Getting message "too weak" when launching openssl server

[dimk1]

I have installed successfully the oqs-provider and have enabled both the default and the oqsprovider providers in the /etc/ssl/openssl.cnf file. I'm replicating the process as described in the USAGE.md. I first create certificates and keys via:

openssl req -x509 -new -newkey dilithium3 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -config /etc/ssl/openssl.cnf
openssl genpkey -algorithm dilithium3 -out dilithium3_srv.key
openssl req -new -newkey dilithium3 -keyout dilithium3_srv.key -out dilithium3_srv.csr -nodes -subj "/CN=test server" -config /etc/ssl/openssl.cnf
openssl x509 -req -in dilithium3_srv.csr -out dilithium3_srv.crt -CA dilithium3_CA.crt -CAkey dilithium3_CA.key -CAcreateserial -days 365

Then I try to launch the server via the provided command but I get the following error:

openssl s_server -cert dilithium3_srv.crt -key dilithium3_srv.key -www -tls1_3 -groups kyber768:frodo640shake
Using default temp DH parameters
error setting certificate
4077C88E967F0000:error:0A00018E:SSL routines:SSL_CTX_use_certificate:ca md too weak:../ssl/ssl_rsa.c:221:

Any idea?

[beldmit]

Please check you don't use sha1 in certificate signature by accident

[dimk1]

I would assume that since the commands I provided are identical to the ones provided in the documentation I wouldn't have this issue. Is there a way to check whether I use sha1 or force maybe sha2/3?

[baentsch]

Any idea?

"ca md too weak" also can be an indication of oqsprovider not being properly operating/registered. So please run openssl list -providers and openssl list -signature-algorithms to ascertain all PQ algs are properly enabled. Then also try to parse the cert using openssl x509... to see which (also MD) alg is encoded.

[bhoopesh369]

for me the provider is registered properly and all the algos are enabled. I also parsed it and the dilithium3 algo is encoded. and I get the same error that its too weak :(

[baentsch]

Please check the openssl version you use: 3.0 and 3.1 don't properly work for sigalgs.

[bhoopesh369]

So using openssl version 3.2 will solve this issue?

[baentsch]

So using openssl version 3.2 will solve this issue?

I'd think so. @dimk1: Did you try this? Did you also confirm the output as per my previous openssl list suggestions?

[dimk1]

Hello. No, I didn't try this yet, I'll check and let you know (in fact due to the initial mess-up with openssl I completely corrupted my pc and had to reinstall everything :()

On Sun, Apr 21, 2024 at 4:37 PM Michael Baentsch @.***> wrote:

So using openssl version 3.2 will solve this issue?

I'd think so. @dimk1 https://github.com/dimk1: Did you try this? Did you also confirm the output as per my previous openssl list suggestions?

— Reply to this email directly, view it on GitHub https://github.com/open-quantum-safe/oqs-provider/issues/360#issuecomment-2068046696, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF6VUXK3RQS2J4S7NDXIPDTY6O6JNAVCNFSM6AAAAABEAEJHNKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANRYGA2DMNRZGY . You are receiving this because you were mentioned.Message ID: @.***>

[baentsch]

due to the initial mess-up with openssl I completely corrupted my pc

Sorry to hear that. Would you recommend we state more clearly that users should not update their local openssl installations but use the build scripts and the local openssl install this creates?

[dimk1]

Hi Michael,

indeed, I think this would have helped from the very beginning to avoid misconceptions and possible corruption. I'm going to test the process again in a virtual machine and report back.

On Mon, Apr 22, 2024 at 12:57 PM Michael Baentsch @.***> wrote:

due to the initial mess-up with openssl I completely corrupted my pc

Sorry to hear that. Would you recommend we state more clearly that users should not update their local openssl installations but use the build scripts and the local openssl install this creates?

— Reply to this email directly, view it on GitHub https://github.com/open-quantum-safe/oqs-provider/issues/360#issuecomment-2068978899, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF6VUXNGVXU42OQFZEVA4MLY6TNITAVCNFSM6AAAAABEAEJHNKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANRYHE3TQOBZHE . You are receiving this because you were mentioned.Message ID: @.***>

[baentsch]

@dimk1 any updates from your side? Or OK to close as #402 added warning as per discussion above?

[dimk1]

Yes, please close it.

On Sat, 25 May 2024, 11:25 Michael Baentsch, @.***> wrote:

@dimk1 https://github.com/dimk1 any updates from your side? Or OK to close as #402 https://github.com/open-quantum-safe/oqs-provider/pull/402 added warning as per discussion above?

— Reply to this email directly, view it on GitHub https://github.com/open-quantum-safe/oqs-provider/issues/360#issuecomment-2131156738, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF6VUXMFMKEUSLZ3UUYAUB3ZEBKHPAVCNFSM6AAAAABEAEJHNKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZRGE2TMNZTHA . You are receiving this because you were mentioned.Message ID: @.***>