piv-tool and EC

[jschlyter]

Greetings!

I'm trying to generate an EC key on a PIV card, but piv-tool reports This build of OpenSSL does not support EC keys. I know for sure my OpenSSL does support EC and I've tried using both the Fedora stock OpenSSL (3.1.1) as well as the latest(3.2.1).

$ piv-tool --admin M:9B:0C --genkey 9E:11 --out 9e.txt

Public-Key: (256 bit)
pub:
    04:44:85:ec:80:da:7b:0d:90:83:dc:69:28:97:99:
    3d:10:de:b3:e7:27:64:0e:fc:85:fb:88:5c:a8:3f:
    a2:48:3f:c9:3a:03:f5:bc:79:d6:76:da:4f:4c:40:
    84:7a:c2:3c:af:ba:f8:5f:29:49:99:dd:e4:ef:ab:
    ff:6e:02:7e:af
ASN1 OID: prime256v1
NIST CURVE: P-256
This build of OpenSSL does not support EC keys

Any hints how to get this working?

[dengert]

The OprnSC piv-tool was designed as a test tool in 2004 as PIV cards at that time left administration up to the card vendors. It has not been updated to support EC curves

You can use the PIV card vendor's tools.

The Yubico PIV Tool https://developers.yubico.com/yubico-piv-tool/ is used by many and is used in OpenSC github actions tests scripts.

[dengert]

Looks like missing #else I will submit PR this week.

@jschlyter are you able to build OpenSC with this patch?

diff --git a/src/tools/piv-tool.c b/src/tools/piv-tool.c
index 84e786b92..570785ef6 100644
--- a/src/tools/piv-tool.c
+++ b/src/tools/piv-tool.c
@@ -532,6 +532,7 @@ static int gen_key(const char * key_info)
                EVP_PKEY_CTX_free(ctx);
                OSSL_PARAM_free(params);
 #endif
+#else   /* OPENSSL_NO_EC */
                fprintf(stderr, "This build of OpenSSL does not support EC keys\n");
                r = 1;
 #endif /* OPENSSL_NO_EC */

[jschlyter]

Compile yes, but I have not tested generating a key yet (no spare cards right now).

[jschlyter]

For future reference this was fixed in #3041