Hi All, I'm working on upgrade openssl version from 0.9.8y to 1.0.1e in our product. To import PEM certificates we use use high-level OpenSSL API:
OpenSSL_add_all_algorithms(); BIO *key=BIO_new(BIO_s_file()); int res = BIO_read_filename(key,filename); EVP_PKEY* pkey = PEM_read_bio_PrivateKey(key,NULL, NULL, password); ........... There were not any problem with the 0.9.8y version. The problem (for 1.0.1e version) is that if PEM was encrypted in ECB mode - PEM_read_bio_PrivateKey returns NULL. I checked how this func works with certificates encrypted by the following algorithms: aes-192 in ecb mode aes-192 in cbc mode des-ede in ecb mode des-ede in cbc mode PEM_read_bio_PrivateKey returns not null value for certificates, encrypted using des-ede and aes-192 in cbc mode. For ecb mode it returns NULL. Here is the openssl error stack: OpenSSL error stack: 906A065 : error:0906A065:PEM routines:PEM_do_header:bad decrypt OpenSSL error stack: 6065064 : error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt I found that this error occurs for openssl1.0.1e built with/without fips and for openssl 0.9.8y build without fips. If we built openssl 0.9.8y with fips everything works ok. I put some logs in openssl code and I checked that openssl read PEM header and resolve cipher by name from DEK-Info (of course it's obvious, I just double-checked that it works correctly). I compared ciphers parameters which different openssl versions provides according to 'DES-EDE' name. They have the same id, block length etc, but cipher received with openssl 0.9.8y with fips version has IV. All other versions which I tested has IV_len = 0, but for openssl 0.9.8y with fips version IV_len always equal to 8. This is the only difference which I found for that ciphers. I don't know how this iv_len is used (maybe it's not used at all), but it seems strange because iv is not needed for ecb mode. Could anyone please help me with it? Thanks in advance! -- View this message in context: http://openssl.6102.n7.nabble.com/For-some-openssl-versions-DES-EDE-cipher-has-IV-len-8-tp46595.html Sent from the OpenSSL - User mailing list archive at Nabble.com. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
