Thanks Dr. Henson.
However still have problems:
1. what encryption method does PKCS#8 format allow ? I tried to use pkcs8
to convert a unencrypted PEM key into PKCS#8 format, and it prompts me for a
password. However, In the converted files I cannot find info like "DEK-Info:
AES-128-CBC" as normal PKCS#5's header, but only a "-----BEGIN ENCRYPTED
PRIVATE KEY-----". Later I tried to read converted key with OpenSSL in FIPS
mode but got error. I guess it uses a FIPS_not_allowd encryption method.
Detailed steps are:
1. openssl genrsa -out key.pem 2048
2. openssl pkcs8 -topk8 -in key.pem -out newkey.pem (enter a password
following prompt)
3. openssl rsa -noout -text -in newkey.pem ( this works)
4. OPENSSL_FIPS=1 openssl rsa -nouot -text -in newkey.pem ( got error
"digest.c(151): OpenSSL internal error, assertion failed: Digest update
previous FIPS forbidden algorithm error ignored")
2. I also try to write to a PKCS#8 with a AES-128 encryption method using
API , but the output is empty with header only. What step did I make it
wrong?
My code : PEM_write_PKCS8PrivateKey( fp, key, EVP_aes_128_cbc(), 0, 0,
callbackFunc, 0 );
Actually I am not fully understand the "transparently used". Could anyone
please explain a bit more? My target it to have a format with FIPS-valid
encryption and digest methods to store and read private RSA keys. Thank you
very much.
Peter Lin
On Thu, Jul 2, 2009 at 5:07 PM, Dr. Stephen Henson <[email protected]>wrote:
> On Thu, Jul 02, 2009, Peter Lin wrote:
>
> > Hi all,
> >
> > I noticed that md5 is used as the digest algo in PEM, which is not
> allowed
> > for FIPS mode.
> >
> > Is there any way change it to a FIPS valid method (e.g. sha1) ? Or is
> there
> > any other format to store a RSA private key in OpenSSL FIPS mode?
> >
>
> PKCS#8 format using SHA1 is transparently used in FIPS mode.
>
> Steve.
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
> ______________________________________________________________________
> OpenSSL Project http://www.openssl.org
> User Support Mailing List [email protected]
> Automated List Manager [email protected]
>
