Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rework ECIES to avoid ECDH_KDF_X9_62 #252

Closed
mcr opened this issue May 27, 2019 · 3 comments
Closed

rework ECIES to avoid ECDH_KDF_X9_62 #252

mcr opened this issue May 27, 2019 · 3 comments

Comments

@mcr
Copy link
Contributor

mcr commented May 27, 2019

openssl/openssl@9453b19 decprecates ECDH_KDF_X9_62 which is used in contributed code for ECIES, so this needs to be fixed.

@rhenium
Copy link
Member

rhenium commented Feb 19, 2020

I cannot merge #246 because we should avoid implementing primitives in this library.

On a side note, once we gain OpenSSL::PKey#derive (which I hope to merge in #329), the KDF can be made accessible from Ruby through the EVP API as suggested in OpenSSL's CHANGES file.

@rhenium rhenium closed this as completed Feb 19, 2020
@mcr
Copy link
Contributor Author

mcr commented Feb 19, 2020

I appreciate the situation. I believe that we need ruby-openssl internals in order to implement this elsewhere. Would it a patching making it possible to do that be acceptable? (Upstreaming to OpenSSL may take years)

@rhenium
Copy link
Member

rhenium commented Feb 21, 2020

I doubt if there is a portable way to use the internals/symbols of Ruby/OpenSSL from another extension library. It might work on Linux (as Ruby uses RTLD_GLOBAL flag when loading extension libraries with dlopen(3)), but I'm not sure about other platforms.

Another concern is mixed versions of OpenSSL. It's possible that Ruby/OpenSSL and openssl-pkey-ec-ies link to incompatible versions of libcrypto, and in that case, sharing the EVP_PKEY object would result in silent misbehavior or crash.

I wonder if it is really necessary to use them to implement it. To me, it seems like the best option is to serialize a key into DER format and let other library re-construct EVP_PKEY from it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants