4

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority.

However, eventhough openssl supports AES 128 GCM, I cannot generate and encrypt a key using this encryption algorithm. OpenSSL reports error writing key. The AES 128/256 GCM both failed, however AES 128 CBC worked. What am I doing wrong? Do I need extra parameters when using GCM?

Here is the command:

$ openssl genpkey -out ca.key.pem -aes-128-gcm -algorithm rsa -pkeyopt rsa_keygen_bits:4096

The output is this:

.........................................................................+++
............................+++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Error writing key
:error:23077006:PKCS12 routines:PKCS12_pbe_crypt:EVP lib:p12_decr.c:96:
:error:2306C067:PKCS12 routines:PKCS12_item_i2d_encrypt:encrypt error:p12_decr.c:175:
:error:2307D067:PKCS12 routines:PKCS8_encrypt:encrypt error:p12_p8e.c:88:

Note: most online resources are out-dated (footnote-1) and using the superseded genrsa, or -nodes/-des flags. So I use those online resources as a basis, plus the (also quite outdated) man pages of openssl and the "-help" flag of the various openssl commands to create the above, IMHO up-to-date, command.

In the above command, I've tried to replace -aes-128-gcm with:

-aes-256-gcm
-aes-128-xts
-aes-256-xts

And all failed. The XTS ones failed with the following error:

:error:0D0A706C:asn1 encoding routines:PKCS5_pbe2_set_iv:cipher has no object identifier:p5_pbev2.c:103:
:error:2307D00D:PKCS12 routines:PKCS8_encrypt:ASN1 lib:p12_p8e.c:79:

Using:

-aes-128-cbc (like in an example in the man page from genpkey)
-aes128
-aes256

All worked fine.

Strangely all of the above ciphers are supported by the version of openssl I'm using.

$ openssl enc -help 2>&1 | grep aes | egrep "128|256"
-aes-128-cbc               -aes-128-cfb               -aes-128-cfb1
-aes-128-cfb8              -aes-128-ctr               -aes-128-ecb
-aes-128-gcm               -aes-128-ofb               -aes-128-xts
-aes-192-gcm               -aes-192-ofb               -aes-256-cbc
-aes-256-cfb               -aes-256-cfb1              -aes-256-cfb8
-aes-256-ctr               -aes-256-ecb               -aes-256-gcm
-aes-256-ofb               -aes-256-xts               -aes128
-aes192                    -aes256

Note: tested on Ubuntu 14.04.2, Debian 7.8 and CentOS 7. All exhibited the same behaviour.

footnote-1: If you google "openssl generate self signed root certificate", none of the 5 first results tells you to encrypt your root private certificate with something better than triple DES!?! One link of the 5 1st links advise for 4096 bit, whereas the other provide 2048 or 1024!?! Most do not provide any cipher flag, so the key is not encrypted. Actually, only the 7th link does a decent job at explaining what and how to do it.

Update 20161218: Tested again without success on Ubuntu 16.04 LTS with openssl 1.0.2g.

Improve this question
3
  • Is there any reason / attack that you particularly need an authentication tag to protect the private key?
    – Maarten Bodewes
    Mar 10, 2015 at 22:46
  • I was expecting such comment much earlier :-) I don't need to use GCM. Before I posted this message I already use the "working" method which is to use CBC, and I moved on. I'm far far from an expert in these cipher and mode algorithms. I only "know" CBC, GCM and XTS from configuring TLS for http server, configuring SSH daemon and encrypting disks. They have strengths and weaknesses which I don't know well. The reason for the question is that I was curious to try the GCM mode and puzzled that it did not work.
    – Huygens
    Mar 11, 2015 at 9:01
  • Reporting that it continues to not work in OpenSSL 1.0.2k $ openssl genpkey -algorithm RSA -out key.pem -aes-128-gcm -pass pass:<something> .......................................++++++ .............++++++ Error writing key 140050281797280:error:0D0A7072:asn1 encoding routines:PKCS5_pbe2_set_iv:error setting cipher params:p5_pbev2.c:131: 140050281797280:error:2307D00D:PKCS12 routines:PKCS8_encrypt:ASN1 lib:p12_p8e.c:86: $ openssl version OpenSSL 1.0.2k 26 Jan 2017
    – mud
    May 15, 2017 at 20:01

1 Answer 1

Reset to default
2

Updated Answer:

According to: https://groups.google.com/forum/#!msg/mailing.openssl.users/hGggWxfrZbA/unBfGlsfXyoJ the gcm support is currently broken in v1.0.1f (what Ubuntu currently uses). There should be patches out for Version v1.0.1.g which then should have a workable GCM mode. However, currently I would just stick with the CBC mode, as for key wrapping it is fully supported from openssl genrsa and openssl genpkey

Old Answer:

According to the docu: https://www.openssl.org/docs/apps/ciphers.html

AESGCM AES in Galois Counter Mode (GCM): these ciphersuites are only supported in TLS v1.2.

The changelog of openssl for ubuntu states for a prior version: openssl (1.0.1e-4ubuntu2) trusty; urgency=low * Re-enable full TLSv1.2 support (LP: #1257877) - debian/patches/tls12_workarounds.patch: disable patch to re-enable full TLSv1.2 support. Most problematic sites have been fixed now, and we really want proper TLSv1.2 support in an LTS. Currently I have installed 1.0.1f-1ubuntu9.1, so at least in theory it should work. But I can assure you, it does not. Maybe the modes are still considered broken, but I'm just assuming.

Improve this answer
7
  • I was not talking about the cipher suite for the TLS family, but about the encryption of private keys. As I showed, the command openssl enc -help provides the supported encryption method. openssl ciphers -tls1 would have provided me with the cipher suites. Anyway, thanks for passing by and trying to help.
    – Huygens
    Mar 9, 2015 at 21:00
  • 1
    OK, sorry then I misunderstood you. But basically I think the backend openssl genpkey uses to encrypt the key is not related to the supported ciphers from openssl enc. Basically openssl genrsa invokes the genpkey beforehand, but if you check there only aes-xxx-cbc is supported. If you want gcm can't you just use "openssl genrsa 4096 | openssl enc -aes-128-gcm -in - -out encrypted.ca.pem" or "openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:4096 | openssl enc -aes-128-gcm -in - -out encrypted.ca.pem"
    – evildead
    Mar 9, 2015 at 22:23
  • 1
    @Huygens In my comment version the decryption fails. According to: groups.google.com/forum/#!msg/mailing.openssl.users/hGggWxfrZbA/… the gcm support is broken even in the enc mode. It should be fixed for versions later then v1.0.1g, but as ubuntu still has v1.0.1f, I'm certain that the bug there still exists and creates our headaches.
    – evildead
    Mar 9, 2015 at 22:34
  • 2
    Late but: yes @Huygens privatekey encryption is different from enc. genpkey pkey pkcs8 use standard encryption defined by PKCS8 and PKCS12; this does not currently support any GCM or other AEAD cipher(s), but use an ASN.1 format which could. enc encryption is an ad-hoc OpenSSL format which does not and cannot support AEAD, although early 1.0.1 versions failed to give an error message (the 'fix' linked is to give the error message, not to implement GCM), but more importantly uses a poor PBKDF, namely a tweaked PBKDF1 with only one iteration. ...
    – dave_thompson_085
    May 16, 2017 at 5:03
  • 1
    ... The 'legacy' keyfile encryption in genrsa rsa uses this same poor PBKDF (EVP_BytesToKey). Worrying about CBC vs GCM in enc genrsa rsa is like worrying about smudged paint on your house while it is burning down. If you want want a privatekey encrypted with integrity protection, and have or can get or create a cert (including a throwaway dummy cert) use PKCS12; that PB-encrypts the key with CBC (or RC4, but don't use RC4!) and PB-MACs the entire file including the encrypted key (giving you encrypt-then-mac, as is preferred if you can't use AEAD).
    – dave_thompson_085
    May 16, 2017 at 5:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .