<div dir="auto"><div>Thanks Tomas for pointing that out, I have tried calling SHA512 on raw envelope however issue still persists.</div><div dir="auto"><br></div><div dir="auto">I suspect public key import has issues. Could you please check if all necessary evp routines and parameters are present to get the public key from octet data?</div><div dir="auto"><br></div><div dir="auto">Thanks <br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Thu, 30 Mar 2023, 12:20 Tomas Mraz, <<a href="mailto:tomas@openssl.org">tomas@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">In the legacy method you've supplied the eciesKeyDerivationFn function<br>
to the ECDH_compute_key() which is applied after the raw shared secret<br>
from the ECDH is computed. The EVP_PKEY_derive() does not do that. Do<br>
not be confused with the KDF parameters - they apply only to the X9.63<br>
KDF if enabled but that is most probably a completely different KDF<br>
from what you implement in the eciesKeyDerivationFn.<br>
<br>
However that is no problem, you can just apply the eciesKeyDerivationFn<br>
on the output of the ECDH yourself. This is how the KDF is called in<br>
ECDH_compute_key():<br>
<a href="https://github.com/openssl/openssl/blob/master/crypto/ec/ec_kmeth.c#L168" rel="noreferrer noreferrer" target="_blank">https://github.com/openssl/openssl/blob/master/crypto/ec/ec_kmeth.c#L168</a><br>
<br>
Tomas Mraz, OpenSSL<br>
<br>
On Thu, 2023-03-30 at 01:30 +0530, Vishal Patil wrote:<br>
> We are having some troubles converting some code from OpenSSL 1.1.x<br>
> to OpenSSL <br>
> 3.0.7 APIs, to get rid of deprecation warnings, and hope someone may<br>
> be able to <br>
> give us some hints in the right direction.<br>
> <br>
> <br>
> Part1: We are encrypting some text file with openssl3 commands <br>
> and extracting public part(ephdata) of provate key and appending it<br>
> to encryptedfile.<br>
> All openssl operations done using openssl(version 3.0.7) commands in<br>
> bash script.<br>
> <br>
> openssl ecparam -name secp521r1 -genkey -noout -out ephpri.pem<br>
> openssl pkeyutl -derive -inkey ephpri.pem -peerkey ecpubkey.pem -out<br>
> derive.bin<br>
> ENVELOPE=$(openssl dgst -sha512 derive.bin | awk '{print $2}')<br>
> AESKEY=$(echo $ENVELOPE | cut -c1-64)<br>
> AESIV=$(echo $ENVELOPE | cut -c65-96)<br>
> echo "AESKEY = $AESKEY"<br>
> echo "AESIV = $AESIV"<br>
> # encrypt file.txt<br>
> openssl enc -e -aes-256-ctr -in file.txt -out file.enc -K $AESKEY -iv<br>
> $AESIV<br>
> <br>
> #extract and append pub part of private-key<br>
> # export public data of the ephemeral key<br>
> openssl ec -in ephpri.pem -pubout -out ephdata.tmp -outform DER -<br>
> conv_form compressed<br>
> OFFSET=$(openssl asn1parse -inform DER -in ephdata.tmp | grep "BIT<br>
> STRING" | awk -F ':' '{print $1}' | awk '{print $1}')<br>
> OFFSET=$(expr $OFFSET + 3)<br>
> dd if=ephdata.tmp of=ephdata bs=$OFFSET count=1024 skip=1<br>
> append_file file.enc ephdata<br>
> <br>
> Part2: We are processing the encrypted file on other peer using<br>
> application which uses openssl3 APIs.<br>
> 1) extraction of ephdata(pub part of key in part1) from encrypted<br>
> file.<br>
> 2) preparing public key from ephdata <br>
> 3) prearing hash using own private key and derived public key<br>
> 4) deriving of AES keys from hash and decrypting encrypted file using<br>
> the same.<br>
> <br>
> Low level APIs: ( part2 decryption succeeds):<br>
> <br>
> group = EC_GROUP_new_by_curve_name(NID_secp521r1);<br>
> EC_GROUP_precompute_mult(group, nullptr)<br>
> EC_GROUP_set_point_conversion_form(group,<br>
> POINT_CONVERSION_COMPRESSED);<br>
> <br>
> publicKey = EC_KEY_new();<br>
> EC_KEY_set_group(key, group)<br>
> point = EC_POINT_new(group);<br>
> EC_POINT_oct2point(group, point, data, length, nullptr) // data is<br>
> ephdata - derived in part1 <br>
> EC_KEY_set_public_key( publicKey , point)<br>
> EC_POINT_free(point);<br>
> EC_KEY_check_key( publicKey ) // key is public key derived from<br>
> ephdata<br>
> <br>
> ECDH_compute_key(envelope,<br>
> SHA512_DIGEST_LENGTH,<br>
> EC_KEY_get0_public_key(publicKey),<br>
> privateKey,<br>
> eciesKeyDerivationFn)<br>
> ---------------------------------------------------------------------<br>
> -----------------------------------------------------------------<br>
> <br>
> Replaced with high level APIs ( part2 decryption fails) :<br>
> <br>
> // ctx setting with named curve<br>
> nid = NID_secp521r1;<br>
> pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);<br>
> EVP_PKEY_keygen_init(pctx)<br>
> EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid)<br>
> params[0] = OSSL_PARAM_construct_utf8_string("point-format",<br>
> compressionState, 0);<br>
> params[1] = OSSL_PARAM_construct_end();<br>
> EVP_PKEY_CTX_set_params(pctx, params)<br>
> <br>
> // public key derivation from pubdata from peer<br>
> dctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)<br>
> EVP_PKEY_fromdata_init(dctx)<br>
> //param struct for fromdata<br>
> OSSL_PARAM params[4];<br>
> char *secp521r1 = (char *)"secp521r1";<br>
> params[0] = OSSL_PARAM_construct_octet_string("pub", (void *)<br>
> data, length);<br>
> params[1] = OSSL_PARAM_construct_utf8_string("group", secp521r1,<br>
> 0);<br>
> char *compressionState = (char *)"compressed";<br>
> params[2] = OSSL_PARAM_construct_utf8_string("point-format",<br>
> compressionState, 0);<br>
> params[3] = OSSL_PARAM_construct_end();<br>
> EVP_PKEY * public_key = nullptr;<br>
> EVP_PKEY_fromdata(dctx, &public_key , EVP_PKEY_PUBLIC_KEY,<br>
> params) <br>
> <br>
> // hash/envelope derivation <br>
> dctx = EVP_PKEY_CTX_new_from_pkey(NULL, d->privateKey, NULL);<br>
> EVP_PKEY_derive_init(dctx)<br>
> OSSL_PARAM params[4];<br>
> unsigned int padding = 1;<br>
> params[0] = OSSL_PARAM_construct_uint(OSSL_EXCHANGE_PARAM_PAD,<br>
> &padding);<br>
> params[1] =<br>
> OSSL_PARAM_construct_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST,<br>
> (char*)"sha512", 0);<br>
> params[2] =<br>
> OSSL_PARAM_construct_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN,<br>
> &length);<br>
> params[3] = OSSL_PARAM_construct_end();<br>
> EVP_PKEY_CTX_set_params(dctx, params)<br>
> EVP_PKEY_derive_set_peer(dctx, publicKey)<br>
> EVP_PKEY_derive(dctx, envelope, &length)<br>
> <br>
> <br>
> Issue:<br>
> If part2 application uses high level APIs, decryption of the file<br>
> fails.<br>
> However if part2 application uses low level APIs ( deprecated in<br>
> openssl3) decryption succeeds.<br>
> Issue could be either in publickey derivation from ephdata or hash.<br>
> <br>
> <br>
> Thanks,<br>
> <br>
<br>
-- <br>
Tomáš Mráz, OpenSSL<br>
<br>
</blockquote></div></div></div>