How to generate and store any PKey using command line?

[baentsch]

Is there an OpenSSL command (line utility) to generate any PKey (implemented in any provider, i.e., not only classic keys like RSA or EC) and store/persist/encode both private and public part into a file?

For the private key, the command genpkey works perfectly. But how to do the same for the public part? I tried via req -new but this fails if the PKey doesn't represent a key of a signature algorithm (but a KEM). Also pkey doesn't work if the public key cannot be computed from the private key.

[t8m]

I do not think there is a command line tool capable of this.

The genpkey command should be enhanced with -pubout option being added to output the public key.

[t8m]

I've created a RFE issue in #22132

[levitte]

The command for further processing of keys, openssl pkey, is the tool to extract / construct the public key from a private key.

$ openssl pkey -in test/certs/key-pass-12345.pem -text
Enter pass phrase for test/certs/key-pass-12345.pem:
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC/RCj1YL8EoDvQ
...
YqgLSMA70QAkZnqQT83Abp1C
-----END PRIVATE KEY-----
Private-Key: (2048 bit, 2 primes)
modulus:
    00:bf:44:28:f5:60:bf:04:a0:3b:d0:bb:50:25:dc:
...
$ openssl pkey -in test/certs/key-pass-12345.pem -pubout
Enter pass phrase for test/certs/key-pass-12345.pem:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv0Qo9WC/BKA70LtQJdwV
GSXqr9dut3cQmiFzTb/SaWldjOT1sRNDFxSzdTJjU/8cIDEZvaTIwRxP/dtVQLjc
+4jzrUwz93NuZYlsEWUEUg4Lrnfs0Nz50yHk4rJhVxWjb8Ii/wRBViWHFExP7CwT
kXiTclC1bCqTuWkjxF3thTfTsttRyY7qNkz2JpNx0guD8v4otQoYjA5AEZvK4IXL
wOwxol5xBTMvIrvvff2kkh+c7OC2QVbUTow/oppjqIKCx2maNHCtLFTJELf3fwtR
JLJsy4fKGP0/6kpZc8Sp88WK4B4FauF9IV1CmoAJUC1vJxhagHIKfVtFjUWs8GPo
bQIDAQAB
-----END PUBLIC KEY-----

[levitte]

... and we're back to the recurring debate on generating the public key on demand...

[baentsch]

we're back to the recurring debate on generating the public key on demand...

I don't think so: Don't we just need a way to store the public key at the same moment the private key (i.e., the key pair) is generated, exactly #22132 ?

[levitte]

Look, I'm not opposed to have an option to store the public key separately, if it can't be generated from the private key. I was just indicating that there is a general tool, in case you missed it.

Side note: this might also indicate that we should consider implementing RFC 5958 - Asymmetric Key Packages, which is basically PKCS#8 with the possibility to also store the public key. There's already some work done on this, that we have forgotten for a while. See issue #10468 and PR #13942.

[baentsch]

there is a general tool, in case you missed it.

Thanks for the pointer -- I (think I) didn't miss it: It just didn't help in our case of algorithms not able to generate public keys from private keys (unless I misunderstood what "pkey" can do?).

Side note: this might also indicate that we should consider implementing RFC 5958 - Asymmetric Key Packages, which is basically PKCS#8 with the possibility to also store the public key. There's already some work done on this, that we have forgotten for a while. See issue #10468 and PR #13942.

Thanks for those pointers -- as this is really triggered by open-quantum-safe/oqs-provider#194 continuing the work on this may be very sensible indeed. What do you think @beldmit @Muzosh @ralienpp @rajeev-0 ?

That said, I think I'll do a PR to just resolve #22132 first along the lines discussed (change of documentation, introduction of two new options).

[beldmit]

@baentsch #13942 looks relatively alive. It worked for me for GOST keys but I didn't meet any other keys in this format yet.

[beldmit]

@baentsch I pushed the updated version of #13942 - could you please tell me if it's enough on the API level?