KeyType identification in PHP

[Muzosh]

Hello,

after some struggles, I managed to include this forked version of OpenSSL to builded PHP, so I can use openssl_X functions. Basic non-PQC functionality seems to work and I'm slowly exploring using PQC functionality.

This issue/question is about the openssl_pkey_new function with the following options:

As you can see, private_key_type is integer and it corresponds do defined constants of RSA=0, DSA=1, DH=2, and EC=3. Is this definition from PHP only or does OpenSSL also distinguish these numbers? If it is from OpenSSL, can I pass other integers that identify Dilithium for example?

[baentsch]

Is this definition from PHP only or does OpenSSL also distinguish these numbers?

To the contrary, these definitions most likely are inherited/introduced to PHP from OpenSSL. This is most likely due to the historic strong focus on (exclusively) these algorithm types in OpenSSL1.1.1.

OpenSSL has changed (away from) this over the last couple of years with the introduction of providers.

I'd personally thus very much suggest you consider the use of OpenSSLv3 when looking at integrating PQ into PHP. All PQ algs are available via OpenSSLv3 via oqs-provider --- without any PQ-specific changes to OpenSSL. A PR adding PHP to our PQ-integrations in oqs-demos would be most welcome --- if at all necessary: Maybe all you need to do is run PHP with OpenSSLv3 and activate oqs-provider via an entry in openssl.cnf.

[Muzosh]

Thank you for a quick response. I also found a possible troubleshooting place in PHP extension for OpenSSL. EDIT: I see that they are using some openssl/evp.h library for these operations, so I guess you are correct that these constants come from OpenSSL :)

Nevertheless, I will first try the V3 with oqs-provider!

[baentsch]

Nevertheless, I will first try the V3 with oqs-provider!

Please let us know how this goes. BTW and FWIW, here's an openssl.cnf that might help along.

[Muzosh]

So I managed to build oqs-provider, activate it in OpenSSLv3 and build a PHP with this new library (there were significantly less problems than with the OQS-OpenSSLv1 library).

However, the openssl_XXX PHP functions are still not usable. It is due to the OpenSSL PHP extension I linked earlier (which is shipped with vanilla PHP source code).

First of all, the enum that is available to PHP developers is hardcoded to 4 non-PQC algorithms: https://github.com/php/php-src/blob/bb97ae7c24ade60bc993d39463dabcee78b5c577/ext/openssl/openssl.c#L104-L117

Second, those 4 algos are also hardcoded when choosing, which private key to obtain: https://github.com/php/php-src/blob/bb97ae7c24ade60bc993d39463dabcee78b5c577/ext/openssl/openssl.c#L4462-L4498

It might be in my interest to expand/modify this PHP extension with undefined/non-hardcoded/PQC algorithms -> thus allowing PHP developers to use OpenSSL with PQC support on the server-side. If doing so, I will create a PR for oqs-demos.