Compile and run C code (PEM_read_bio_PrivateKey) with pq-algoirthms using oqs-provider and OpenSSL3

[alexandra-buzatoiu]

I am using the Openssl3 build and installed by the fullbuild.sh script, i have cloned the repository in /home/buzi2/oqs-provider directory

buzi2@buzi2-virtual-machine: ~/oqs-provider/openssl$ ./apps/openssl version -a
OpenSSL 3.1.0-dev (Library: OpenSSL 3.1.0-dev )
built on: Wed Aug 24 07:41:04 2022 UTC
platform: linux-x86_64
options: bn(64,64)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/home/buzi2/oqs-provider/openssl/../.local/ssl"
ENGINESDIR: "/home/buzi2/oqs-provider/openssl/../.local/lib64/engines-3"
MODULESDIR: "/home/buzi2/oqs-provider/openssl/../.local/lib64/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0xfffa32034f8bffff:0x9c27ab

I have modified the openssl.cnf file as it follows (inside the oqs-provider/openssl/apps/openssl.cnf)

[openssl_init]
providers = provider_sect

List of providers to load

[provider_sect]
oqsprovider = oqsprovider_sect # added
default = default_sect

[default_sect]
activate = 1 # uncommented

[oqsprovider_sect] # added
module = /home/buzi2/oqs-provider/_build/oqsprov/ oqsprovider.so #added
activate = 1 # added

My problem is I have modified this inside the oqs-provider/openssl/apps/openssl.cnf file, and the examples on github seem to use the already generated exe in oqs-provider/.local/bin
I don't know if my modification would have any impact.
And now, I have a simple C code I want to run, read a pq-algorithm private key from a file and write it into another file.

I compile my code this way, even though I guess this is not the right way to link it.
gcc -L/home/buzi2/oqs-provider/.local/lib64 mycms.c -o mycms -lcrypto

When I try to execute it, I get segfault, as it cant't read the pq key and it uses OpenSSL3.

The output of ldd mycmp (my executable file) is:
buzi2@buzi2-virtual-machine: ~/program$ ldd mycms
linux-vdso.so.1 (0x00007ffc4e9cf000)
libcrypto.so.3 => /home/buzi2/oqs-provider/.local/lib64/libcrypto.so.3 (0x00007fb852a63000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb85282c000)
/lib64/ld-linux-x86-64.so.2 (0x00007fb852fa3000)

My question would be what should I do in addition to what I am already doing, in order to be able to run my code. Should I also pass by -L the path to the shared object oqsprovider.so?
I have already mentioned the path to the shared object oqsprovider.so as module in the openssl.cnf configure file.
I think it is active, at least it seems to be.
Thank you in advance!

The content of mycms.c:

include <stdio.h>

include <string.h>

include <openssl/crypto.h>

include <openssl/pem.h>

include <openssl/err.h>

include <openssl/x509_vfy.h>

include <openssl/x509v3.h>

include <openssl/cms.h>

include <openssl/pem.h>

#define ERR_FILE_IO 100
#define ERR_LOAD_CERT 101
#define ERR_LOAD_KEY 102

int main(int argc, char **argv)
{
BIO *out = NULL, *pkey = NULL;
EVP_PKEY *key = NULL;
char *keyfile = NULL;
char *outfile = NULL;
if (argc != 3)
{
printf("Wrong number of parmeters\n");
exit -3;
}
outfile = argv[1];
keyfile = argv[2];
int ret;
out = BIO_new_file(outfile, "wb");
bio_cert = BIO_new_file(signerfile, "rb");
pkey = BIO_new_file(keyfile, "rb");
key = PEM_read_bio_PrivateKey(pkey, &key,
NULL,
NULL);
if(key == NULL)
{
printf("Private key load error!!!!!\n");
exit -5;
}
ret = PEM_write_bio_PrivateKey(out, key, NULL, NULL, 0, NULL, NULL);
return ret;
}

[baentsch]

At first glance:

[oqsprovider_sect] # added
module = /home/buzi2/oqs-provider/_build/oqsprov/ oqsprovider.so #added

Here seems to be an incorrect space ... Have you validated that oqs-provider is loaded at all?

[baentsch]

@alexandra-buzatoiu Will mark this as answer unless you state that your problem is not resolved, OK?

[baentsch]

@alexandra-buzatoiu : Is your problem resolved? OK to mark as "Answered"?

[ranjankumar23]

Michael,

I also have similar use case. can i post my question in this thread or i create new thread?

Regards
-Ranjan

[baentsch]

Ranjan, I consider the question answered and will close this when not receiving an answer to my question above. Thus, I'd prefer a separate issue/question that exclusively covers your use case. Thanks.

[ranjankumar23]

Thanks for your response Michael.
I started another Q&A thread #87

[ranjankumar23]

@alexandra-buzatoiu : Is your problem resolved? OK to mark as "Answered"?

It is on me to check, i was not able to spend time on this. Thanks for your help. I will update this later with my result.Let's mark it answered for time being.