Error while verifying PQ signed xml document

[umairsafdar768]

I am trying to test PQ signing and verification for my xml document. Here is the xml doc I am trying to sign:

<domain_access_rules>
    <domain_rule>
        <domains>
          <id>0</id>
        </domains>
        <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
        <enable_join_access_control>true</enable_join_access_control>
        <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
        <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
        <rtps_protection_kind>SIGN</rtps_protection_kind>
        <topic_access_rules>
            <topic_rule>
                <topic_expression>*</topic_expression>
                <enable_discovery_protection>true</enable_discovery_protection>
                <enable_liveliness_protection>true</enable_liveliness_protection>
                <enable_read_access_control>true</enable_read_access_control>
                <enable_write_access_control>true</enable_write_access_control>
                <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
                <data_protection_kind>ENCRYPT</data_protection_kind>
            </topic_rule>
        </topic_access_rules>
    </domain_rule>
</domain_access_rules>

I created a Dilithium 2 CA private key and certificate as follows:

openssl genpkey -algorithm Dilithium2 -out ca.key.pem
openssl req -x509 -new -key ../private/ca.key.pem -out ca.cert.pem

Then I signed the above doc (named governance.xml) using this command:
openssl cms -in governance.xml -sign -signer ../public/ca.cert.pem -inkey ../private/ca.key.pem -outform smime -out governance.p7s -md sha256 -text

Now when I try to verify this signed doc using the following command:
openssl cms -verify -CAfile ../public/ca.cert.pem -inform smime -in governance.p7s -crlfeol -out outputfile
I get the below error:

Error reading SMIME Content Info
40873270267F0000:error:0680006E:asn1 encoding routines:b64_read_asn1:decode error:../crypto/asn1/asn_mime.c:146:
40873270267F0000:error:068000CC:asn1 encoding routines:SMIME_read_ASN1_ex:asn1 sig parse error:../crypto/asn1/asn_mime.c:467:

If I try all these steps with a non-PQ CA (RSA or ECDSA), then the verification command succeeds with the below output:

CMS Verification successful

I am not an expert of openssl or oqs project, just trying out the oqs provider for a personal project, and would appreciate any information or help to resolve/understand the above mentioned errors.

[baentsch]

To exclude openssl usage errors, can you please try to utilize exactly the commands documented here and check whether the problem persists? Also, to exclude errors in your build of the software, please use those commands within the pre-build oqs-provider docker image and let us know whether the problem persists. If so, please file an issue with all information requested.

[umairsafdar768]

Upgrading to openssl version 3.2.0 fixed the problem for me. Was using openssl v 3.0.2 previously, and cms functionality was not supported with external providers for that version link