Score:1

Error to create PQ certificate in C - x509 certificate routines:X509_PUBKEY_set:unsupported algorithm

in flag

I'm learning OQS OpenSSL and I'd like to create a certificate with dilithium in C, using liboqs and OQS OpenSSL. This is my code (based on https://stackoverflow.com/questions/256405/programmatically-create-x509-certificate-using-openssl and a lite bit of chagpt):

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/opensslv.h>
#include <openssl/obj_mac.h>
#include <openssl/ec.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <oqs/oqs.h>
#include <openssl/obj_mac.h>
#include <openssl/objects.h>


// Função para exibir erros OpenSSL
void handleOpenSSLErrors()
{
    ERR_print_errors_fp(stderr);
    abort();
}

X509 *createSelfSignedCertificate(OQS_SIG *sig)
{
    EVP_PKEY *pkey = EVP_PKEY_new();
    if (!pkey)
    {
        handleOpenSSLErrors();
    }

    // Gerar chave privada e pública pós-quântica
    uint8_t *privKey = malloc(sig->length_secret_key);
    //printf("%zu - %zu \n", sig->length_secret_key, sig->length_public_key);
    uint8_t *pubKey = malloc(sig->length_public_key);
    if (!privKey || !pubKey)
    {
        fprintf(stderr, "Erro ao alocar memória para chaves pós-quânticas.\n");
        exit(1);
    }

    OQS_STATUS status = sig->keypair(pubKey, privKey);
    if (status != OQS_SUCCESS)
    {
        fprintf(stderr, "Erro ao gerar chaves pós-quânticas.\n");
        exit(1);
    }

    // Criar o certificado autoassinado
    X509 *cert = X509_new();
    if (!cert)
    {
        handleOpenSSLErrors();
    }

    // Definir versão do certificado
    if (!X509_set_version(cert, 2))
    {
        handleOpenSSLErrors();
    }

    // Definir número de série do certificado
    ASN1_INTEGER_set(X509_get_serialNumber(cert), 1);

    // Definir validade do certificado
    X509_gmtime_adj(X509_get_notBefore(cert), 0);
    X509_gmtime_adj(X509_get_notAfter(cert), 31536000L);

    // Atribuir chave pública ao certificado
    if (!X509_set_pubkey(cert, pkey))
    {
        handleOpenSSLErrors();
    }

    // Autoassinatura do certificado
    if (!X509_sign(cert, pkey, EVP_sha256()))
    {
        handleOpenSSLErrors();
    }

    // Liberar memória
    EVP_PKEY_free(pkey);
    free(privKey);
    free(pubKey);

    return cert;
}

int main()
{
    // Verificar versão do OpenSSL que está sendo usada
    printf("Versão do OpenSSL: %s\n", SSLeay_version(SSLEAY_VERSION));
    // Verificar se o algoritmo de assinatura pós-quântico está disponível
    const char *method_name = "dilithium2";
    if (!OQS_SIG_alg_is_enabled(method_name))
    {
        fprintf(stderr, "A curva elíptica pós-quântica não está disponível.\n");
        exit(1);
    }

    // Obter informações sobre a assinatura pós-quântica
    OQS_SIG *sig = OQS_SIG_new(method_name);
    if (!sig)
    {
        fprintf(stderr, "Erro ao obter informações sobre a assinatura pós-quântica.\n");
        exit(1);
    }

    // Criar o certificado autoassinado
    X509 *cert = createSelfSignedCertificate(sig);

    printf("Certificado criado com sucesso.\n");

    // Verificar a assinatura do certificado
    EVP_PKEY *pubKey = X509_get_pubkey(cert);
    if (!pubKey)
    {
        handleOpenSSLErrors();
    }

    int result = X509_verify(cert, pubKey);
    if (result == 1)
    {
        printf("Assinatura do certificado verificada com sucesso.\n");
    }
    else
    {
        printf("Falha na verificação da assinatura do certificado.\n");
    }

    // Salvar o certificado em um arquivo PEM
    FILE *certFile = fopen("cert.pem", "wb");
    if (!certFile)
    {
        fprintf(stderr, "Erro ao criar o arquivo de certificado.\n");
        exit(1);
    }
    PEM_write_X509(certFile, cert);
    fclose(certFile);

    // Liberar memória
    X509_free(cert);
    OQS_SIG_free(sig);
    EVP_PKEY_free(pubKey);

    return 0;
}

and I got his error when I tried X509_set_pubkey(cert, pkey) : Versão do OpenSSL: OpenSSL 1.1.1t 7 Feb 2023, Open Quantum Safe 2023-02 140484302799488:error:0B07806F:x509 certificate routines:X509_PUBKEY_set:unsupported algorithm:crypto/x509/x_pubkey.c:82:

I know this error maybe is related with different versions of OpenSSL in the same machine, but as you can see in my error message the version is correct. Could you help me?

Maarten Bodewes avatar
in flag
I think that if you are trying post quantum libs for X.509 that you should (still) be expecting to debug the libraries used. If you step through the code you should pick up the branch in the code that produces the error.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.