Re: Openssl 3.0.0. EVP_PKEY_CTX vs EVP_PKEY

2021-09-14 Thread Tomas Mraz
On Tue, 2021-09-14 at 14:42 -0400, Ken Goldman wrote: > On 9/14/2021 11:40 AM, Tomas Mraz wrote: > > On Tue, 2021-09-14 at 11:11 -0400, Ken Goldman wrote: > > > Conceptually, how are these different? > > > > > > When do I use one vs the other? > > > > The EVP_PKEY is an object holding data (well,

Re: OpenSSl 3 statically linking a provider

2021-09-14 Thread Tomas Mraz
On Tue, 2021-09-14 at 21:46 -0700, Kory Hamzeh wrote: > I have written a custom provider which I need to include (link) with > my Application at link time rather than load it at run-time. The init > function is defined like this: > > OSSL_provider_init_fn sck_provider_init; > > int sck_provider_i

OpenSSl 3 statically linking a provider

2021-09-14 Thread Kory Hamzeh
I have written a custom provider which I need to include (link) with my Application at link time rather than load it at run-time. The init function is defined like this: OSSL_provider_init_fn sck_provider_init; int sck_provider_init(const OSSL_CORE_HANDLE *handle, const O

Re: Openssl 3.0.0. EVP_PKEY RSA is NULL

2021-09-14 Thread Dr Paul Dale
On 15/9/21 9:19 am, Ken Goldman wrote: irc = EVP_PKEY_fromdata_init(ctx); irc = EVP_PKEY_fromdata(ctx, (EVP_PKEY **)rsa_pub_key, /* freed by caller */     EVP_PKEY_PUBLIC_KEY, params); Do you mean :     irc = EVP_PKEY_fromdata(ctx, &rsa_pub_key, EVP_PKEY_PUBLIC_KEY, pa

Re: Openssl 3.0.0. EVP_PKEY RSA is NULL

2021-09-14 Thread Matt Caswell
On 15/09/2021 00:19, Ken Goldman wrote: I am doing the following, but the EVP_PKEY->pkey->rsa is null. Am I misusing the API or missing a step? Neither. This is normal. EVP_PKEY->pkey->rsa is only used if you have a legacy key. Matt (error checking removed)     EVP_PKEY    *rsa_p

Openssl 3.0.0. EVP_PKEY RSA is NULL

2021-09-14 Thread Ken Goldman
I am doing the following, but the EVP_PKEY->pkey->rsa is null. Am I misusing the API or missing a step? (error checking removed) EVP_PKEY*rsa_pub_key = NULL; EVP_PKEY_CTX*ctx = NULL; OSSL_PARAM_BLD *param_bld = NULL; OSSL_PARAM *params = NULL;

Re: Openssl 3.0.0. EVP_PKEY_CTX vs EVP_PKEY

2021-09-14 Thread Ken Goldman
On 9/14/2021 11:40 AM, Tomas Mraz wrote: On Tue, 2021-09-14 at 11:11 -0400, Ken Goldman wrote: Conceptually, how are these different? When do I use one vs the other? The EVP_PKEY is an object holding data (well, rather a reference, but that is fairly irrelevant) of a private key, public key,

Re: Openssl 3.0.0. EVP_PKEY_CTX vs EVP_PKEY

2021-09-14 Thread Tomas Mraz
On Tue, 2021-09-14 at 11:11 -0400, Ken Goldman wrote: > Conceptually, how are these different? > > When do I use one vs the other? The EVP_PKEY is an object holding data (well, rather a reference, but that is fairly irrelevant) of a private key, public key, or domain parameters for asymetric cryp

Openssl 3.0.0. EVP_PKEY_CTX vs EVP_PKEY

2021-09-14 Thread Ken Goldman
Conceptually, how are these different? When do I use one vs the other? Where would I learn this?

Re: Reducing the footprint of a simple application

2021-09-14 Thread Dr Paul Dale
> ...low security RNGs and other antifeatures. Huh  Where?  Why plural? The only **one** I'm aware of is the one I added to stochastically flush the property cache where it doesn't need to be cryptographically secure. Pauli

Re: Reducing the footprint of a simple application

2021-09-14 Thread Jakob Bohm via openssl-users
Hi fellow sufferer, I used to do a lot of manual patching of OpenSSL 1.0.x to remove the insane object interdependencies (such as objects named foolib.c being nexus points that bring in tonnes of irrelevant code because someone was too unfamiliar with basic library concepts to make an actual l

Blog post about Let's Encrypt root certificate expiration and OpenSSL 1.0.2

2021-09-14 Thread Tomas Mraz
I've written a blog post to explain the situation with the old Let's Encrypt root certificate expiration which will happen on 2021-09-30 and the behavior of OpenSSL 1.0.2 with that root certificate. Please read, if interested: https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/

Re: openssl 3.0.0 legacy provider won't lload via config file

2021-09-14 Thread Tomas Mraz
On Mon, 2021-09-13 at 16:13 -0700, Kory Hamzeh wrote: > I have cross-compiled OpenSSL 3.0.0 for the ARMv7. So far, everything > seems to be working fine, except for the fact that I cannot get > OpenSSL to load the legacy module when I configure /ssl/openssl.cnf > as such. I can, however, load the m