I can't use OQS Provider for Post Quantum Handshakes and Certificate Generation #635

rishabhamar · 2025-02-04T07:50:00Z

rishabhamar
Feb 4, 2025

I have followed all the instructions carefully but still i am unable to generate a certificate and use handshake protocol using post quantum algorithms

Here are my steps

Provider is imported correctly

  vboxuser@oqs:~$ openssl list -providers
  Providers:
    default
      name: OpenSSL Default Provider
      version: 3.4.0
      status: active
    legacy
      name: OpenSSL Legacy Provider
      version: 3.4.0
      status: active
    oqsprovider
      name: OpenSSL OQS Provider
      version: 0.8.1-dev
      status: active

Openssl Path

vboxuser@oqs:~$ openssl version -a
OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)
built on: Mon Feb  3 14:08:16 2025 UTC
platform: linux-x86_64
options:  bn(64,64)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/opt/openssl"
ENGINESDIR: "/opt/openssl/lib64/engines-3"
MODULESDIR: "/opt/openssl/lib64/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0xc2da2203478bffff:0x842509

Openssl config file

#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

# Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Groups = kyber768:kyber1024

# List of providers to load
[provider_sect]
default = default_sect
legacy = legacy_sect
oqsprovider = oqsprovider_sect

# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
activate = 1

[legacy_sect]
activate = 1

[oqsprovider_sect]
activate = 1


####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem # The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha256	# algorithm to compute certificate
				# identifier (optional, default: sha256)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = $insta::out_trusted # apps/insta.ca.crt

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

Openssl Signature algorithms using OQS Provider

vboxuser@oqs:~$ openssl list -signature-algorithms -provider oqsprovider
  { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  { 1.2.840.10040.4.1, 1.3.14.3.2.12, DSA, DSA-old, dsaEncryption, dsaEncryption-old } @ default
  { 1.2.840.10040.4.3, 1.3.14.3.2.27, DSA-SHA, DSA-SHA-1, DSA-SHA1, DSA-SHA1-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default
  { 1.3.101.112, ED25519 } @ default
  { 1.3.101.113, ED448 } @ default
  { 1.2.156.10197.1.301, SM2 } @ default
  { 2.16.840.1.101.3.4.3.1, DSA-SHA2-224, DSA-SHA224, dsa_with_SHA224 } @ default
  { 2.16.840.1.101.3.4.3.2, DSA-SHA2-256, DSA-SHA256, dsa_with_SHA256 } @ default
  { 1.2.840.1.101.3.4.3.3, DSA-SHA2-384, DSA-SHA384, dsa_with_SHA384, id-dsa-with-sha384 } @ default
  { 1.2.840.1.101.3.4.3.4, DSA-SHA2-512, DSA-SHA512, dsa_with_SHA512, id-dsa-with-sha512 } @ default
  { 2.16.840.1.101.3.4.3.5, DSA-SHA3-224, dsa_with_SHA3-224, id-dsa-with-sha3-224 } @ default
  { 2.16.840.1.101.3.4.3.6, DSA-SHA3-256, dsa_with_SHA3-256, id-dsa-with-sha3-256 } @ default
  { 2.16.840.1.101.3.4.3.7, DSA-SHA3-384, dsa_with_SHA3-384, id-dsa-with-sha3-384 } @ default
  { 2.16.840.1.101.3.4.3.8, DSA-SHA3-512, dsa_with_SHA3-512, id-dsa-with-sha3-512 } @ default
  { 1.3.36.3.3.1.2, ripemd160WithRSA, RSA-RIPEMD160 } @ default
  { 1.2.840.113549.1.1.5, RSA-SHA-1, RSA-SHA1, sha1WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.14, RSA-SHA2-224, RSA-SHA224, sha224WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.11, RSA-SHA2-256, RSA-SHA256, sha256WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.12, RSA-SHA2-384, RSA-SHA384, sha384WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.13, RSA-SHA2-512, RSA-SHA512, sha512WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.15, RSA-SHA2-512/224, RSA-SHA512-224, sha512-224WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.16, RSA-SHA2-512/256, RSA-SHA512-256, sha512-256WithRSAEncryption } @ default
  { 2.16.840.1.101.3.4.3.13, id-rsassa-pkcs1-v1_5-with-sha3-224, RSA-SHA3-224 } @ default
  { 2.16.840.1.101.3.4.3.14, id-rsassa-pkcs1-v1_5-with-sha3-256, RSA-SHA3-256 } @ default
  { 2.16.840.1.101.3.4.3.15, id-rsassa-pkcs1-v1_5-with-sha3-384, RSA-SHA3-384 } @ default
  { 2.16.840.1.101.3.4.3.16, id-rsassa-pkcs1-v1_5-with-sha3-512, RSA-SHA3-512 } @ default
  { 1.2.156.10197.1.504, RSA-SM3, sm3WithRSAEncryption } @ default
  ED25519ph @ default
  ED25519ctx @ default
  ED448ph @ default
  ECDSA @ default
  { 1.2.840.10045.4.1, ECDSA-SHA-1, ECDSA-SHA1, ecdsa-with-SHA1 } @ default
  { 1.2.840.10045.4.3.1, ECDSA-SHA2-224, ECDSA-SHA224, ecdsa-with-SHA224 } @ default
  { 1.2.840.10045.4.3.2, ECDSA-SHA2-256, ECDSA-SHA256, ecdsa-with-SHA256 } @ default
  { 1.2.840.10045.4.3.3, ECDSA-SHA2-384, ECDSA-SHA384, ecdsa-with-SHA384 } @ default
  { 1.2.840.10045.4.3.4, ECDSA-SHA2-512, ECDSA-SHA512, ecdsa-with-SHA512 } @ default
  { 2.16.840.1.101.3.4.3.9, ECDSA-SHA3-224, ecdsa_with_SHA3-224, id-ecdsa-with-sha3-224 } @ default
  { 2.16.840.1.101.3.4.3.10, ECDSA-SHA3-256, ecdsa_with_SHA3-256, id-ecdsa-with-sha3-256 } @ default
  { 2.16.840.1.101.3.4.3.11, ECDSA-SHA3-384, ecdsa_with_SHA3-384, id-ecdsa-with-sha3-384 } @ default
  { 2.16.840.1.101.3.4.3.12, ECDSA-SHA3-512, ecdsa_with_SHA3-512, id-ecdsa-with-sha3-512 } @ default
  HMAC @ default
  SIPHASH @ default
  POLY1305 @ default
  CMAC @ default
  mldsa44 @ oqsprovider
  p256_mldsa44 @ oqsprovider
  rsa3072_mldsa44 @ oqsprovider
  mldsa44_pss2048 @ oqsprovider
  mldsa44_rsa2048 @ oqsprovider
  mldsa44_ed25519 @ oqsprovider
  mldsa44_p256 @ oqsprovider
  mldsa44_bp256 @ oqsprovider
  mldsa65 @ oqsprovider
  p384_mldsa65 @ oqsprovider
  mldsa65_pss3072 @ oqsprovider
  mldsa65_rsa3072 @ oqsprovider
  mldsa65_p256 @ oqsprovider
  mldsa65_bp256 @ oqsprovider
  mldsa65_ed25519 @ oqsprovider
  mldsa87 @ oqsprovider
  p521_mldsa87 @ oqsprovider
  mldsa87_p384 @ oqsprovider
  mldsa87_bp384 @ oqsprovider
  mldsa87_ed448 @ oqsprovider
  falcon512 @ oqsprovider
  p256_falcon512 @ oqsprovider
  rsa3072_falcon512 @ oqsprovider
  falconpadded512 @ oqsprovider
  p256_falconpadded512 @ oqsprovider
  rsa3072_falconpadded512 @ oqsprovider
  falcon1024 @ oqsprovider
  p521_falcon1024 @ oqsprovider
  falconpadded1024 @ oqsprovider
  p521_falconpadded1024 @ oqsprovider
  sphincssha2128fsimple @ oqsprovider
  p256_sphincssha2128fsimple @ oqsprovider
  rsa3072_sphincssha2128fsimple @ oqsprovider
  sphincssha2128ssimple @ oqsprovider
  p256_sphincssha2128ssimple @ oqsprovider
  rsa3072_sphincssha2128ssimple @ oqsprovider
  sphincssha2192fsimple @ oqsprovider
  p384_sphincssha2192fsimple @ oqsprovider
  sphincsshake128fsimple @ oqsprovider
  p256_sphincsshake128fsimple @ oqsprovider
  rsa3072_sphincsshake128fsimple @ oqsprovider
  mayo1 @ oqsprovider
  p256_mayo1 @ oqsprovider
  mayo2 @ oqsprovider
  p256_mayo2 @ oqsprovider
  mayo3 @ oqsprovider
  p384_mayo3 @ oqsprovider
  mayo5 @ oqsprovider
  p521_mayo5 @ oqsprovider
  CROSSrsdp128balanced @ oqsprovider

Openssl KEM algorithms using OQS Provider

vboxuser@oqs:~$ openssl list -kem-algorithms -provider oqsprovider
  { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  { 1.2.840.10045.2.1, EC, id-ecPublicKey } @ default
  { 1.3.101.110, X25519 } @ default
  { 1.3.101.111, X448 } @ default
  frodo640aes @ oqsprovider
  p256_frodo640aes @ oqsprovider
  x25519_frodo640aes @ oqsprovider
  frodo640shake @ oqsprovider
  p256_frodo640shake @ oqsprovider
  x25519_frodo640shake @ oqsprovider
  frodo976aes @ oqsprovider
  p384_frodo976aes @ oqsprovider
  x448_frodo976aes @ oqsprovider
  frodo976shake @ oqsprovider
  p384_frodo976shake @ oqsprovider
  x448_frodo976shake @ oqsprovider
  frodo1344aes @ oqsprovider
  p521_frodo1344aes @ oqsprovider
  frodo1344shake @ oqsprovider
  p521_frodo1344shake @ oqsprovider
  mlkem512 @ oqsprovider
  p256_mlkem512 @ oqsprovider
  x25519_mlkem512 @ oqsprovider
  mlkem768 @ oqsprovider
  p384_mlkem768 @ oqsprovider
  x448_mlkem768 @ oqsprovider
  X25519MLKEM768 @ oqsprovider
  SecP256r1MLKEM768 @ oqsprovider
  mlkem1024 @ oqsprovider
  p521_mlkem1024 @ oqsprovider
  SecP384r1MLKEM1024 @ oqsprovider
  bikel1 @ oqsprovider
  p256_bikel1 @ oqsprovider
  x25519_bikel1 @ oqsprovider
  bikel3 @ oqsprovider
  p384_bikel3 @ oqsprovider
  x448_bikel3 @ oqsprovider
  bikel5 @ oqsprovider
  p521_bikel5 @ oqsprovider
  hqc128 @ oqsprovider
  p256_hqc128 @ oqsprovider
  x25519_hqc128 @ oqsprovider
  hqc192 @ oqsprovider
  p384_hqc192 @ oqsprovider
  x448_hqc192 @ oqsprovider
  hqc256 @ oqsprovider
  p521_hqc256 @ oqsprovider

ERROR

vboxuser@oqs:~$ openssl req -x509 -new -newkey frodo_kem_640_aes -keyout frodo_CA.key -out frodo_CA.crt -nodes -subj "/CN=test CA" -days 365 -provider oqsprovider
Error allocating keygen context
80BB65C45C7A0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (frodo_kem_640_aes : 0), Properties (<null>)

vboxuser@oqs:~$ openssl req -x509 -new -newkey dilithium3 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -provider oqsprovider
Error allocating keygen context
80EB0E3EDB7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (dilithium3 : 0), Properties (<null>)

vboxuser@oqs:~$ openssl req -x509 -new -newkey mlkem768 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -config /opt/openssl/openssl.cnf
80BB3C94977D0000:error:1D800065:ENCODER routines:OSSL_ENCODER_to_bio:reason(101):crypto/encode_decode/encoder_lib.c:55:No encoders were found. For standard encoders you need at least one of the default or base providers available. Did you forget to load them?
80BB3C94977D0000:error:04800073:PEM routines:do_pk8pkey:error converting private key:crypto/pem/pem_pk8.c:133:

Answered by rishabhamar

Feb 4, 2025

@baentsch Update the oqs provider is working absolutely fine with this change in command

vboxuser@oqs:~$ openssl req -x509 -new -newkey p256_mldsa44 -keyout p256_mldsa44_CA.key -out p256_mldsa44_CA.crt -nodes -subj "/CN=test CA" -days 365 -provider-path /home/vboxuser/oqs-provider -provider default -provider oqsprovider
-----
vboxuser@oqs:~$ openssl genpkey -algorithm p256_mldsa44 -out p256_mldsa44_srv.key
vboxuser@oqs:~$ openssl req -new -newkey p256_mldsa44 -keyout p256_mldsa44_srv.key -out p256_mldsa44_srv.csr -nodes -subj "/CN=test server" -provider-path /home/vboxuser/oqs-provider -provider default -provider oqsprovider
-----
vboxuser@oqs:~$ Usage instructions for oqsprovider
vboxuse…

View full answer

baentsch · 2025-02-04T08:02:54Z

baentsch
Feb 4, 2025
Maintainer

openssl req -x509 -new -newkey frodo_kem_640_aes -keyout frodo_CA.key -out frodo_CA.crt -nodes -subj "/CN=test CA" -days 365 -provider oqsprovider

I'd suggest to work through https://github.com/open-quantum-safe/oqs-provider/blob/main/USAGE.md, particularly looking at:

Be sure to always activate either the "default" or "fips" provider as these deliver functionality also needed by oqsprovider (e.g., for hashing or high quality random data during key generation).

2 replies

rishabhamar Feb 4, 2025
Author

Yes sir the default provider is activated, i have updated the code and removed legacy in case of any conflict

PATH Variable

vboxuser@oqs:~$ echo $PATH
/opt/openssl/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin

/opt/openssl/openssl.cnf

#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

# Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect

# List of providers to load
[provider_sect]
default = default_sect
oqsprovider = oqsprovider_sect

# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
activate = 1

[oqsprovider_sect]
activate = 1

List of Providers

vboxuser@oqs:~$ openssl list -providers
Providers:
  default
    name: OpenSSL Default Provider
    version: 3.4.0
    status: active
  oqsprovider
    name: OpenSSL OQS Provider
    version: 0.8.1-dev
    status: active

Still got this error

vboxuser@oqs:~$ openssl req -x509 -new -newkey dilithium3 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -config /opt/openssl/openssl.cnf
Error allocating keygen context
803BCB0003760000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (dilithium3 : 0), Properties (<null>)

I have gone through every step in the above document and i have also remove the specification of kem algorithms so that it don't conflict with the dilithium generation

vboxuser@oqs:~$ openssl list -signature-algorithms -provider oqsprovider
  { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  { 1.2.840.10040.4.1, 1.3.14.3.2.12, DSA, DSA-old, dsaEncryption, dsaEncryption-old } @ default
  { 1.2.840.10040.4.3, 1.3.14.3.2.27, DSA-SHA, DSA-SHA-1, DSA-SHA1, DSA-SHA1-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default
  { 1.3.101.112, ED25519 } @ default
  { 1.3.101.113, ED448 } @ default
  { 1.2.156.10197.1.301, SM2 } @ default
  { 2.16.840.1.101.3.4.3.1, DSA-SHA2-224, DSA-SHA224, dsa_with_SHA224 } @ default
  { 2.16.840.1.101.3.4.3.2, DSA-SHA2-256, DSA-SHA256, dsa_with_SHA256 } @ default
  { 1.2.840.1.101.3.4.3.3, DSA-SHA2-384, DSA-SHA384, dsa_with_SHA384, id-dsa-with-sha384 } @ default
  { 1.2.840.1.101.3.4.3.4, DSA-SHA2-512, DSA-SHA512, dsa_with_SHA512, id-dsa-with-sha512 } @ default
  { 2.16.840.1.101.3.4.3.5, DSA-SHA3-224, dsa_with_SHA3-224, id-dsa-with-sha3-224 } @ default
  { 2.16.840.1.101.3.4.3.6, DSA-SHA3-256, dsa_with_SHA3-256, id-dsa-with-sha3-256 } @ default
  { 2.16.840.1.101.3.4.3.7, DSA-SHA3-384, dsa_with_SHA3-384, id-dsa-with-sha3-384 } @ default
  { 2.16.840.1.101.3.4.3.8, DSA-SHA3-512, dsa_with_SHA3-512, id-dsa-with-sha3-512 } @ default
  { 1.3.36.3.3.1.2, ripemd160WithRSA, RSA-RIPEMD160 } @ default
  { 1.2.840.113549.1.1.5, RSA-SHA-1, RSA-SHA1, sha1WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.14, RSA-SHA2-224, RSA-SHA224, sha224WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.11, RSA-SHA2-256, RSA-SHA256, sha256WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.12, RSA-SHA2-384, RSA-SHA384, sha384WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.13, RSA-SHA2-512, RSA-SHA512, sha512WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.15, RSA-SHA2-512/224, RSA-SHA512-224, sha512-224WithRSAEncryption } @ default
  { 1.2.840.113549.1.1.16, RSA-SHA2-512/256, RSA-SHA512-256, sha512-256WithRSAEncryption } @ default
  { 2.16.840.1.101.3.4.3.13, id-rsassa-pkcs1-v1_5-with-sha3-224, RSA-SHA3-224 } @ default
  { 2.16.840.1.101.3.4.3.14, id-rsassa-pkcs1-v1_5-with-sha3-256, RSA-SHA3-256 } @ default
  { 2.16.840.1.101.3.4.3.15, id-rsassa-pkcs1-v1_5-with-sha3-384, RSA-SHA3-384 } @ default
  { 2.16.840.1.101.3.4.3.16, id-rsassa-pkcs1-v1_5-with-sha3-512, RSA-SHA3-512 } @ default
  { 1.2.156.10197.1.504, RSA-SM3, sm3WithRSAEncryption } @ default
  ED25519ph @ default
  ED25519ctx @ default
  ED448ph @ default
  ECDSA @ default
  { 1.2.840.10045.4.1, ECDSA-SHA-1, ECDSA-SHA1, ecdsa-with-SHA1 } @ default
  { 1.2.840.10045.4.3.1, ECDSA-SHA2-224, ECDSA-SHA224, ecdsa-with-SHA224 } @ default
  { 1.2.840.10045.4.3.2, ECDSA-SHA2-256, ECDSA-SHA256, ecdsa-with-SHA256 } @ default
  { 1.2.840.10045.4.3.3, ECDSA-SHA2-384, ECDSA-SHA384, ecdsa-with-SHA384 } @ default
  { 1.2.840.10045.4.3.4, ECDSA-SHA2-512, ECDSA-SHA512, ecdsa-with-SHA512 } @ default
  { 2.16.840.1.101.3.4.3.9, ECDSA-SHA3-224, ecdsa_with_SHA3-224, id-ecdsa-with-sha3-224 } @ default
  { 2.16.840.1.101.3.4.3.10, ECDSA-SHA3-256, ecdsa_with_SHA3-256, id-ecdsa-with-sha3-256 } @ default
  { 2.16.840.1.101.3.4.3.11, ECDSA-SHA3-384, ecdsa_with_SHA3-384, id-ecdsa-with-sha3-384 } @ default
  { 2.16.840.1.101.3.4.3.12, ECDSA-SHA3-512, ecdsa_with_SHA3-512, id-ecdsa-with-sha3-512 } @ default
  HMAC @ default
  SIPHASH @ default
  POLY1305 @ default
  CMAC @ default
  mldsa44 @ oqsprovider
  p256_mldsa44 @ oqsprovider
  rsa3072_mldsa44 @ oqsprovider
  mldsa44_pss2048 @ oqsprovider
  mldsa44_rsa2048 @ oqsprovider
  mldsa44_ed25519 @ oqsprovider
  mldsa44_p256 @ oqsprovider
  mldsa44_bp256 @ oqsprovider
  mldsa65 @ oqsprovider
  p384_mldsa65 @ oqsprovider
  mldsa65_pss3072 @ oqsprovider
  mldsa65_rsa3072 @ oqsprovider
  mldsa65_p256 @ oqsprovider
  mldsa65_bp256 @ oqsprovider
  mldsa65_ed25519 @ oqsprovider
  mldsa87 @ oqsprovider
  p521_mldsa87 @ oqsprovider
  mldsa87_p384 @ oqsprovider
  mldsa87_bp384 @ oqsprovider
  mldsa87_ed448 @ oqsprovider
  falcon512 @ oqsprovider
  p256_falcon512 @ oqsprovider
  rsa3072_falcon512 @ oqsprovider
  falconpadded512 @ oqsprovider
  p256_falconpadded512 @ oqsprovider
  rsa3072_falconpadded512 @ oqsprovider
  falcon1024 @ oqsprovider
  p521_falcon1024 @ oqsprovider
  falconpadded1024 @ oqsprovider
  p521_falconpadded1024 @ oqsprovider
  sphincssha2128fsimple @ oqsprovider
  p256_sphincssha2128fsimple @ oqsprovider
  rsa3072_sphincssha2128fsimple @ oqsprovider
  sphincssha2128ssimple @ oqsprovider
  p256_sphincssha2128ssimple @ oqsprovider
  rsa3072_sphincssha2128ssimple @ oqsprovider
  sphincssha2192fsimple @ oqsprovider
  p384_sphincssha2192fsimple @ oqsprovider
  sphincsshake128fsimple @ oqsprovider
  p256_sphincsshake128fsimple @ oqsprovider
  rsa3072_sphincsshake128fsimple @ oqsprovider
  mayo1 @ oqsprovider
  p256_mayo1 @ oqsprovider
  mayo2 @ oqsprovider
  p256_mayo2 @ oqsprovider
  mayo3 @ oqsprovider
  p384_mayo3 @ oqsprovider
  mayo5 @ oqsprovider
  p521_mayo5 @ oqsprovider
  CROSSrsdp128balanced @ oqsprovider

rishabhamar Feb 4, 2025
Author

FIPS Module is also available but still getting errors

vboxuser@oqs:~$ openssl list -providers
Providers:
  default
    name: OpenSSL Default Provider
    version: 3.4.0
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.4.0
    status: active
  oqsprovider
    name: OpenSSL OQS Provider
    version: 0.8.1-dev
    status: active

baentsch · 2025-02-04T10:25:28Z

baentsch
Feb 4, 2025
Maintainer

Please try the commands in the prebuilt docker image and let me know if they also fail there. Otherwise, please review the contents of the docker image with your local build/setup to check for differences.

5 replies

rishabhamar Feb 4, 2025
Author

@baentsch I can't create my own Post Quantum Enabled server using the docker image. It just provide basic operations

baentsch Feb 4, 2025
Maintainer

For a PQC server, I'd recommend https://hub.docker.com/r/openquantumsafe/nginx (or any other integration at https://github.com/open-quantum-safe/oqs-demos).

rishabhamar Feb 4, 2025
Author

Thank You Sir
Out of curiosity I want to ask that why was that the dilithium or any other algorithm didn't worked despite of having proper integration with the openssl

rishabhamar Feb 4, 2025
Author

@baentsch Update the oqs provider is working absolutely fine with this change in command

vboxuser@oqs:~$ openssl req -x509 -new -newkey p256_mldsa44 -keyout p256_mldsa44_CA.key -out p256_mldsa44_CA.crt -nodes -subj "/CN=test CA" -days 365 -provider-path /home/vboxuser/oqs-provider -provider default -provider oqsprovider
-----
vboxuser@oqs:~$ openssl genpkey -algorithm p256_mldsa44 -out p256_mldsa44_srv.key
vboxuser@oqs:~$ openssl req -new -newkey p256_mldsa44 -keyout p256_mldsa44_srv.key -out p256_mldsa44_srv.csr -nodes -subj "/CN=test server" -provider-path /home/vboxuser/oqs-provider -provider default -provider oqsprovider
-----
vboxuser@oqs:~$ Usage instructions for oqsprovider
vboxuser@oqs:~$ openssl req -new -newkey p256_mldsa44 -keyout p256_mldsa44_srv.kvboxuser@oqs:~$ openssl x509 -req -in p256_mldsa44_srv.csr -out p256_mldsa44_srv.crt -CA p256_mldsa44_CA.crt -CAkey p256_mldsa44_CA.key -CAcreateserial -days 365
Certificate request self-signature ok
subject=CN=test server

I just mention provider after the certifate creation and instead of writing dilithium i used the mentioned signature algorithm in the github file

Also setup a client server connection with oqs key exchange algorithms

vboxuser@oqs:~$ openssl s_server -cert p256_mldsa44_srv.crt -key p256_mldsa44_srv.key -www -tls1_3 -groups X25519MLKEM768 -provider oqsprovider
Using default temp DH parameters
ACCEPT

vboxuser@oqs:~$ openssl s_client -connect localhost:4433 -groups X25519MLKEM768 -provider oqsprovider
Connecting to 127.0.0.1
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN=test server
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=test server
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN=test server
verify return:1
---
Certificate chain
 0 s:CN=test server
   i:CN=test CA
   a:PKEY: UNDEF, 128 (bit); sigalg: p256_mldsa44
   v:NotBefore: Feb  4 12:44:24 2025 GMT; NotAfter: Feb  4 12:44:24 2026 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIP/DCCBiugAwIBAgIUUzGq4gVFzHjHjjOd9KhNDHUP8sEwBwYFK84PBwUwEjEQ
MA4GA1UEAwwHdGVzdCBDQTAeFw0yNTAyMDQxMjQ0MjRaFw0yNjAyMDQxMjQ0MjRa
MBYxFDASBgNVBAMMC3Rlc3Qgc2VydmVyMIIFczAHBgUrzg8HBQOCBWYAAAAAQQT0
0IMfMgUJkxE29rZHKHnBGvQqrcG3Z9tTEjPYvpeKqcMOQN+NbRNIxUXSfdeBoPcv
d9GG5jwwoaj4telv6oDOSJbWNur9qP1pXj8121Vyjzegck6/3LecNSzhUMulY62F
nYVTAQx38dfNQClIioOPhKejB90o1eH+tROoKQwmiB6bv7zftalE092Z8L/HGyVm
RHGviS5qOiJ0DP34ar8hHorAFqGunCtLJKsJWogChGviTHWhHAWDG5AqedZgaLMn
jXP0vPI9FxerSzZoLySa66A2Rm9d7JoLeoyXx244YGLP5K5rea/BWFJMLCxVd9X8
WuesEsst3L/OOVCcEDoPUad/9xaMKozgSZznCdw9n6TTivhO32Bu8zIpyhVB7wcF
Luq3t9xFU4/5uqEKq5r6M7YWmM1wc46jkkQnXVdEQkSSia1pp+CvncmAUpf1ZR9F
yC6pM8O3+QIF3yQS6LMZnjOzZvLXGFl80Neid/emDMp9BfmeEMp9TFZwG0m/Ktdm
I9BcEKw42APzurT9l1aeoYFzcM6MTd/JJjlt08v7D8Thd2QD4MS7OlkJYHWl9chR
KL841MFqHsiK9b/bK3NjoKP3+6yzHN+z0znXfkbjGT1jlAmhJPZ011cWOFoC9u10
HVV36EoWQsCQDSZixJ7cc7VH/669xJ3gvexLQUinIIuu+PlcI50VU9V0eLYCveP1
4LOg2uGLdQmYrdrlAibq/Rr7DzTaqLCePrcldAbrl22I13gVXgL1UIVxgHdZdJtZ
0silXIxzPWQcD7+YNAnhwu47ZMlGsQm6lWc0NvGYmDbSxQKiRGECEdLDo7aHBEgQ
cWi+dHv8ZzxF/F8sdNhnqW870YN7EcRiguL99QEIkDfcnJvCYHB+iccvEB3Mf1D8
Ma4KaqfEq27b1eetwk5XlPJj5eGUZX/7UIDHDHPEPBdG5ieUBl6JWqVos5tTvsEq
KMpSy2I8fpp0F8kZ+R9ZvKfl5stmR8ytZ6E6XZNL08DE170vkgpbLOgX18TdKBCn
jQZpJQ4BYhZAq4anm1OBF52vXgXEyWFEA3+l6Hz4Llu5J0xPXEMGwXSC9xNM8q9a
0lfKC+ZS96sogAXE/sra5b9wid90PXPo3H0//KenMNmFrhm0/a0oniAdUW4q6tYP
gGRE5hSRpcIeYhgSijb+ZOE0zI3jukX24o1v9abYQo7DFvLV6QycuAy7jMxW73Dn
JAOtHRZStg+zHF/X5iu278H0gVbnpFOp5d0sWhSgqd/EqcjEBl6kYOmaGQq+1zoc
+lh9sh88yluYnPeIXfQAxHIo1z2YHQGdO1iQ4uwp65pXtfVeo3uMOWTrfOFzNpjA
XMqZMkAJCPa50pCsVMXVjN3LkLZMxoetH9gnjxiokvkXH3C6yCah2OhI0NUgCvgA
twJl101mgRd5mRR0t+Zs3wC6Q1sdCGzbHjVlFlWSFYSY6t1DObkPi2Mit9UjLWRa
fjvr8XXkAfU2TISHjgba2NXKJAnRjrE12r2aN/t6QVr8P/58qRGdX1Rqbw3E0H/t
b2QsShD77qEMhmtWcuxCKawDC4daXFijn3faRKDkozjKXS6NdTVMt4LWqCeCM5hO
0vIuxajRlV/Eg5beDGciauKpMz4YfxoBZmUTQmnMcB6gqz6DLkrUY7/gQJn44RqN
4j2BwsOpkUrRRz/sCG5hhapvnlRt80EFldGD5HD9OR+HtXlf64cwlRL+zb6YGcO3
CBWd4PsCxMMDPPO4QrOQ5Yi0Rf7SbeZLLwLTJrrveuNthnxO5RFAM1LTLE2rZaek
pK5/N6OjQkT3krkv5wgZVSE9oeZ+1eBobSbdWNSIQqNCMEAwHQYDVR0OBBYEFFSh
EnOMLzGoH4ynTTpg07Op4g43MB8GA1UdIwQYMBaAFExCOhg1VtkH60BrTRV27GoD
l95AMAcGBSvODwcFA4IJwAAAAABHMEUCIDOVJAnyOtg5UqFrFtrA/I+zEJaD8VpQ
H4+xChtFKjdBAiEA9ZBHjHheJzyn4/+tnh/mVs5zL6rQUrXLa22V5JRQpvWwzyZm
/zGvW+mvW/yAMicwYXzRlz6EPQo8n+xi5RM7rargZee5IvfcQNp3a/0vPEMgypDv
iK8blSecvBrIRB6RMigClU45mFkMMFsRSYAHme1SGds3hsrFVtAHRAtQQ/1pofKp
PgucQhAL/Z5sOMpOetVFKIzNO06c/Tue0UuBz5FjreSGiZ4wZgQgGSif8H7wD2ST
aqYS1Q+Lsf/txB4ebU96uVJyXz7lJkFZg9L5mxdsHftsUPmXKvbXrcjZ1ZgP4AHi
UnsYytHBzXCuBhAyLCUobwzeULB8fxgBCEu0skLC7xKLUDKbqjepTSn1DcTfLi9c
m7xnaX+hhCVXw54gX0S4PfQhjwtS8JeRKWsEI1jdZ16U682fKNMIkD6vknMO/pxi
QTRnmyGGR5CR35WKcQSq88mde4x5/+APkuzBeg0hTBue3GXpPMW8UJAmFgGaNzuw
OTqMf8cr5Ngaf5wMDFTnkkD+b2CU15tYDCeOeCif0WPr4Edr0UIzUPdvwtRPI5K9
FcMGVTnxicPvo846j6Th6VQxyQrljz+iEKY6pVI3rwXp3JAeIdUS/ug/f25fzwd9
gMWp0s6udv7SjA4jRDsl7P2pdCFK2DRFkrYn3E3P8X4eyaEk0cUA1vlN/0/2Ul5I
jWVuuyeb0DHMlD3XY4uKP6pJPHj1PKK6bmGxSq7G7ObEe1uIaKVYoy6zuus4M8o6
smEcESfpKbU+C8NqsRJLegH1VPpw6y0cG/9oU3cesnnyrLgSazWlIUpPrrnCdiqx
KGyGzi+lO3uPQcp+pQwE6XN0XjJ8eHuzvbhB3F2azwIxAikGaBQdno9KE4e/xFDg
NOrPEAaZ5rEn6W3m/GqsQYm/rgvsri1GyzOhMEefpHWOGAWbzoayAWls6VCMoDBD
YcGBfhYb+YO7VMGI4KHd4byv+Ot/D5AGc6abcvygUSnSTic8E/v7ZR++n4oF0w7I
DlQC0xnSgdk2iGwq7nJIYUfIQTi47oDgRbdtas/WjFkfcbOfS52dgrvwzDH9IQ4X
j2TUySUiAcJHs7dNe7ZYfYY0tZAUqfE+x1GlhjAJcABRF6WF5zz3MLVosTkhQq/q
3tqH7WRWlBM5gORBi1yLG5TRGm3VKx88/UZi/Q/U/T95GJLJJOG93vwjoVInqyKD
5i6FAcDy8u47sg5kwVp6OJ60kxPExDrZIAVpIz1YJISGykxHzTQaQOIXry0wxUvd
Jvr1dH5PPDPOdnAdf8i7F6n3U4tRyVySmZ+qB3/YjUbVaUvkk+p0z47GZshNtV+9
481HU+fkZNQTTqVNBlEIDx/leMOoqXWX25GIG8EnIrpDU4tWSWaw3IVz/kVgTm8t
2psubc/a+zhn077l+otVt44AZDW0+1gwLOwLDaYyw7BhivnPAzGsg5stkMN6Cyup
VhWiv78DT5EmD2sfBzLwD4BZXVVyeYp4ZduEFvPrJ6TyJvzEpKFor0zm1TbQ3lih
uvUVvZB5kZ1GJx30dK3E5HamVAwcjeX/aFJIR/dQtWd1HFaS4IYMTK/UZA/Gub5g
ns4y/dGaFjT/loBLblha+kCzK3APK4oKxvqWZQG+dv2eCOw5Ipk82jzZgpFk/tAT
Q9+b1EnXEjCmYZi6yN0YjOAfGE3HKKfL3HTlRcFVPwyAtRZidRKs5/uOpcMtGakk
/rCsE7g5dbbPXX0tFj+3C1xtLFucUqzMA4eDwGCxLCKFXGmf+vdDEGT0SCPZVC8R
9p26sWrBmcUBMolwLYEirCxzXL3xaGBXA0/DnamvJM4NEJyuiWjXQR26cweRmGnn
7MnVuCdTZMB0NcZ2bhqMqDi9lZHN7tTlU/EY+FAnL+Dko2tg7bjGke65d8+A2nOv
JK9EucIl4P3kLljQInkRPjuIliVDTj2ZtmBMSKGp6fR06yFaI+foz7XhO+TDqi+9
5jVnbILj4lqvVANtpbKTkoNywD7GRgbWx9iyd9Y3GNWOnof+mD5a5xq+MjqndKR+
5C6hu07/MoJV3/uZN9L01tQgPm4mP1Km8XOmTp1NgwqGjKvoAyYNw90aaREH/Mac
gkM47WsPBQapyqbv4rNwfwgNFloBWo4N6xBTBfckf3GIWOZC2NA2oDtSFKPBYp+X
QbqRKu6PykrLSposXjID/tR0L4hcPdUHnmkMDMHG0HORIRGFr0Wk1u5FvjKvM9mc
vUVxAPc4Ve+vZgp9XlDF0vTn/VwjGgrxyvuDFT8X2vCXCIFv8KmcUMOoU4qSXtU2
A5frJPixwaD1x6Hgc/xOatPKbiAka2Go3MtfZZswEQM9Imd155AJBW8mogZ1uNvL
EDLYnNenoDxyF6X40+kE4kUgTctmHctsiBkdtahMSw/ZIp+LAq0vtjBDiquDPWM/
JWZYcpFL/iU2U4r4F3Ow6/+8UnzYJgYFyAJBZ8XNbYvhjFyxk35E1M6QqnevhGqz
gjhLNxUjnp1le/P0w7LXxEfgOHSQZgVemL5c3blj7GcNuDAPey8yJIn4LOA/X7Dg
024j4fFQKXm9E7CiPjptldR0wboY+TW6SQ2pe+GeYIvt3l1uPI6XOePe2wpdurxs
kDmylDJ3+SozfVOldZAfVD3sELIakUhN/+TQ9d7/87QbYlj6VCCcqoVQ2xLKWyW+
uzoIIjbmqY9OObj7dGORqSIB81ZE7urTwpwwiBgoV2Yk+3jWeRMcAYKi7vWGWceH
rx+Q/i3uT/RbQc3IDCHoq63EPw8pj4ti6844m19DyZCtOuCgYMMCnvwW7/A2zt6S
pcQdBbQcTUUXGDjsmoJoJIDX+QBTcb5keUx5SsJAQYLz6XEDLaYe1AEk+EdNv6JT
7dUp140k+hnB3EmVcXch5FVcfSxcEO4qzPqjbwYtr5K1xrDMqX2ui/XOP7EJRbve
eqKnnTuVCf0eG5o8dlLLQHQGHOKpWzuB71cyaxtBfGS9+z0Y8Y4B4A5vnzZW/wlU
dZ+Kzg1/ekYMiaHMIOh9792dyxlIebU6viNAzM0krzZaAD4N0PhxVPVrWAibIiw9
xIhyakEp2Q1jN6vkN3gzTtKsdU0ZlK2EzYFchxtfFnWlrAcOLHpeXYChjeCoflav
LxEOW+JVXdAZ1ZK38YIjyV+LCb82vjkhyFUO1REmKU9SVmlukazIzM7c4AkKICRP
XGdpmqj4DBkfKCosPER6uMbN6/UQJik1R1SWl87WAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAADxooMg==
-----END CERTIFICATE-----
subject=CN=test server
issuer=CN=test CA
---
No client certificate CA names sent
Peer signature type: p256_mldsa44
---
SSL handshake has read 7979 bytes and written 1640 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 128 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: ED1C40F85DC41637EAB92421D3DDF53A75A339EE57900151F9689D17A2F211EF
    Session-ID-ctx: 
    Resumption PSK: EEF6B4DBD5F7388A7F802084C748E5C713F32E70A3A7B0B0F7E1F5A6AECFC384299EF0C08C9149650D629ABB7237B0EF
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 47 6b d6 6c d4 2b 5f 45-a2 34 e5 7c bf 24 d2 e0   Gk.l.+_E.4.|.$..
    0010 - 89 df 9e 3b 88 33 10 dd-3b b1 64 bc 51 ab cd 62   ...;.3..;.d.Q..b
    0020 - e9 2c 82 dd 97 8d 48 4d-a6 9f 8f 2b 32 cc 84 6e   .,....HM...+2..n
    0030 - 06 b0 4e 01 8c a7 33 16-68 5e 0d b0 73 ae bd a2   ..N...3.h^..s...
    0040 - 86 7e c4 8f c1 75 ea 9a-73 32 ef 9f 4c af 0d 89   .~...u..s2..L...
    0050 - 3a c7 46 dd 1f 60 1c 95-bc d4 0d 07 37 70 70 d9   :.F..`......7pp.
    0060 - 4d e9 97 99 e2 6f a7 07-6f 5b 69 10 56 d9 da ca   M....o..o[i.V...
    0070 - 0b 81 32 a5 75 3d ed ef-0c 02 b7 c9 e7 ee 91 69   ..2.u=.........i
    0080 - 86 5d 7f 41 b6 93 20 30-c7 45 ae cb 0b 00 36 5c   .].A.. 0.E....6\
    0090 - ae f9 47 3e da 82 2f 7c-57 e4 38 ce 09 ac 09 2f   ..G>../|W.8..../
    00a0 - f5 52 bb b2 ec 70 6e 25-51 b2 6d 8a f4 54 52 e1   .R...pn%Q.m..TR.
    00b0 - f3 8d c9 43 0d a6 5f fe-36 6a b3 5d 92 36 43 12   ...C.._.6j.].6C.
    00c0 - cc 2e 8f b6 cb 85 40 1b-61 97 10 58 eb 79 80 9c   ......@.a..X.y..

    Start Time: 1738674600
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: EE5296376C9B6A447EA82D51062B0EB54787E00A02E79AFFA4D15BEBB7E8B1EC
    Session-ID-ctx: 
    Resumption PSK: B50F122BDFF59D27FD5D4C4B7AAC999AB958E8857F455EB4E6C21DFFCEC19D44CEC0E9819C8912ADD20D3F3ADE09C3F5
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 47 6b d6 6c d4 2b 5f 45-a2 34 e5 7c bf 24 d2 e0   Gk.l.+_E.4.|.$..
    0010 - cb fc 1c e3 36 6c 86 31-36 1a db bc 9c 40 4d 09   ....6l.16....@M.
    0020 - db cc 17 c1 4f af cb 09-83 fc ee 8b 6c a9 0e bf   ....O.......l...
    0030 - a4 b0 ec 44 1c df aa cd-cf 77 37 36 2d 1b 95 2f   ...D.....w76-../
    0040 - 2e 90 a9 62 c7 a7 6c 68-5b 9c a9 5c 1e 23 a5 00   ...b..lh[..\.#..
    0050 - 95 5b 69 e3 f3 fb 0d 30-4e 5c a7 ff 79 6f 47 f5   .[i....0N\..yoG.
    0060 - e0 32 cc fa 3f 6c d5 b8-34 12 fe cb fd 56 25 ec   .2..?l..4....V%.
    0070 - 74 a5 9a 0d cf 57 cf 54-5e 82 8b f6 e0 32 52 a6   t....W.T^....2R.
    0080 - 34 23 57 23 89 a1 bd 92-c7 86 8a d6 0c 32 b5 13   4#W#.........2..
    0090 - 9a 68 7c e5 2f a2 d1 82-6b 2e 9f b0 0c 0d b7 d7   .h|./...k.......
    00a0 - 1e f4 c3 3a cd 71 8f 50-74 42 a7 1b 0a 7d ff ba   ...:.q.PtB...}..
    00b0 - 01 67 56 cd b1 f0 c1 10-09 e6 a4 21 aa 55 be 14   .gV........!.U..
    00c0 - 55 6c fe de d7 7a 05 69-80 70 74 82 e9 66 5d 80   Ul...z.i.pt..f].

    Start Time: 1738674600
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

Thank you sir helping out and communicating throughout

Answer selected by rishabhamar

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

I can't use OQS Provider for Post Quantum Handshakes and Certificate Generation #635

{{title}}

Replies: 2 comments 7 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

I can't use OQS Provider for Post Quantum Handshakes and Certificate Generation #635

rishabhamar Feb 4, 2025

Replies: 2 comments · 7 replies

baentsch Feb 4, 2025 Maintainer

rishabhamar Feb 4, 2025 Author

rishabhamar Feb 4, 2025 Author

baentsch Feb 4, 2025 Maintainer

rishabhamar Feb 4, 2025 Author

baentsch Feb 4, 2025 Maintainer

rishabhamar Feb 4, 2025 Author

rishabhamar Feb 4, 2025 Author

rishabhamar
Feb 4, 2025

Replies: 2 comments 7 replies

baentsch
Feb 4, 2025
Maintainer

rishabhamar Feb 4, 2025
Author

rishabhamar Feb 4, 2025
Author

baentsch
Feb 4, 2025
Maintainer

rishabhamar Feb 4, 2025
Author

baentsch Feb 4, 2025
Maintainer

rishabhamar Feb 4, 2025
Author

rishabhamar Feb 4, 2025
Author