<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm trying to encrypt an email using the ECDH One-Pass algorithm. I've first created an X509 certificate with an EDSA key based on the curve prime256v1.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Then, I ran this command:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
openssl cms -encrypt -in Unencrypted.eml -binary -recip ecc.cer -aes256 -keyopt ecdh_kdf_md:sha256 -keyopt ecdh_cofactor_mode:1<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This does indeed create an encrypted eml:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
MIME-Version: 1.0
<div>Content-Disposition: attachment; filename="smime.p7m"</div>
<div>Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"</div>
<div>Content-Transfer-Encoding: base64</div>
<div><br>
</div>
<div>MIIBuQYJKoZIhvcNAQcDoIIBqjCCAaYCAQIxggEQoYIBDAIBA6BRoU8wCQYHKoZI</div>
<div>zj0CAQNCAAQYMD63JbNHczeD0BVjdlzuZAdTyFchu/KsXAZA6/OmbJ37xEoga1GG</div>
<div>ItMUW5qnzzNL9L25wi1GVZrMxH5bksxEMBUGBiuBBAEOATALBglghkgBZQMEAS0w</div>
<div>gZwwgZkwbTBnMQswCQYDVQQGEwJERTEMMAoGA1UECAwDTlJXMRIwEAYDVQQHDAlQ</div>
<div>YWRlcmJvcm4xGTAXBgNVBAoMEE5ldCBhdCBXb3JrIEdtYkgxGzAZBgNVBAMMEk5v</div>
<div>U3BhbVByb3h5IERldiBDQQICEBwEKB6t+YrcLQLXlVc8oC47Ija4mgzJ0uv7DvFl</div>
<div>JQXtUGZpf4pYQ9fvEO0wgYwGCSqGSIb3DQEHATAdBglghkgBZQMEASoEENsnhiim</div>
<div>ZK1xDpAN3tpDiwmAYLp71os2uX6TIEJeDbtAuEf570gNii9AdHgdbS3+4hpFUyKI</div>
<div>fifnofwQRq5+vsIc8DllYGMdMoWknO0vzNSNaLFpWMJ2Xe0SFyU0dO30wHlHXvz3</div>
a3CzwXa5yoQ1qHfo3Q==<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
And it does have the expected KEK encryption algorithm set:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
1.3.132.1.14.1 => dhSinglePass-cofactorDH-sha256kdf-scheme<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, the KDF method used is exactly the same as when I execute:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">openssl cms -encrypt -in Unencrypted.eml -binary -recip ecc.cer -aes256 -keyopt ecdh_kdf_md:sha256 -keyopt ecdh_cofactor_mode:0</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This call does produce a different KEK algorithm:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
1.3.132.1.11.1 ecdhX963KDF-SHA256.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">At least I can decrypt the content encryption key in both cases using the same algorithm ('Standard' ECDH).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">I'm using OpenSSL 3.0.0-beta1-dev (Library: OpenSSL 3.0.0-beta1-dev ).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">Any ideas? Do I need any additional parameters to get this working?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">Kind regards,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">Henning</span></div>
</body>
</html>