Skip to main content
Cryptography

Return to Question

deleted 68 characters in body
Source Link
JBaczuk
JBaczuk
  • 201
  • 1
  • 6

I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.

I tried to get this information from openssl using the following:

# Generate a ECDH private key

# generate the key to pem format
openssl genpkey -algorithm X25519 -out x25519.pem

# print to screen as hex
openssl ec -in x25519.pem -noout -text

# Connect using the private key and log the traffic secrets and display handshake messages
openssl s_client -connect google.com:443 -tls1_3 -keylogfile keys.log -key x25519.pem -msg -msgfile messages.log -state -ciphersuites TLS_AES_128_GCM_SHA256 -debug -keymatexport key_material -trace -nocommands -tlsextdebug

I was able to get many of the secrets in the keylogfile, but I can't find the initial ephemeral secret used for ECDHE. I noticed that the public key from the -key I passed in does not match the key share in the handshakes, so I don't think it used my generated private key for ECDHE. I'm having trouble finding info on what that -key parameter is.

Is there a way to get openssl to log the ephemeral private key used for the initial ECDHE? Or is there a better way to generate test cases for TLS 1.3 key derivation?

I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.

I tried to get this information from openssl using the following:

# Generate a ECDH private key

# generate the key to pem format
openssl genpkey -algorithm X25519 -out x25519.pem

# print to screen as hex
openssl ec -in x25519.pem -noout -text

# Connect using the private key and log the traffic secrets and display handshake messages
openssl s_client -connect google.com:443 -tls1_3 -keylogfile keys.log -key x25519.pem -msg -msgfile messages.log -state -ciphersuites TLS_AES_128_GCM_SHA256 -debug -keymatexport key_material -trace -nocommands -tlsextdebug

I was able to get many of the secrets in the keylogfile, but I can't find the initial ephemeral secret used for ECDHE. I noticed that the public key from the -key I passed in does not match the key share in the handshakes, so I don't think it used my generated private key for ECDHE. I'm having trouble finding info on what that -key parameter is.

Is there a way to get openssl to log the ephemeral private key used for the initial ECDHE? Or is there a better way to generate test cases for TLS 1.3 key derivation?

I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.

I tried to get this information from openssl using the following:

# Generate a ECDH private key

# generate the key to pem format
openssl genpkey -algorithm X25519 -out x25519.pem

# Connect using the private key and log the traffic secrets and display handshake messages
openssl s_client -connect google.com:443 -tls1_3 -keylogfile keys.log -key x25519.pem -msg -msgfile messages.log -state -ciphersuites TLS_AES_128_GCM_SHA256 -debug -keymatexport key_material -trace -nocommands -tlsextdebug

I was able to get many of the secrets in the keylogfile, but I can't find the initial ephemeral secret used for ECDHE. I noticed that the public key from the -key I passed in does not match the key share in the handshakes, so I don't think it used my generated private key for ECDHE. I'm having trouble finding info on what that -key parameter is.

Is there a way to get openssl to log the ephemeral private key used for the initial ECDHE? Or is there a better way to generate test cases for TLS 1.3 key derivation?

Source Link
JBaczuk
JBaczuk
  • 201
  • 1
  • 6

How to create TLS 1.3 Key Derivation test cases

I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.

I tried to get this information from openssl using the following:

# Generate a ECDH private key

# generate the key to pem format
openssl genpkey -algorithm X25519 -out x25519.pem

# print to screen as hex
openssl ec -in x25519.pem -noout -text

# Connect using the private key and log the traffic secrets and display handshake messages
openssl s_client -connect google.com:443 -tls1_3 -keylogfile keys.log -key x25519.pem -msg -msgfile messages.log -state -ciphersuites TLS_AES_128_GCM_SHA256 -debug -keymatexport key_material -trace -nocommands -tlsextdebug

I was able to get many of the secrets in the keylogfile, but I can't find the initial ephemeral secret used for ECDHE. I noticed that the public key from the -key I passed in does not match the key share in the handshakes, so I don't think it used my generated private key for ECDHE. I'm having trouble finding info on what that -key parameter is.

Is there a way to get openssl to log the ephemeral private key used for the initial ECDHE? Or is there a better way to generate test cases for TLS 1.3 key derivation?