0
$\begingroup$

Client-Server Example

apps/openssl req -x509 -new -newkey ec:<(apps/openssl ecparam -name secp384r1) -keyout ecdsa_CA.key -out ecdsa_CA.crt -nodes -subj "/CN=oqstest" -days 365 -config apps/openssl.cnf

apps/openssl req -new -newkey falcon512 -keyout falcon512_srv.key -out falcon512_srv.csr -nodes -subj "/CN=oqstest server" -config apps/openssl.cnf

apps/openssl x509 -req -in falcon512_srv.csr -out falcon512_srv.crt -CA ecdsa_CA.crt -CAkey ecdsa_CA.key -CAcreateserial -days 365

SPAWN SERVER: apps/openssl s_server -cert falcon512.crt -key falcon512.key -www -tls1_3

CLIENT CONNECT: apps/openssl s_client -groups hqc128 -CAfile _CA.crt

After the server and client complete the TLS handshake, is there an option that let's me dump the hqc128 public key from the client?

reference: https://github.com/open-quantum-safe/openssl

Improve this question
$\endgroup$
6
  • $\begingroup$ Have you tried the various debug arguments for OpenSSL? This is not on topic here, it's probably more at home at Super User, but I won't migrate there if you haven't even browsed the man pages. $\endgroup$
    – Maarten Bodewes ♦
    Commented Sep 14, 2022 at 21:51
  • $\begingroup$ I have brosed man pages for s_client and s_server commands. It seems -msg, -debug, and -state give a hex dump of all protocols messages. For example, for TLSv1.3, we know the client public key is part of client hello message, and we can see the hex dump of the encoded client hello running with the -msg or -debug command options. I guess, I'm wondering if there is any other way to view explicitly dump the client public key bytes, besides doing a printf from the openssl code. $\endgroup$
    – user15651
    Commented Sep 14, 2022 at 22:58
  • $\begingroup$ Also, is there any other command that will do that; not quite sure. $\endgroup$
    – user15651
    Commented Sep 14, 2022 at 22:59
  • $\begingroup$ @MaartenBodewes I've checked the superuser, however, they don't have post-quantum tag... $\endgroup$
    – kelalaka
    Commented Sep 14, 2022 at 23:13
  • 1
    $\begingroup$ I haven't looked at this variant, but in mainstream openssl if you ./configure with the nondefault option enable-ssl-trace, then s_client and s_server gain a -trace option that dumps each message with fields labelled and where possible decoded. But concur that isn't a cryptography question. $\endgroup$
    – dave_thompson_085
    Commented Sep 15, 2022 at 2:48

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.