Describe the feature
The OpenSSL supports KEM operations on ECC keys. This does not exist on the PKCS#11 layer, but it might be possible to compose the operation somehow. Related to #667 which is RFE for the composed hybrid KEM methods.
Expected behavior
The pkeyutl provides simpley way to test the operation, which fails now.
But interestingly enough, the encapsulation works, but the decapsulation does not (unless I messed something up)
Test Encapsulation with public X25519 key imported from file
openssl pkeyutl -encap -pubin
-inkey ${TMPPDIR}/file.x25519.pub.key.pem
-secret ${TMPPDIR}/file.x25519.secret
-out ${TMPPDIR}/file.x25519.public
Test Decapsulation with private X25519 key imported from file
openssl pkeyutl -decap
-inkey ${TMPPDIR}/file.x25519.key.pem
-in ${TMPPDIR}/file.x25519.public
-secret ${TMPPDIR}/file.x25519.secret2
pkeyutl: Error initializing context
C0D206C3297F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:375:Global default library context, Algorithm (X25519 : 108), Properties (<null>)
C0D206C3297F0000:error:03000096:digital envelope routines:evp_kem_init:operation not supported for this keytype:crypto/evp/kem.c:114:
(this was tested with the default_properties = ?provider=pkcs11 in openssl.cnf
Describe the feature
The OpenSSL supports KEM operations on ECC keys. This does not exist on the PKCS#11 layer, but it might be possible to compose the operation somehow. Related to #667 which is RFE for the composed hybrid KEM methods.
Expected behavior
The pkeyutl provides simpley way to test the operation, which fails now.
But interestingly enough, the encapsulation works, but the decapsulation does not (unless I messed something up)
(this was tested with the
default_properties = ?provider=pkcs11in openssl.cnf