Error initiating server

[T-449]

Hello,

I was trying to initate a server using the commands in the oqs repo. But this is the error I get.

The error is the same when i want to sign messages.

Also there is an error when i try to initiate client, but it could also be because the server hasn't started yet

Can you please help me resolve these?

[Martyrshot]

Hey there, what version of OpenSSL are you using?

In order to have pq digital signatures oqs-provider requires versions >= 3.2.x.

As for the frodo issue, what is the output of openssl list -kem-algorithms -provider oqsprovider?

[baentsch]

Adding to the suggestions by @Martyrshot , please review the discussion board as well as the bug reporting template as those most likely contain hints and/or even answers to your questions, @T-449 .

[T-449]

I am using OpenSSL 3.2.2. and the output is

(oqs) heresy@heresy:~$ openssl list -kem-algorithms -provider oqsprovider
{ 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
{ 1.2.840.10045.2.1, EC, id-ecPublicKey } @ default
{ 1.3.101.110, X25519 } @ default
{ 1.3.101.111, X448 } @ default
frodo640aes @ oqsprovider
p256_frodo640aes @ oqsprovider
x25519_frodo640aes @ oqsprovider
frodo640shake @ oqsprovider
p256_frodo640shake @ oqsprovider
x25519_frodo640shake @ oqsprovider
frodo976aes @ oqsprovider
p384_frodo976aes @ oqsprovider
x448_frodo976aes @ oqsprovider
frodo976shake @ oqsprovider
p384_frodo976shake @ oqsprovider
x448_frodo976shake @ oqsprovider
frodo1344aes @ oqsprovider
p521_frodo1344aes @ oqsprovider
frodo1344shake @ oqsprovider
p521_frodo1344shake @ oqsprovider
kyber512 @ oqsprovider
p256_kyber512 @ oqsprovider
x25519_kyber512 @ oqsprovider
kyber768 @ oqsprovider
p384_kyber768 @ oqsprovider
x448_kyber768 @ oqsprovider
x25519_kyber768 @ oqsprovider
p256_kyber768 @ oqsprovider
kyber1024 @ oqsprovider
p521_kyber1024 @ oqsprovider
mlkem512 @ oqsprovider
p256_mlkem512 @ oqsprovider
x25519_mlkem512 @ oqsprovider
mlkem768 @ oqsprovider
p384_mlkem768 @ oqsprovider
x448_mlkem768 @ oqsprovider
x25519_mlkem768 @ oqsprovider
p256_mlkem768 @ oqsprovider
mlkem1024 @ oqsprovider
p521_mlkem1024 @ oqsprovider
p384_mlkem1024 @ oqsprovider
bikel1 @ oqsprovider
p256_bikel1 @ oqsprovider
x25519_bikel1 @ oqsprovider
bikel3 @ oqsprovider
p384_bikel3 @ oqsprovider
x448_bikel3 @ oqsprovider
bikel5 @ oqsprovider
p521_bikel5 @ oqsprovider
hqc128 @ oqsprovider
p256_hqc128 @ oqsprovider
x25519_hqc128 @ oqsprovider
hqc192 @ oqsprovider
p384_hqc192 @ oqsprovider
x448_hqc192 @ oqsprovider
hqc256 @ oqsprovider
p521_hqc256 @ oqsprovider

[baentsch]

Thanks for that reconfirmation @T-449 . In that list call you did pass "-provider oqsprovider" -- but you didn't do so in the s_client call in your original post: Intentional? Without oqsprovider active, the error message would be expected..

[T-449]

I was just following the command as provided in the USAGE.md of the repo. So I ran the server with the -provider flag and this is what I get

[baentsch]

I was just following the command as provided in the USAGE.md of the repo.

Not really: The command above documents use of sudo: This is not suggested or recommended anywhere in the documentation for the simple reason that it changes completely the config setup. In addition, the command line above cannot work and is not recommended in USAGE.md for use with the s_client app as it doesn't activate the default provider required for TLS ops.

All in all, this is incorrect use of the system. I'd recommend you work with any of the pre-built docker images with oqsprovider correctly configured. If you want to use your own build, I'd suggest reading up on OpenSSL configuration, starting e.g., here. Moving issue to discussion.