<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head><body lang="EN-IN" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi Daniel ,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:36.0pt"><span style="mso-fareast-language:EN-US">We do have generated the key using
</span>EVP_PKEY_gen as suggested in earlier emails, but since this was a non-ephemeral and we wanted to store the key in "raw" octet bytes, so we did extracted the whole DH priv/pub key pair out from the key generated via EVP_PKEY_gen ( using as suggested…
EVP_PKEY_get_raw_public_key (pkey, pub, &len) )<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now, at a later stage in application we have to compute the Secret key using the stored key’s (in above step).<o:p></o:p></p>
<p class="MsoNormal">As of now, these keys are in uchar format, but are converted to BIGNUM and given to DH_compute_key as below.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> BIGNUM *<span style="background:yellow;mso-highlight:yellow">bn_publicKey</span>;<o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <span style="background:aqua;mso-highlight:aqua">
dh->priv_key</span> = BN_bin2bn(privateKey, octet_len, NULL);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <span style="background:yellow;mso-highlight:yellow">
bn_publicKey</span> = BN_bin2bn(publicKey, octet_len, NULL);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> rv = DH_compute_key(sharedSecret, bn_publicKey, dh);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">So in order to keep the existing frame work in place and just replace the DH_compute_key, we should be using the dh->priv_key/ bn_publicKey to compute shared secret key.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">So we require to convert the BIGNUM key types to EVP_KEY types to use in
</span>EVP_PKEY_derive_init, EVP_PKEY_derive_set_peer, and EVP_PKEY_derive to get shared secret<o:p></o:p></p>
<p class="MsoNormal">Please suggest…<o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Sunil<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Sands, Daniel <dnsands@sandia.gov>
<br>
<b>Sent:</b> 15 December 2020 05:16<br>
<b>To:</b> Narayana, Sunil Kumar <sanarayana@rbbn.com>; openssl-users@openssl.org<br>
<b>Subject:</b> RE: DH_compute_key () - replacement in 3.0<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center"><span lang="EN-US">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="EN-US">NOTICE: This email was received from an EXTERNAL sender<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span lang="EN-US">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal">to exactly replace this we are generating “<b><span style="background:yellow;mso-highlight:yellow">pubparam_key</span>/<span style="background:aqua;mso-highlight:aqua">priparam_key</span></b>” using bn_publicKey/dh->priv_key as below<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">OSSL_PARAM_BLD *pubparamsbld = NULL, priparamsbld = NULL;<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">OSSL_PARAM *pubparams = NULL, priparams = NULL;<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY *pubparam_key = NULL, *priparam_key = NULL;<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY_CTX *pubctx = NULL, *prictx = NULL;<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">pubparamsbld = OSSL_PARAM_BLD_new()<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">priparamsbld = OSSL_PARAM_BLD_new()<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">OSSL_PARAM_BLD_push_BN(pubparamsbld, OSSL_PKEY_PARAM_PUB_KEY, bn_publicKey)<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">OSSL_PARAM_BLD_push_BN(priparamsbld, OSSL_PKEY_PARAM_PRIV_KEY,bn_privateKey)<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">//build context<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">pubctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">prictx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY_key_fromdata_init(pubctx)<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY_key_fromdata_init(prictx)<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">pubparams = OSSL_PARAM_BLD_to_param(pubparamsbld);<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY_fromdata(pubctx, &<span style="background:yellow;mso-highlight:yellow">pubparam_key</span>, pubparams))<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">priparams = OSSL_PARAM_BLD_to_param(priparamsbld);<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">EVP_PKEY_fromdata(prictx, &<span style="background:aqua;mso-highlight:aqua">priparam_key</span>, priparams))<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">From there, we are planning to use EVP_PKEY_derive_init, EVP_PKEY_derive_set_peer, and EVP_PKEY_derive to get shared secret
<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">Didn’t you generate the private keys using the EVP_PKEY_gen as was suggested to your previous email inquiry? If so, you shouldn’t have to rebuild it in such a way, since you already have a usable PKEY that has the generated keypair. If
you created a private keypair called privkey, the public key data can be sent to your peer with i2d_PUBKEY_bio(peer_bio, privkey) and received on the peer’s side with d2i_PUBKEY_bio(peer_bio, &peerkey);<br>
<br>
Now you just need to build a new context around your private EVP_PKEY using derive_ctx = EVP_PKEY_CTX_new(privkey, NULL); and then do the EVP_PKEY_derive series of calls.<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"> <span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal">Your example code does not seem to set the P or G parameters of your keypair, so if you must do it that way, you will need to add them too.<span lang="EN-US"><o:p></o:p></span></p>
</div>
<br><br><span style="font-family:Arial; Font-size:8.0pt"> <hr> Notice: This e-mail together with any attachments may contain information of Ribbon Communications Inc. that is confidential and/or proprietary for the sole use of the intended recipient. Any review, disclosure, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please notify the sender immediately and then delete all copies, including any attachments.<hr> </span></body></html>