkey = load_key(CAkeyfile, CAkeyformat, 0, passin, e, "CA <br>
> Private Key");<br>
> ? bio = BIO_new_file(CAkeyile, "r");<br>
> ? CApkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, passin);<br>
> ? BIO_free(bio);<br>
><br>
> ? EVP_PKEY_copy_parameters(upkey, CApkey);<br>
><br>
> ? X509_STORE *ctx = NULL;<br>
> ? ctx = X509_STORE_new();<br>
><br>
> ? X509_STORE_CTX *xsc = NULL;<br>
> ? xsc = X509_STORE_CTX_new();<br>
> ? if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, crt, NULL));<br>
><br>
> ? ASN1_INTEGER *serialno = NULL;<br>
> ? serialno = ASN1_INTEGER_new();<br>
> ? BIGNUM *btmp = NULL;<br>
> ? btmp = BN_new();<br>
><br>
> ? # define SERIAL_RAND_BITS??????? 159<br>
> ? if (!BN_rand(btmp, SERIAL_RAND_BITS, BN_RAND_TOP_ANY, <br>
> BN_RAND_BOTTOM_ANY));<br>
> ? if (!BN_to_ASN1_INTEGER(btmp, serialno));<br>
> ? BN_free(btmp);<br>
><br>
> X509_STORE_CTX_set_cert(xsc, crt);<br>
> ? X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);<br>
><br>
> ? if (!X509_check_private_key(xca, CApkey)) ;<br>
><br>
> ? if (!X509_set_issuer_name(crt, X509_get_subject_name(xca)));<br>
> ? if (!X509_set_serialNumber(crt, serialno));<br>
><br>
> ? int days = 365;<br>
> ? if (X509_time_adj_ex(X509_getm_notAfter(crt), days, 0, NULL) == NULL);<br>
><br>
> ? const char digestname[] = "sha256";<br>
> ? const EVP_MD* md = EVP_get_digestbyname(digestname);<br>
> ? EVP_MD_CTX *mctx = EVP_MD_CTX_new();<br>
> ? EVP_PKEY_CTX *pkctx = NULL;<br>
> ? EVP_DigestSignInit(mctx, &pkctx, md, NULL, CApkey); //ist CApkey <br>
> hier der richtige private Key? sollte eigentlich<br>
> ? int rv = (X509_sign_ctx(crt, mctx) > 0);<br>
> ? EVP_MD_CTX_free(mctx);<br>
><br>
> ? BIO *out = NULL;<br>
> ? out = BIO_new_file("test_certificate.pem", "w");<br>
> ? PEM_write_bio_X509(out, crt);<br>
> ? BIO_free_all(out);<br>
><br>
> ? ...some more frees ...<br>
> ? return crt;<br>
> }<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20201210/897e5d1b/attachment-0001.html">https://mta.openssl.org/pipermail/openssl-users/attachments/20201210/897e5d1b/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 10 Dec 2020 11:42:37 +0100<br>
From: Tomas Mraz <<a href="mailto:tmraz@redhat.com">tmraz@redhat.com</a>><br>
To: Andreas Tengicki <<a href="mailto:tengicki@autopoll.de">tengicki@autopoll.de</a>>,
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
Subject: Re: creating certificate by code / problems to load via<br>
openssl x509 / pem format<br>
Message-ID:<br>
<<a href="mailto:a5196a1bd4dcd8175448e8689d6396231d23097a.camel@redhat.com">a5196a1bd4dcd8175448e8689d6396231d23097a.camel@redhat.com</a>><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
On Thu, 2020-12-10 at 10:39 +0100, Andreas Tengicki wrote:<br>
> The solution was to choice a EVP by signing the certificate<br>
> <br>
> i = X509_sign(x, CApkey, EVP_sha256());<br>
<br>
I do not really think this was the problem. In the code below you do<br>
not set the notBefore time which is actually indicated by the parsing<br>
errors when you try to load the invalid certificate.<br>
<br>
> Best regards<br>
> <br>
> Andreas<br>
> <br>
> Am 09.07.2020 um 11:09 schrieb Andreas Tengicki:<br>
> > Hello,<br>
> > <br>
> > your first help in this project, helps much, but now some weeks<br>
> > later, there is a new problem, and I cannot find any tipps via<br>
> > google.<br>
> > <br>
> > For all the coding a have looked into the openssl examples.<br>
> > <br>
> > I create a private key per code, the "openssl rsa -in<br>
> > test_privatekey.pem -check" is fine<br>
> > <br>
> > I create a certificate request per code, "openssl req -text -noout<br>
> > -verify -in test_request.pem" is fine<br>
> > <br>
> > I create a certifcate via this reqeust and store it with<br>
> > "PEM_write_bio_X509(out, crt);" like the others. (some more code<br>
> > below)<br>
> > <br>
> > Perhaps there is something wrong, but to detect this, I will use<br>
> > the validation, but it cannot load the certificate to validate it:<br>
> > <br>
> > >> openssl x509 -in test_certificate.pem -text <br>
> > unable to load certificate<br>
> > 140180222239872:error:0D07209B:asn1 encoding<br>
> > routines:ASN1_get_object:too long:../crypto/asn1/asn1_lib.c:91:<br>
> > 140180222239872:error:0D068066:asn1 encoding<br>
> > routines:asn1_check_tlen:bad object<br>
> > header:../crypto/asn1/tasn_dec.c:1118:<br>
> > 140180222239872:error:0D07803A:asn1 encoding<br>
> > routines:asn1_item_embed_d2i:nested asn1<br>
> > error:../crypto/asn1/tasn_dec.c:190:Type=ASN1_TIME<br>
> > 140180222239872:error:0D08303A:asn1 encoding<br>
> > routines:asn1_template_noexp_d2i:nested asn1<br>
> > error:../crypto/asn1/tasn_dec.c:627:Field=notBefore, Type=X509_VAL<br>
> > 140180222239872:error:0D08303A:asn1 encoding<br>
> > routines:asn1_template_noexp_d2i:nested asn1<br>
> > error:../crypto/asn1/tasn_dec.c:627:Field=validity, Type=X509_CINF<br>
> > 140180222239872:error:0D08303A:asn1 encoding<br>
> > routines:asn1_template_noexp_d2i:nested asn1<br>
> > error:../crypto/asn1/tasn_dec.c:627:Field=cert_info, Type=X509<br>
> > 140180222239872:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1<br>
> > lib:../crypto/pem/pem_oth.c:33:<br>
> > <br>
> > <br>
> > Thanks for any help.<br>
> > <br>
> > Best regards<br>
> > <br>
> > Andreas<br>
> > <br>
> > ----<br>
> > <br>
> > ErrorHandling should be added in a second step, first debug outputs<br>
> > (I have deleted for here) says everything is created<br>
> > <br>
> > X509* certificate_create(const X509_REQ* req)<br>
> > {<br>
> > //openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.crt<br>
> > -CAkey ca.key -CAcreateserial -out server.crt<br>
> > <br>
> > if ((crt = X509_new()) == NULL);<br>
> > //xca = load_cert(CAfile, CAformat, "CA Certificate");<br>
> > BIO *bio = NULL;<br>
> > bio = BIO_new_file(CAfile, "r");<br>
> > xca = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);<br>
> > BIO_free(bio);<br>
> > <br>
> > upkey = X509_get0_pubkey(xca);<br>
> > <br>
> > char CAkeyile[] = "ca.key";<br>
> > int CAkeyformat = 5; //FORMAT_PEM<br>
> > char passin[] = "xyz";<br>
> > <br>
> > ENGINE *e = NULL;<br>
> > EVP_PKEY * CApkey = NULL;<br>
> > //CApkey = load_key(CAkeyfile, CAkeyformat, 0, passin, e, "CA<br>
> > Private Key");<br>
> > bio = BIO_new_file(CAkeyile, "r");<br>
> > CApkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, passin);<br>
> > BIO_free(bio);<br>
> > <br>
> > EVP_PKEY_copy_parameters(upkey, CApkey);<br>
> > <br>
> > X509_STORE *ctx = NULL;<br>
> > ctx = X509_STORE_new();<br>
> > <br>
> > X509_STORE_CTX *xsc = NULL;<br>
> > xsc = X509_STORE_CTX_new();<br>
> > if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, crt, NULL));<br>
> > <br>
> > ASN1_INTEGER *serialno = NULL;<br>
> > serialno = ASN1_INTEGER_new();<br>
> > BIGNUM *btmp = NULL;<br>
> > btmp = BN_new();<br>
> > <br>
> > # define SERIAL_RAND_BITS 159<br>
> > if (!BN_rand(btmp, SERIAL_RAND_BITS, BN_RAND_TOP_ANY,<br>
> > BN_RAND_BOTTOM_ANY));<br>
> > if (!BN_to_ASN1_INTEGER(btmp, serialno));<br>
> > BN_free(btmp);<br>
> > <br>
> > X509_STORE_CTX_set_cert(xsc, crt);<br>
> > X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);<br>
> > <br>
> > if (!X509_check_private_key(xca, CApkey)) ;<br>
> > <br>
> > if (!X509_set_issuer_name(crt, X509_get_subject_name(xca)));<br>
> > if (!X509_set_serialNumber(crt, serialno));<br>
> > <br>
> > int days = 365;<br>
> > if (X509_time_adj_ex(X509_getm_notAfter(crt), days, 0, NULL) ==<br>
> > NULL);<br>
> > <br>
> > const char digestname[] = "sha256";<br>
> > const EVP_MD* md = EVP_get_digestbyname(digestname);<br>
> > EVP_MD_CTX *mctx = EVP_MD_CTX_new();<br>
> > EVP_PKEY_CTX *pkctx = NULL;<br>
> > EVP_DigestSignInit(mctx, &pkctx, md, NULL, CApkey); //ist CApkey<br>
> > hier der richtige private Key? sollte eigentlich<br>
> > int rv = (X509_sign_ctx(crt, mctx) > 0);<br>
> > EVP_MD_CTX_free(mctx);<br>
> > <br>
> > BIO *out = NULL;<br>
> > out = BIO_new_file("test_certificate.pem", "w");<br>
> > PEM_write_bio_X509(out, crt);<br>
> > BIO_free_all(out);<br>
> > <br>
> > ...some more frees ...<br>
> > return crt;<br>
> > }<br>
> > <br>
-- <br>
Tom?? Mr?z<br>
No matter how far down the wrong road you've gone, turn back.<br>
Turkish proverb<br>
[You'll know whether the road is wrong if you carefully listen to your<br>
conscience.]<br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Thu, 10 Dec 2020 12:16:11 +0000<br>
From: Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>><br>
To: "Narayana, Sunil Kumar" <<a href="mailto:sanarayana@rbbn.com">sanarayana@rbbn.com</a>>,<br>
"<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
Subject: Re: DH_generate_key<br>
Message-ID: <<a href="mailto:0d2eb472-d8d8-0272-e992-8e5c37082f0e@openssl.org">0d2eb472-d8d8-0272-e992-8e5c37082f0e@openssl.org</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
<br>
<br>
On 09/12/2020 15:31, Matt Caswell wrote:<br>
>> our application creates a new DH and using DH_generate_key()<br>
> <br>
> How do you set up the DH parameters? Do you load them from a file or<br>
> generate them in your application? Or some other way? Will it break your<br>
> application if you swap to using different parameters, or must you<br>
> retain support for the old ones?<br>
> <br>
> The first step is to create an EVP_PKEY object containing the DH<br>
> parameters. How to do that depends on the answers to the above questions.<br>
<br>
Sunil emailed me directly (off list) and provided some code samples.<br>
<br>
So you have some fixed "p" and "g" parameter values defined as static<br>
unsigned char arrays, which you are currently converting to BIGNUMs<br>
using "BN_bin2bn", and then assigning to "dh->p" and "dh->g" respectively.<br>
<br>
The "g" value is just "2", so in the 3.0 equivalent you don't need to<br>
convert that to a BIGNUM first. Some equivalent code to construct a DH<br>
params object (called "param_key" in the code below) is:<br>
<br>
<br>
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);<br>
OSSL_PARAM_BLD *tmpl = NULL;<br>
OSSL_PARAM *params = NULL;<br>
EVP_PKEY *param_key = NULL;<br>
<br>
if (pctx == NULL || !EVP_PKEY_key_fromdata_init(pctx))<br>
goto err;<br>
<br>
if ((tmpl = OSSL_PARAM_BLD_new()) == NULL<br>
|| !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)<br>
|| !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2))<br>
goto err;<br>
<br>
params = OSSL_PARAM_BLD_to_param(tmpl);<br>
if (params == NULL || !EVP_PKEY_fromdata(pctx, ¶m_key, params))<br>
goto err;<br>
err:<br>
EVP_PKEY_CTX_free(pctx);<br>
OSSL_PARAM_BLD_free_params(params);<br>
OSSL_PARAM_BLD_free(tmpl);<br>
<br>
<br>
You can then generate the key using the code sample I gave in my<br>
previous email:<br>
<br>
EVP_PKEY *key = NULL;<br>
EVP_PKEY_CTX *gctx = EVP_PKEY_CTX_new_from_pkey(NULL, param_key, NULL);<br>
<br>
EVP_PKEY_keygen_init(gctx);<br>
EVP_PKEY_gen(gctx, &key);<br>
EVP_PKEY_print_private(bio_out, key, 0, NULL);<br>
...<br>
EVP_PKEY_free(key);<br>
EVP_PKEY_CTX_free(gctx);<br>
<br>
<br>
<br>
Hope that helps,<br>
<br>
Matt<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 73, Issue 9<br>
********************************************<o:p></o:p></p>
</div>
<br><br><span style="font-family:Arial; Font-size:8.0pt"> <hr> Notice: This e-mail together with any attachments may contain information of Ribbon Communications Inc. that is confidential and/or proprietary for the sole use of the intended recipient. Any review, disclosure, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please notify the sender immediately and then delete all copies, including any attachments.<hr> </span></body></html>