What is the difference between openssl functions - d2i_PublicKey & d2i_PUBKEY and what scenarios decide which should be used?

d2i_PublicKey was being used in the application which was returning a valid EVP_PKEY object until a specific testcase was found wherein it returned NULL. If the function call is changed to d2i_PUBKEY it returns a valid EVP_PKEY. But it is specific to this one testcase only and the rest of them work with the other function - d2i_PublicKey. It seems that some initial checking/processing needs to be done on the arguments before deciding which function to call. Has anyone faced similar issue before and could help with the relevant information or code?

Variant 1: EVP_PKEY_result_obj = d2i_PublicKey(keyType /*EVP_PKEY_RSA*/, nullptr, &publicKeyData, publicKey.size());
Variant 2: EVP_PKEY_result_obj = d2i_PUBKEY(nullptr, &publicKeyData, publicKey.size());

The 1.1.0 branch documentation [1] [2] states the following regarding these functions:

d2i_PrivateKey() decodes a private key using algorithm type. It attempts to use any key specific format or PKCS#8 unencrypted PrivateKeyInfo format. The type parameter should be a public key algorithm constant such as EVP_PKEY_RSA. An error occurs if the decoded key does not match type. d2i_PublicKey() does the same for public keys.

d2i_PUBKEY() and i2d_PUBKEY() decode and encode an EVP_PKEY structure using SubjectPublicKeyInfo format. They otherwise follow the conventions of other ASN.1 functions such as d2i_X509().

[1] https://www.openssl.org/docs/man1.1.0/man3/d2i_PublicKey.html

[2] https://www.openssl.org/docs/man1.1.0/man3/d2i_PUBKEY.html

It isn't clear how to interpret the above information to help understand the ongoing issue.

If there is any other information needed to further understand the issue, please let me know - I'll add it here.

  • $\begingroup$ This is not about cryptography, but programming with a particular library, and thus will probably be closed as offtopic. I think it would be suitable on security.SX but I suspect some may feel it needs StackOverflow. In any case, the doc saying d2i_PublicKey 'does the same' is misleading at best; it actually does only the algorithm-specific forms (d2i_{RSA,DSA,EC}PublicKey as applicable) not any algorithm-generic form, and definitely not PKCS8. Use it for algorithm-specific data and d2i_PUBKEY for algorithm-generic X.509 SPKI data. $\endgroup$ – dave_thompson_085 Jun 1 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.