After Setup and Run Facing Issue: No OpenSSL randomness retrieved. DRBG available? #582

tareqraihan926 · 2024-12-03T07:19:29Z

tareqraihan926
Dec 3, 2024

Can you Please look my issue that i am facing after setup oqs-provider openssl. Check the terminal results from the attached...

baentsch · 2024-12-03T07:44:15Z

baentsch
Dec 3, 2024
Maintainer

FAQ. Search Discussions for drbg.

0 replies

tareqraihan926 · 2024-12-03T08:35:30Z

tareqraihan926
Dec 3, 2024
Author

Hi Sir,

Can you please clarify one more issue that i am facing? i am following test by the OQS Test usage manual. Like made cert by:

openssl req -x509 -new -newkey dilithium3 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -config openssl/apps/openssl.cnf
openssl genpkey -algorithm dilithium3 -out dilithium3_srv.key
openssl req -new -newkey dilithium3 -keyout dilithium3_srv.key -out dilithium3_srv.csr -nodes -subj "/CN=test server" -config openssl/apps/openssl.cnf
openssl x509 -req -in dilithium3_srv.csr -out dilithium3_srv.crt -CA dilithium3_CA.crt -CAkey dilithium3_CA.key -CAcreateserial -days 365

but when i was try to test face issue and can't figure out:

0 replies

baentsch · 2024-12-03T09:09:58Z

baentsch
Dec 3, 2024
Maintainer

(most likely) another FAQ (openssl version too old): Search "md too weak" in Discussions.

0 replies

tareqraihan926 · 2024-12-03T10:31:36Z

tareqraihan926
Dec 3, 2024
Author

Hi Thanks past two issue resolved by following the instructions. now used openssl version 3.4.0 latest. i created certs again as per following:

openssl req -x509 -new -newkey dilithium3 -keyout dilithium3_CA.key -out dilithium3_CA.crt -nodes -subj "/CN=test CA" -days 365 -config openssl/apps/openssl.cnf
openssl genpkey -algorithm dilithium3 -out dilithium3_srv.key
openssl req -new -newkey dilithium3 -keyout dilithium3_srv.key -out dilithium3_srv.csr -nodes -subj "/CN=test server" -config openssl/apps/openssl.cnf
openssl x509 -req -in dilithium3_srv.csr -out dilithium3_srv.crt -CA dilithium3_CA.crt -CAkey dilithium3_CA.key -CAcreateserial -days 365

so when i try to load now using latest openssl also. check the new issue:

Using default temp DH parameters
error setting certificate
40C22C2DD87A0000:error:0A0000F7:SSL routines:ssl_set_cert:unknown certificate type:ssl/ssl_rsa.c:257:

7 replies

tareqraihan926 Dec 4, 2024
Author

I understand your suggestions. its works fine into docker image but still confuse what is the issue on dedicated system whenever i matched the version and setup. I am adding deatils about setup and config with versions for your short looking if you can suggest anything. Thank you for your co-operation on that matter.

The latest oqs-provider i cloned: https://github.com/open-quantum-safe/oqs-provider.git
OS Type and Version: Ubuntu 22.04.5 LTS
Openssl Version: 3.4.0(Latest)
is there any issue on the selected versions?

i am also added openssl.cnf file for review if i forget anything in setup. i confused on which point i missed actually.
openssl.cnf (https://drive.google.com/file/d/1oZ9x2PPsjfxL6W_l1D5zh-uZaBi_wFqG/view?usp=sharing )

also scripts/runtests.sh this was shows 100% test passed.

baentsch Dec 4, 2024
Maintainer

The runtests.sh script sets up the environment correctly, so that working OK is expected. The error message you get is very clearly indicating that oqsprovider is not active at that time, but I don't see an obvious error from the (pretty big) distance. Have you tried using OPENSSL_CONF and OPENSSL_MODULES as per runtests.sh? Please also compare exactly your local setup and the one in our docker image.

tareqraihan926 Dec 8, 2024
Author

Hi Sir, now all ok and perfectly integrated into system and works locally, i attached the result for your finall review. Thank you for your incredible support and guidance.

after cert creation then run the server shows below:

Handshaking from another terminal result:

root@tareq-virtual-machine:/home/tareq/Desktop/PQC/new/oqs-provider-main/cert# openssl s_client -groups frodo640shake
Connecting to ::1
CONNECTED(00000003)
depth=0 CN=test server
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=test server
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN=test server
verify return:1
---
Certificate chain
 0 s:CN=test server
   i:CN=test CA
   a:PKEY: UNDEF, 192 (bit); sigalg: dilithium3
   v:NotBefore: Dec  8 10:01:15 2024 GMT; NotAfter: Dec  8 10:01:15 2025 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIVZzCCCHKgAwIBAgIUYi1dHauEA8Yo8kWJvgrosDIlGQ4wDQYLKwYBBAECggsH
BgUwEjEQMA4GA1UEAwwHdGVzdCBDQTAeFw0yNDEyMDgxMDAxMTVaFw0yNTEyMDgx
MDAxMTVaMBYxFDASBgNVBAMMC3Rlc3Qgc2VydmVyMIIHtDANBgsrBgEEAQKCCwcG
BQOCB6EAEtZ4IqwOGpv7CUUYLGDg3EnPw5Mg0N3QhcOmpqmvf+DmxuKMebskK1LD
At8JRIZEQWAqHdVrFvRVwHwtepom78njYP+CWJ3uUlyqoJgZXcAgLlj2kpcyq6n9
1hNRHHTOR7l1XEozycCyoenJpxstEcWQfCuqWRxx0MjIEszJo+05dd58PTLjmISl
jnh+S66qYD+suNZdY2Gt08ui/TGivjLr/i7k1QespKk2nUW/Qf2MH0zZTAEBwAUy
ItPj/ck8TNH1/CsfTFwPKvrsvJ5+vUJM4TIqLyusDfRW/6TKLyFNkXeu0xmAjHg4
f7VIQxPxJKoOB8qscwbm25Pc0kpaDo02H7H8OgJSueiSD80Jea5rkL4lSLdo3gYb
aQ3zChja/KYyM2jZUh/RGXDrEvxmA236a7mBM9ZgTEZLVuy8nn3NX/Aurr+zwv2w
J/NAOQjB8ZPgh7Ju7yQ3/bd2Fe0i1iTod4s7cW0KseAHADnvDghImUOClaK9fvpR
JMK8iLDYXDI+uPgbR9NgxMqMMBpSo5c1y6PfnRKaOqEBoulU3CLFm8Ab0KCMb2mz
XX/8cSyEHtM8h6P45E4Qt1jUWRHdt9IOo1flTSwZRDH1Zkekqops75lLRHbBjDHf
/c0gNjIOtkT4HqUKPbedEVGi5o8bM/tU/iZdZMYy1awIS7VD4YSzrupqX9wv6ZZN
iepQEDTnWZoalNm5r8FfJDKmCdei58ICrzBhtyms5xujPESkTJS59TaKcl/buIme
3qwSbihMhbLhfMfwkwpGmE9QKpD5XASAeMW9DesCkO6oXQtrbGQidEgPa4+5cCtZ
VNO23vSXeXGVDk7dC29MCEcXHMDJlKmLPMQjEf6cUkj4UGGCFqoClC/zqPoalwkF
HzcG3NaPCk0cS8Re0w7IFYwbqoz/U8PzZFlj8n5D4LBoVhREDFKElaPG/Erwn2Xc
vHdiLagz8DoWXKXBjo5M4zNTG41RaV4q77YNTL8sFN73N3K9P35ZJDot0QgrsY22
uDZuPFQI9vUWtn42/31Lcweg+DslHW/PnejLVbX5CdCS0VyWYYgumr88NHYF4xkF
pJZcSI4zaYUxFsc9HQIttyd1yIVNISbVL1EKFdYPuAxM05YofrCL8MdHD7ll1GdY
/Ox1S/tuqy09aGgjGYlKhW0g/jgCsplAmoD20dfK8835KCbO0WRgvkwTyVpIrr+L
W0tzm/vJGOrqHh1FBsHoo/Bqx1ZRGs9+L+OrPpH7Slk/bRIfaj2J98rQcj+1VRQ4
7eo7e/hPLENcq0l0ajjGiiy65Hl/k+z1336SmMmrKRWkhhsc3iA823pdZdJ74amD
gf8UCk0zo/2RB/qnJmnYmceKmHBzhtfrVfIp8DSMVfTVI1O1uZvzA9qroP2dkSBz
atHcqfwC5l86cBwy1tyBPjhanAsp013dk49FYbcJgW52oCcmwGkzx54G7pIfm4+F
1HwhgR2/vLZca88IYltsxDu1LHM1Ois4fP2cuGEuByHpv7tstKrWWG8tSJe3XijG
YV06QrWRCs2OpE3xerCaYPi3lSVPj1XMUSkkhu8E9sodXZhToek1H0X0nv5OCKe/
rjFR8yVWIlCBo8xzrLL9fzSPG4L9YNYjke33M7QrI36awJYFrQSCoHOBgkMciYbh
/YfRhEOevmliw+vWaFGPGICOAqc/LNJtvmmSVLjIfIh1Dih+OffoAK7PdbOyeh1R
1gtyhHA+RiWVD580yRNsBAfopK+pa2rgK4JGsPv7be9fNYIGL0huEvUD8oj+ym2M
4bWqcHVWFZQAsHpEF4Bpu2wmkuE4GFvAIfnLSqPlKO7i+CB9UK6uOfLO98j7PqkE
KfsnripM+qHbwVuhqRbzO5s6pXJE3Ejfrp4ZRT2lC9KAJwLGvvjEYevZR9Np4lKL
I+wG7mpHGQJBWaRMrQ0bUnO7n5lf/vOi0VGl+tpRQEXQhZrzYeZnTBdJbR3YpQ/s
T5ZxXKs61a5pcV+yKUd4zxgZ3GuxgR5oQ285u7tIp23MQEo9BHU1jpbvzHr0/mN9
SJpJJjb+UzfCs4W8Y78zL5aoVYakXCrEkIH5O09+cG6BDfazeeVZPY9B6mKdt0qa
Zot5xZPqV3sKcIz7gMFfKF+TPCrCYsnLNAN3cagFyauIQZYfMy/ud/Zr0Mol/rJn
3jU2x4t7WAj7/n3N+YvUL9BtPiZFRB1ckDSqEMgt9GuGYcagwyBJrlUqrSxMXYCO
DksDtVEXVIpiPQuN/GHrACsOcBDXrDwqzdpozQRxXv5wquR3xNCvpuqKuOmw3HOO
3Hi8t3kpS7UL2voBVlcY45/Xaop8gaQCXeCRzOOx1pzx7NBN/FSACGXtZgptC6HQ
1trt4TGwK/HTyjQ+P4ttv8XKJlSoFs99CrKHateMgtPtEhd9wS/fu8ctx/MoQNpn
yzgeR4Xumdc33bLqXfIR6ZCsNuf5bR1/aDC005Lfqc0yMG5deghalGKT9bY+nzyz
0cAJqTWJ5/VDQpi0/Vf6RFqffVI7WQoHPUmENU5Xfzavob1qkRZoJP29x3DeabVx
exOG+0+tjoTPDnNdLqEep/USI8hHgmgND+9cQ4nboXL8j97KYTWjQjBAMB0GA1Ud
DgQWBBT9ts/BT85sCQqEjrELN+RTeMe6nDAfBgNVHSMEGDAWgBQNVOi9inEOzc0G
oXcpGeB5wzqsMDANBgsrBgEEAQKCCwcGBQOCDN4AEkLB1SzAizJhrltmZwabFsm0
7QYfVbP5IgAaLILAI//yleL1VfoIyKABYYTpDQ1ym8DTmzWRsVBKfgUT30JE7f8r
aWtO/EosdNgPdRVD4HzZCKoafGjE17yF8HFBpLWzRlcJXv82B9dNvDnS+K6JDadR
uRyqlq1YcBlBhoxedjr/U6JC7ejPiN+vinh/uB1hp+4ZGdeIKUROWSsrlT8y7f+M
PJT26tCdsd4jBNC6tToQKs6pPfh2etPzqt/gRMdjeo8lTSTho7mfpuy2y2tPHEgb
UJGG2eZElnABlHb6SaM8gFX8STHTgetHpGP4XI9EcPYCQ8mJNSEckSghE1T48c4r
+PY48zxfMZvfFpbK8dS8P/M8z0JZkgVRSJcUbP3OC/Fg65EfjpcZkXRfFG4WoM3m
nakyu93t5TubxlnEUytudFdM0zBp3A7Yxa4Jm/gCq/SYUvb3JB0L+0NLjMeC2YVM
I5xAOdJUPkbFbhgv8gFbcDF1xXp9yD3Odqik9KbXg2ZnVgGC4MmWKQobelLZaKUi
zzC3zTG4ByEx1iPE72iz/xx19DqzN5PTTyc2OSE3q9JMPKlUSpMadIT1BT4tXjmg
e0tUXtaolm6CxTS2LQWM41THXudsDJ6nB1IgvA9chfzpgqKiXCYiuxPrPTzFzWyx
MelyOfIrdfoBm1FuGGdPQFftS1LGHHHXBlxKTn2/5Plfqmuk/QjOKk3RbfZL5Y/a
N/FbOQWtQjVszCs9GE+acsWrnDcrwNLOZ+O+7O/DZHx0fAdgQ8XBNXLrbBlJVif/
2WZ+rHqj9UyMaA8q1v4+gSDzlS2xV1RWlywsPke1TLotD1s5CzTtWmB18sLLMLdO
PGcXmRJ28fD8gVtzetGSdxnTFLWD+dFzLlNdKLEKbr51FO+sDNfemh1HkHCjlzEi
07K1hAyjtconPzYcXCNjEm+Imemszbgyh565+yjU96GJGreUE/OGRN/Bqw0qKtJv
ndIo8GvVJhQlGMB6VQerSg1fLmwBXcoS8HJLgZ7NuybP0A8b35sL7ovmmwuN5Q+Y
hbqPyFH+deYEEcX0jgwoLrYlA6I9VTeC1xq0sHHozBvgUOyAFLuuEujsmV3+xLh5
kF1V5x4Hds0wZN60aaEBqQ32Ks2l2qvWqQ/OCZ4BSrp4KC+v/oUDBZcAgtb42L+4
pxwl7TbWCzKCb6ELR3x2m3jnFpLazPCuHqn4KJW4k5K/FOw3x+avw4BmkjyWfPyu
q6MAfLTpW0p9t6hoPu71moHz0vjoFIz/0VAcDGUXDhC84nPmeAjSlyDaA5ekWraa
cD4rmZKINCfDOgzNrYaGBnM3JxISAE5IY3Y2zYjJdDmg+9ZFZc4a3QsNbZcVfRQG
fALGwDlcFRaHOU2VBWVJGWHv9Kb5Gqwe+w0iL51zsJHef2hio2HsFQ1OUklL9aSw
Lw/xfvkMANyeX2eME1L4FZFt0xck/oVhWNdCW9fll1ZUN7+xnpsmXRFHI/yajRXL
Yc/u1yf8r69YSad6MFH9U4GLmCdasMGxf60sSD1R1PEnEEOdmlhPVi+S7UbY/Ikj
0YGnh9UbJ7qEvH9xmS2i73WkNkcPB1xuN98eL4r35gbFwGofEbkEjGEmu09dZzVi
7+wnByAqhX5qdVvJ6o3w+1JR2Iz33glBUq2kBY8fdLM5C39Ej6FJQI3yTrU54i76
G3j1ioMK/mOHFkvPhRXGcJNotoSI6l/KaMNHKNJVIy7DJ1GVTXFv52SBMMUFKvPX
9eNW2iacinK7+MsTkx1Cb1F9jOViaDcBL0ul16VX7Rw+yWIf5ybNC8MU0nlPdjMS
E3RmMSv7FITK9OJbYmjlBO0a73QFfROVFeBGD0VJ3FYOV/0/gPS4iJsfqP4FGHHk
akNutV28mPncRx4v8o1l/fYwGETw0Tez2JRbNckrm5rwzgQskpVuCZXl+QkkX88y
IDOrkHTXyuAmBd1UWRNDjZifoLjmDANcZ2PlzNqx3+DChZ3zLDQ7rCO5sXUNbbCT
AOD/8xobYEuwWnQKbvJURpBR1lmGk7PUVN0XjNvMZR+MapzqKHGBe7w9fTYUl0vp
NpVwdh6UxYQGlxLyzF/oIsgRWNPpDcXquQTTdIQ+pfq01D31ORAaS/KDIrVhMTM9
dybv+s2bLXNkVuM0gW2VHvM5q1DirqA3AVoLqcxTEUAVxnG6FaTH6JWMnUh5LuMB
Bexcwb7Yc5LR6V9fEQEZKLvsOMW7hXYKWGaYufjsGmslexJL6JJq03zGTF18Lv6U
4lNLxTj/yKcOSs/Pg8Xbusqs6TN7QkpumK+oEIpDex+CzSCBIqOkJe8729WqyxHO
XIfW8xwTXC8myeSJoR6Z7BfNyoyZu+AgB1UlARp/eaqjYVxowQYYuh89dkRUKNZu
Aw6LCRJorfpD2d+jDYZDWKPVRbIE+bxMefiM7HRI+d2s/35Mu5BVklL2RgCGBwh4
P3FZTUBH+S20du1dxgYFLvrb9SGuPJVXJqLwu3vMnVN6SGjB6nNOCjgYLKtuaR1n
mXe/m/QRtTyOydDf+4vxI3pFc7y+GQMFUgXu1TabwEOPk4oTYBKRgBuCG462irIj
hfBDSSlmTjhsipoGyLH8mjdJfjRBOY2d9h47umbPs28pzW/I/xQB2p12lrRAaE9f
zNuLu3lhBxQSGgG/NLFKKqsHU+tAD5wI3dQYiW/p53WSLGbBGgnPb7WA11WowfIe
mxLtn3FPbr4hALaj1GctC5MNFLyIbDjSTAZx3EBO/wSLxCVjsIvQIKEbqpNV+NJc
8gJUcxeqWFsKAeHGyw+Amn5g1w7UX9Y5RB0hotDsshCIDZtxa6c1YQJmfOXel43X
GsPo3diH1OMD5sIl5sJWnBbqxFNmmAZGrPACGoWg0ZanQ6Vn3ONytlgZZBP8izuF
zSgCgL/MWUoUOOYxssGt+2C1NFD2YEgifG10gCZDrSccGLW9yqAgb1/8Sd7o82ZN
O2MbgdW3dTcr7B6dJt1GRh2yWOz9zQvzBxqA982nRXO9c0ar6/MhOpYQJmTcXZw8
CmmrE2bIopqE9Q/KEiJ6gYRUz3M6X4c6PLtaxrr26Af7zw5Or6hjuUJjcRpXqTzc
Bsi5g8/ESvTIqMEeubC+/Eu76K2UhZSewe0lEgcEAmijA52xt3lj9pPPaYS6iDLM
9LbSF14i8AZbjXbhqeWEDA6AdgsIm+5uVMmS6DI2DoGRt6t0dV1CLajXLWsUbnKq
DSU1sb0tqteyr9prywhdI+dkboHcoAoGgZzNMJqFqV5VYdW3XOsuJ8K8sdFClsv2
HP2wdV094OuhZKR5SX4Z9Cb9bRRAb52y7WZexbOYK5RQ/no7Z7WXSIkmQECkHsD+
2Q1S/CzdiCYxIWfaILUqDeRT25ZMBTv2It2Ypx6ZNXB4R2J+ZW6O39dQFuCG4uvS
nem58ySTndHJyOvNXIcoNe8SEniq2ckiabI0TOlhmoQpTeaHup8hweJqHuxKnevW
0QkML/wxLoX1AXFvPfUIpo/DI+QyKwgt4uXeFwlPXfAOpt8/YPmlLl63Cjy3/Lhh
Tw6DRs8kr2F0vYp79Z0BJ24OKJ8M2l3+J26iKt8oGTOf422iZg5tjrf4OapJ3wgX
r+WEONILR0c6hJD5yDwALtvy1SZldhQfDMEBFx1I2dWFKuUnr3+pxGJcJUGHtFi0
qzB+C73Pci03KsjZU9WJjy9yGgA1uwJh1SRSHD+9UEwUJCwiIqa8/Sj3/iX6slVy
93XUYumEKk+iXM5jQL1qkYtBFdq5eJsww5SLSvn8JliZYqqSNu5q+Dbbbyj8Dhi4
fChSxXSNuiXbIR/rcP490W6InVw1ko3TKXcv3ox4T+8hT9oLAkKwugKiGxFmjCBQ
84ly6BxqBR/6ygsqyhdK11svpLDdkH5GarqYRjddymeyoDiCK6dOcLIB0+MpiQXY
5FJnwZWs2w5ZNyEpf/Xxs0HMcWx+wskxxbiCB81iEj1fWPwdTMAi1KaTHGYk9Qqj
+vhHWZeav/r8H0DZj8i62LnuAaY8vzGtyD4waTJn70jBmcSB8uA4jl7bI/CGnpD6
D6hnN3C1JSlZjWfPUxuHbdeAgqkerSRka/Jucfkz+LBO6WxfSHgh5sIYI/vfHo0L
Wa6wDN1LeP2W7dspNiNDlA/4rfwPIGU0hOqYhwFx4Y66gUr97+6r3q4wy0ZGt/Mh
+lptb4nQLg48y2LtflLZAUUkYm/14oj27fATX5yiPhEgNF1I8aTTvatf0NluUdhD
YTgcmHXdg73eKXFv4YLrm+7C3JZzMUkeI/CVLrxtS4qKVa0SjjXXwQjvXv0abwUM
DhklR2hqa3bV6/E5RICFi6XM1utkzuj3T1loy/cjdHmGyN7xCx8nXGFytdQAAAAA
AAAAAAANFhofJi4=
-----END CERTIFICATE-----
subject=CN=test server
issuer=CN=test CA
---
No client certificate CA names sent
Peer signature type: dilithium3
---
SSL handshake has read 18774 bytes and written 10079 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 192 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: DC0A4F2BAD2063FA73BE7E99D139443401B0B9DE42F8B167CDBAD70BCCDA66FF
    Session-ID-ctx: 
    Resumption PSK: 8062B21E8C3663FEE72A2ECCE48CB63C5EC5B1B071315A2B0C7200C015FC8DFC33B7FD6F656500B44B12EA9DFD965D9D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 5d 82 9c 21 8b 19 a6 59-68 5c c7 4b 1f ad 71 1d   ]..!...Yh\.K..q.
    0010 - 49 3c b8 33 5d 35 df 73-0a 1a ff d6 39 b5 fe ac   I<.3]5.s....9...
    0020 - ff 40 57 e0 e6 f2 dc d7-b2 1d f6 b5 fc 73 63 5e   [email protected]^
    0030 - 09 e4 51 c9 05 4c 03 4d-b4 98 07 95 e7 c7 e3 49   ..Q..L.M.......I
    0040 - fe ab 17 6d f3 bc 7d f7-3e bc 90 d2 c4 b1 ca 5c   ...m..}.>......\
    0050 - b7 06 00 bc dc 21 22 1b-dd 37 85 62 86 75 2f 9b   .....!"..7.b.u/.
    0060 - dd c4 06 49 a9 f0 11 5e-53 49 98 db dd 4f b9 26   ...I...^SI...O.&
    0070 - b3 73 2d dc 83 c0 e3 d9-f8 91 ac 47 c6 5d f5 da   .s-........G.]..
    0080 - fc e9 4f 91 6f fb 06 d0-c1 be 7e b5 2b 4e 8c 61   ..O.o.....~.+N.a
    0090 - df 5a 58 a2 f9 42 d3 55-7b 6a 8d 78 a2 d5 a1 e9   .ZX..B.U{j.x....
    00a0 - 1f 2d cf d1 c2 f3 e9 3b-c2 10 ef 7d 78 1f c5 64   .-.....;...}x..d
    00b0 - 31 28 b1 a7 65 b3 60 3e-c3 5b c3 ca 79 48 a1 82   1(..e.`>.[..yH..
    00c0 - 2f af 6b 1d df 6b da 65-9e 2f 1c 36 7f 4d 0c 41   /.k..k.e./.6.M.A

    Start Time: 1733652626
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 037187C904101AFC6F396CB290A7CC67690E992E679449374CB4ED204602BF98
    Session-ID-ctx: 
    Resumption PSK: 71B12C2B5D03A22283813AB1166C2D7DE81708C530B04ED03F1FFE5F3845FE82C4B7ADEA7ED68CAE90D17C3FC50D1AC2
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 5d 82 9c 21 8b 19 a6 59-68 5c c7 4b 1f ad 71 1d   ]..!...Yh\.K..q.
    0010 - 2b 56 3e fe c7 e1 b3 ef-e5 e5 b6 79 2d a5 2c 41   +V>........y-.,A
    0020 - 4f 27 9d 7b ea 02 ed 7f-38 19 ef 68 36 d3 e9 a8   O'.{....8..h6...
    0030 - af 17 e3 a8 23 36 f5 f5-b1 42 3c ce 3f bd 20 7e   ....#6...B<.?. ~
    0040 - de bb 5d b6 e2 51 4b b0-2d 50 c3 94 b1 f5 19 b8   ..]..QK.-P......
    0050 - 8b cc c7 dc fe 27 54 75-b0 29 85 83 ce 5c 5c e0   .....'Tu.)...\\.
    0060 - 09 e2 5b 5a bd 33 28 c6-d1 c7 e3 d1 d5 eb c9 8d   ..[Z.3(.........
    0070 - 21 18 b9 ba a2 4f 47 09-ad 4d 03 bc 33 2b 0f 74   !....OG..M..3+.t
    0080 - 6a bc 65 76 3c 2b c9 f2-7c de 46 90 1c a3 8f b1   j.ev<+..|.F.....
    0090 - 6c bb 93 bc 05 4f 68 5f-08 99 f1 8d f2 4d 95 28   l....Oh_.....M.(
    00a0 - d1 de f1 ee 54 ab 34 99-a5 ca bd 74 de f4 f2 b0   ....T.4....t....
    00b0 - 37 df 78 58 26 1c ae 4e-55 ff 44 ba 6d a9 5a 3c   7.xX&..NU.D.m.Z<
    00c0 - 4e 9d 07 e1 08 d9 96 0d-c2 fc 90 9b 24 de 4f 6d   N...........$.Om

    Start Time: 1733652626
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

baentsch Dec 8, 2024
Maintainer

LTGM. Thanks for letting me know, @tareqraihan926 . Would you want to share what the actual problem (and solution) was so that future readers can avoid the same problem and/or we can improve the documentation?

tareqraihan926 Dec 11, 2024
Author

Hi Sir, It was a version mismatch i think and you also mentioned about versions for ubuntu, openssl etc.
By Match them then some steps did,

After install Openssl into a Target Directory then update the environment variables. I think this section got a error in past for me cause past openssl not fully cleaned up thats why librray conflict happened on time OQS integration into openssl. CLeaned up all then, on new setup updated System Environment Variables.

Also PKG_CONFIG_PATH=/usr/local/ssl/lib64/pkgconfig:$PKG_CONFIG_PATH into Environment added.

and then its cool. Make perfectly and integrated Globally without specified OQS-Provider, System Automatically detect and shows result for oqs-openssl modules also openssl default.

export LD_LIBRARY_PATH=/usr/local/ssl/lib64:$LD_LIBRARY_PATH
export PATH=/usr/local/ssl/bin:$PATH
export PKG_CONFIG_PATH=/usr/local/ssl/lib64/pkgconfig:/usr/local/ssl/lib64/pkgconfig:
export OPENSSL_MODULES=/usr/local/ssl/lib64/ossl-modules

These 4 section added on oqs-provider openssl setup. One more thing i noticed that when i did setup oqs-provder make and also openssl by this setup, temporarily high system RAM its used for processing. Almost 14-16 GB was required for complete the setup i dont know why much but below RAM its Crashed multiple times.

tareqraihan926 · 2024-12-16T20:33:42Z

tareqraihan926
Dec 16, 2024
Author

Hi @baentsch Sir,
Hope you are well. I have a New query about Key Exchange algorithm by OQS into Openssl. Check the result for clarify:

root@tareq-virtual-machine:/home/tareq/Documents/PQC/hostap_2_11_Office/hostapd# openssl list -kem-algorithms | grep -i kyber
   kyber512 @ oqsprovider
   p256_kyber512 @ oqsprovider
   x25519_kyber512 @ oqsprovider
   kyber768 @ oqsprovider
   p384_kyber768 @ oqsprovider
   x448_kyber768 @ oqsprovider
   x25519_kyber768 @ oqsprovider
   p256_kyber768 @ oqsprovider
   kyber1024 @ oqsprovider
   p521_kyber1024 @ oqsprovider
 root@tareq-virtual-machine:/home/tareq/Documents/PQC/hostap_2_11_Office/hostapd# openssl list -public-key-algorithms | grep -i kyber
   Name: kyber512
     IDs: kyber512 @ oqsprovider
   Name: p256_kyber512
     IDs: p256_kyber512 @ oqsprovider
   Name: x25519_kyber512
     IDs: x25519_kyber512 @ oqsprovider
   Name: kyber768
     IDs: kyber768 @ oqsprovider
   Name: p384_kyber768
     IDs: p384_kyber768 @ oqsprovider
   Name: x448_kyber768
     IDs: x448_kyber768 @ oqsprovider
   Name: x25519_kyber768
     IDs: x25519_kyber768 @ oqsprovider
   Name: p256_kyber768
     IDs: p256_kyber768 @ oqsprovider
   Name: kyber1024
     IDs: kyber1024 @ oqsprovider
   Name: p521_kyber1024
     IDs: p521_kyber1024 @ oqsprovider
 root@tareq-virtual-machine:/home/tareq/Documents/PQC/hostap_2_11_Office/hostapd# openssl list -key-exchange-algorithms
   { 1.2.840.113549.1.3.1, DH, dhKeyAgreement } @ default
   { 1.3.101.110, X25519 } @ default
   { 1.3.101.111, X448 } @ default
   ECDH @ default
   TLS1-PRF @ default
   HKDF @ default
   { 1.3.6.1.4.1.11591.4.11, id-scrypt, SCRYPT } @ default
 root@tareq-virtual-machine:/home/tareq/Documents/PQC/hostap_2_11_Office/hostapd#

Here you can see Three command result. after integrate oqs with openssl then One is Public-key-algorithm list section by openssl. it shows Kyber or oqs key exchange algorithms in the list correctly. Another command like Kem-algorithms also verify the listing. But the last command like Key-exchange-algorithms not shows the list about kyber or other oqs key exchange algorithms. So in that case , when a system verify or authenticate via a key exchange then it maybe find from key-exchange-algorithms but if i want them for kyber then it wont find. so why its into another list group? is it possible to add them into openssl key-exchange-algorithms group beside kem-algorithm section?? because openssl shows only Deffie Helman/ECDH key exchange into the list.

Eagerly waiting for the Response. Thank you.

2 replies

tareqraihan926 Dec 17, 2024
Author

@baentsch can you let me know sir about this?

baentsch Dec 17, 2024
Maintainer

Please read up on the differences between KEX's and KEM's.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

After Setup and Run Facing Issue: No OpenSSL randomness retrieved. DRBG available? #582

{{title}}

Replies: 5 comments 9 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

After Setup and Run Facing Issue: No OpenSSL randomness retrieved. DRBG available? #582

tareqraihan926 Dec 3, 2024

Replies: 5 comments · 9 replies

baentsch Dec 3, 2024 Maintainer

tareqraihan926 Dec 3, 2024 Author

baentsch Dec 3, 2024 Maintainer

tareqraihan926 Dec 3, 2024 Author

tareqraihan926 Dec 4, 2024 Author

baentsch Dec 4, 2024 Maintainer

tareqraihan926 Dec 8, 2024 Author

baentsch Dec 8, 2024 Maintainer

tareqraihan926 Dec 11, 2024 Author

tareqraihan926 Dec 16, 2024 Author

tareqraihan926 Dec 17, 2024 Author

baentsch Dec 17, 2024 Maintainer

tareqraihan926
Dec 3, 2024

Replies: 5 comments 9 replies

baentsch
Dec 3, 2024
Maintainer

tareqraihan926
Dec 3, 2024
Author

baentsch
Dec 3, 2024
Maintainer

tareqraihan926
Dec 3, 2024
Author

tareqraihan926 Dec 4, 2024
Author

baentsch Dec 4, 2024
Maintainer

tareqraihan926 Dec 8, 2024
Author

baentsch Dec 8, 2024
Maintainer

tareqraihan926 Dec 11, 2024
Author

tareqraihan926
Dec 16, 2024
Author

tareqraihan926 Dec 17, 2024
Author

baentsch Dec 17, 2024
Maintainer