Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-82676

Describe key conversion from oqsprovider into a standard format

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: Generate New Ti...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • openssl-3.5.1-1.el10
    • No
    • Low
    • 2
    • rhel-security-crypto
    • ssg_security
    • 26
    • 0.5
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto25Q2, Crypto25July
    • Hide

      For both ML-DSA and ML-KEM algorithms:
      1. OpenSSL is able to read files created by the oqsprovider we shipped in RHEL-10.0 and convert them to the "expandedKey" IETF format

      Show
      For both ML-DSA and ML-KEM algorithms: 1. OpenSSL is able to read files created by the oqsprovider we shipped in RHEL-10.0 and convert them to the "expandedKey" IETF format
    • Pass
    • Not Needed
    • Automated
    • Enhancement
    • Hide
      .OpenSSL 3.5 uses standard format for ML-KEM and ML-DSA

      In RHEL 10.0, the `oqsprovider` library used a pre-standard format for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) private keys. With the rebase to OpenSSL 3.5, you must convert the ML-KEM and ML-DSA keys to the standard format by using the following command:

      ----
      # openssl pkcs8 -in <old_private_key> -nocrypt -topk8 -out <standard_private_key>
      ----

      Replace `<old_private_key>` with the path to the non-standard private key, and `<standard_private_key>` with the path where the standard key will be saved.
      Show
      .OpenSSL 3.5 uses standard format for ML-KEM and ML-DSA In RHEL 10.0, the `oqsprovider` library used a pre-standard format for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) private keys. With the rebase to OpenSSL 3.5, you must convert the ML-KEM and ML-DSA keys to the standard format by using the following command: ---- # openssl pkcs8 -in <old_private_key> -nocrypt -topk8 -out <standard_private_key> ---- Replace `<old_private_key>` with the path to the non-standard private key, and `<standard_private_key>` with the path where the standard key will be saved.
    • Done
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      oqsprovider shipped in RHEL10 creates private keys in its own format that doesn't correspond the IETF ones we expect.

      After rebasing to OpenSSL 3.5 we need to verify that we can convert it and document the way how to convert into smth more standard.

              dbelyavs@redhat.com Dmitry Belyavskiy
              dbelyavs@redhat.com Dmitry Belyavskiy
              Dmitry Belyavskiy Dmitry Belyavskiy
              Georgios Stavros Pantelakis Georgios Stavros Pantelakis
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: