0

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources).

We are used to generate CSR using RSA, but we can't find any documentation on how to do that with Elliptic Curve, specifically how to do the signing part. Studying OpenSSL-generated CSR it looks like there's multiple signatures generated, or a hash of some kind but we don't know. And OpenSSL source code is quite difficult to read when you're not used to.

Can anyone point us in the right direction?

Laurent PerrucheJ
  • 101
  • 1

2 Answers2

1

I think it's kinda same as RSA you're used to. Most of CAs such as Digicert already supported, just use the same openssl toolsets.

For examples in Digicert guideline:

To create key in EC:

openssl ecparam -out server.key -name prime256v1 -genkey

And create CSR as usual:

openssl req -new -key server.key -out server.csr -sha256
vdchuyen
  • 116
  • 1
  • Yes, we know how to do that using openssl. What we can't figure out is the format of the generated CSR, because we generate this without openssl (we're doing this inside a credit card chip, so very limited resources). The signature of the CSR looks very different than an RSA one, and basically we can't figure out what OpenSSL is signing with the key... – Laurent PerrucheJ Jul 24 '19 at 07:34
  • @LaurentPerrucheJ If you are interested in which cryptographic parameters are used, then perhaps [crypto.se] is a better place to ask. –  Jul 24 '19 at 07:41
  • Not sure really : we know how to encrypt/decrypt using ECC, our issue is with the CSR format and the specific data to encrypt to generate the signature. I'll try asking on the other side though, thanks. – Laurent PerrucheJ Jul 24 '19 at 07:46
  • Got your point, just because both are too different including keysize and signature algorithm and with your limited resource, you have to figure out your own implement based on existing one. AS MechMK recommend @cryptography is a good place to start. Good luck ! – vdchuyen Jul 24 '19 at 07:50
  • @LaurentPerrucheJ Do you mean that you are looking for the ASN.1 specification of an EC public/private key? – mat Jul 24 '19 at 09:08
0

The relevant ASN.1 definitions for ECC can be found here:

Community
  • 1
mat
  • 1,243
  • 7
  • 14