Closed Supermathie closed 2 years ago
I am able to decrypt both of those files with both LibreSSL 3.5.0 (in development) and OpenSSL 1.1.1l:
$ eopenssl11 version
OpenSSL 1.1.1l 24 Aug 2021
$ eopenssl11 smime -decrypt -recip test.crt -inkey test.key < testsecret-libressl.enc
hello world
$ openssl version
LibreSSL 3.5.0
$ openssl smime -decrypt -recip test.crt -inkey test.key < testsecret-libressl.enc
hello world
Note that the -recip
option is given to specify the certificate, otherwise it will result in the error you gave:
$ openssl smime -decrypt -inkey test.key < testsecret-libressl.enc
Error decrypting PKCS#7 structure
16157693055912:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/usr/src/lib/libcrypto/evp/evp_enc.c:549:
$ eopenssl11 smime -decrypt -inkey test.key < testsecret-libressl.enc
Error decrypting PKCS#7 structure
0:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:610:
I'm not aware of that changing between versions though.
I'm going to close this due to there being no further follow up.
We've discovered that LibreSSL isn't properly generating SMIME files. Specifically:
Note that in these commands below,
openssl
is 1.1.1l (on Arch) andlibressl-openssl
is 3.4.1 (on the same Arch system):I don't know what exactly is going wrong, but it's happening on multiple computers.
This was first discovered on a co-worker's OS X system using the stock LibreSSL 2.8.3 - he was generating files that others could not decrypt. Upon investigation we found:
My demonstration files are:
test.key.gz (demo RSA key) test.crt.gz (public portion) testsecret-libressl.enc.gz (encrypted file generated by libressl) testsecret-openssl.enc.gz (encrypted file generated by openssl)
These files were generated on the Arch system mentioned above with: