0

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources).

We are used to generate CSR using RSA, but we can't find any documentation on how to do that with Elliptic Curve, specifically how to do the signing part. Studying OpenSSL-generated CSR it looks like there's multiple signatures generated, or a hash of some kind but we don't know. And OpenSSL source code is quite difficult to read when you're not used to.

Can anyone point us in the right direction?

Improve this question

2 Answers 2

Reset to default
1

I think it's kinda same as RSA you're used to. Most of CAs such as Digicert already supported, just use the same openssl toolsets.

For examples in Digicert guideline:

To create key in EC:

openssl ecparam -out server.key -name prime256v1 -genkey

And create CSR as usual:

openssl req -new -key server.key -out server.csr -sha256
Improve this answer
5
  • Yes, we know how to do that using openssl. What we can't figure out is the format of the generated CSR, because we generate this without openssl (we're doing this inside a credit card chip, so very limited resources). The signature of the CSR looks very different than an RSA one, and basically we can't figure out what OpenSSL is signing with the key...
    – Laurent PerrucheJ
    Commented Jul 24, 2019 at 7:34
  • @LaurentPerrucheJ If you are interested in which cryptographic parameters are used, then perhaps Cryptography is a better place to ask.
    – user163495
    Commented Jul 24, 2019 at 7:41
  • Not sure really : we know how to encrypt/decrypt using ECC, our issue is with the CSR format and the specific data to encrypt to generate the signature. I'll try asking on the other side though, thanks.
    – Laurent PerrucheJ
    Commented Jul 24, 2019 at 7:46
  • Got your point, just because both are too different including keysize and signature algorithm and with your limited resource, you have to figure out your own implement based on existing one. AS MechMK recommend @cryptography is a good place to start. Good luck !
    – vdchuyen
    Commented Jul 24, 2019 at 7:50
  • @LaurentPerrucheJ Do you mean that you are looking for the ASN.1 specification of an EC public/private key?
    – mat
    Commented Jul 24, 2019 at 9:08
0

The relevant ASN.1 definitions for ECC can be found here:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .