gpenkey with algorithm p521_kyber1024 fails

[Roflincopter]

I'm too unsure of what I'm doing to report this as a bug so I'm asking a question. The following command gives the output below. Should I be able to do this?

openssl genpkey -algorithm p521_kyber1024 -out private.key

Error writing key(s)
40178A419E7F0000:error:400C0102:lib(128):key2any_encode:passed a null parameter:/home/dennis/projects/oqs-provider/oqsprov/oqs_encode_key2any.c:1384:

For context I was able to succesfully created a p521_Dilithium5, CA and intermediate CA, Keypair and certificates so in general the oqsprovider seems to work perfectly.

[baentsch]

You are trying to persist ("encode" in openssl provider terminology) a KEM -- that is a conceptually unusual operation. oqsprovider supports this, but only if you set OQS_KEM_ENCODER=ON during build.

[Roflincopter]

Hi,

I did build the oqsprovider with OQS_KEM_ENCODER=ON, what I did was.

• Make a build dir and chdir into it.
• run cmake ..
• ran ccmake .
• set OQS_KEM_ENCODER to ON, configured, generated.
• ran make
• ran make package
• installed package with DPKG.
• updated openssl system config to include the OQS provider by default.

[Roflincopter]

I was suspecting some configuration bug, so I was looking at Configure.md, reading about the fact you can set the OID for some of the algorithms by environment variables. And I saw the OID for p521_kyber1024 was set to NULL. So I tried the following 2 things:

• OQS_OID_P521_KYBER1024="1.3.6.1.4.1.2.267.8.4.5" openssl genpkey -algorithm p521_kyber1024 -out private.key
• OQS_OID_P521_KYBER1024="1.3.6.1.4.1.2.267.8.4.4" openssl genpkey -algorithm p521_kyber1024 -out private.key

The first one succeeds. the second one fails, (it is the same OID as kyber1024) with the following error, but I suspect that is to be expected:

error registering p521_kyber1024 with no hash
Error initializing p521_kyber1024 context
405787E15E7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (p521_kyber1024 : 0), Properties (<null>)

[baentsch]

Thanks for the complete report. This all sounds correct. So is the question resolved then or anything still open?

[Roflincopter]

Well I can continue with my experimentation, but I still wonder why the OID being NULL matters for persisting a Private key? the OID is not part of the Private key structure?

[SWilson4]

Assuming the private key is being exported in PKCS#8 format, it should contain an identifier.

[Roflincopter]

Ah, i checked the output of

openssl pkey -in private.key -noout -text

And it didn't mention it, so my conclusion was that it isn't in there. I don't know too much about the ASN.1 formats used. Thanks for answering my questions, as far as I'm concerned this topic can be closed now.

[SWilson4]

You are most welcome!