Merge pull request #500 from Yu-Ma28051503/x9146-wolfssl-command

X9.146 migrate from openssl command to wolfssl command

Author: dgarske

X9.146/README.md

@@ -36,6 +36,16 @@ sudo make install
 sudo ldconfig # required on some targets
 ```
 
+And need to setup wolfCLU:
+
+```sh
+./autogen.sh  # Cloned from GitHub
+./configure
+make
+sudo make install
+sudo ldconfig # required on some targets
+```
+
 In the directory where this README.md file is found, clean up previous build
 products and certificates and then build the applications.
 
@@ -78,33 +88,45 @@ wolfSSL Leaving DoTls13CertificateVerify, return 0
 Generate the various conventional keys; the post-quantum key are pre-generated:
 
 ```sh
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -out ca-key.der -outform der
+# CA
+wolfssl genkey ecc -name secp256r1 -out ca-key -outform pem -output keypair
 
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -out server-key.der -outform der
+wolfssl pkey -in ca-key.priv -inform pem -out ca-key.der -outform der
+
+wolfssl pkey -pubin -in ca-key.pub -inform pem -pubout -out ca-pubkey.der -outform der
+
+mv ca-key.priv ca-key.pem
+
+# Server
+wolfssl genkey ecc -name secp256r1 -out server-key -outform pem -output keypair
+
+wolfssl pkey -in server-key.priv -inform pem -out server-key.der -outform der
+
+wolfssl pkey -in server-key.priv -inform pem -pubout -out server-pubkey.der -outform der
 ```
 
 Generate the certificate chain:
 
-```
+```sh
 ./gen_ecdsa_mldsa_dual_keysig_root_cert 2
 
 ./gen_ecdsa_mldsa_dual_keysig_server_cert 2
 ```
 
 Convert the DER encoded resulting certificates and keys into PEM:
 
-```
-openssl x509  -in ca-cert-pq.der -inform der -out ca-P256-mldsa44-cert.pem -outform pem
+```sh
+wolfssl x509 -in ca-cert-pq.der -inform der -out ca-P256-mldsa44-cert.pem -outform pem
 
-openssl x509  -in server-cert-pq.der -inform der -out server-P256-mldsa44-cert.pem -outform pem
+wolfssl x509 -in server-cert-pq.der -inform der -out server-P256-mldsa44-cert.pem -outform pem
 
-openssl pkey  -in server-key.der -inform der -out server-P256-key.pem -outform pem
+mv server-key.priv server-P256-key.pem
 
 cp ../certs/mldsa44_server_key.pem server-mldsa44-key-pq.pem
 ```
 Then in wolfssl's source directory:
 
-```
+```sh
 examples/server/server -d -v 4 -c ../wolfssl-examples/X9.146/server-P256-mldsa44-cert.pem -k ../wolfssl-examples/X9.146/server-P256-key.pem --altPrivKey ../wolfssl-examples/X9.146/server-mldsa44-key-pq.pem
 
 examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P256-mldsa44-cert.pem
@@ -114,34 +136,46 @@ examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P256-mldsa44-cert.p
 Generate the various conventional keys; the post-quantum key are pre-generated:
 
 ```sh
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-384 -out ca-key.der -outform der
+# CA
+wolfssl genkey ecc -name secp384r1 -out ca-key -outform pem -output keypair
+
+wolfssl pkey -in ca-key.priv -inform pem -out ca-key.der -outform der
+
+wolfssl pkey -pubin -in ca-key.pub -inform pem -pubout -out ca-pubkey.der -outform der
+
+mv ca-key.priv ca-key.pem
 
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-384 -out server-key.der -outform der
+# Server
+wolfssl genkey ecc -name secp384r1 -out server-key -outform pem -output keypair
+
+wolfssl pkey -in server-key.priv -inform pem -out server-key.der -outform der
+
+wolfssl pkey -in server-key.priv -inform pem -pubout -out server-pubkey.der -outform der
 ```
 
 Generate the certificate chain:
 
-```
+```sh
 ./gen_ecdsa_mldsa_dual_keysig_root_cert 3
 
 ./gen_ecdsa_mldsa_dual_keysig_server_cert 3
 ```
 
 Convert the DER encoded resulting certificates and keys into PEM:
 
-```
-openssl x509  -in ca-cert-pq.der -inform der -out ca-P384-mldsa65-cert.pem -outform pem
+```sh
+wolfssl x509 -in ca-cert-pq.der -inform der -out ca-P384-mldsa65-cert.pem -outform pem
 
-openssl x509  -in server-cert-pq.der -inform der -out server-P384-mldsa65-cert.pem -outform pem
+wolfssl x509  -in server-cert-pq.der -inform der -out server-P384-mldsa65-cert.pem -outform pem
 
-openssl pkey  -in server-key.der -inform der -out server-P384-key.pem -outform pem
+mv server-key.priv server-P384-key.pem
 
 cp ../certs/mldsa65_server_key.pem server-mldsa65-key-pq.pem
 ```
 
 Then in wolfssl's source directory:
 
-```
+```sh
 examples/server/server -d -v 4 -c ../wolfssl-examples/X9.146/server-P384-mldsa65-cert.pem -k ../wolfssl-examples/X9.146/server-P384-key.pem --altPrivKey ../wolfssl-examples/X9.146/server-mldsa65-key-pq.pem
 
 examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P384-mldsa65-cert.pem
@@ -151,35 +185,46 @@ examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P384-mldsa65-cert.p
 Generate the various conventional keys; the post-quantum key are pre-generated:
 
 ```sh
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-521 -out ca-key.der -outform der
+# CA
+wolfssl genkey ecc -name secp521r1 -out ca-key -outform pem -output priv
 
-openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-521 -out server-key.der -outform der
-```
+wolfssl pkey -in ca-key.priv -inform pem -out ca-key.der -outform der
 
-Generate the certificate chain:
+wolfssl pkey -in ca-key.priv -inform pem -pubout -out ca-pubkey.der -outform der
+
+mv ca-key.priv ca-key.pem
 
+# Server
+wolfssl genkey ecc -name secp521r1 -out server-key -outform pem -output priv
+
+wolfssl pkey -in server-key.priv -inform pem -out server-key.der -outform der
+
+wolfssl pkey -in server-key.priv -inform pem -pubout -out server-pubkey.der -outform der
 ```
 
+Generate the certificate chain:
+
+```sh
 ./gen_ecdsa_mldsa_dual_keysig_root_cert 5
 
 ./gen_ecdsa_mldsa_dual_keysig_server_cert 5
 ```
 
 Convert the DER encoded resulting certificates and keys into PEM:
 
-```
-openssl x509  -in ca-cert-pq.der -inform der -out ca-P521-mldsa87-cert.pem -outform pem
+```sh
+wolfssl x509 -in ca-cert-pq.der -inform der -out ca-P521-mldsa87-cert.pem -outform pem
 
-openssl x509  -in server-cert-pq.der -inform der -out server-P521-mldsa87-cert.pem -outform pem
+wolfssl x509  -in server-cert-pq.der -inform der -out server-P521-mldsa87-cert.pem -outform pem
 
-openssl pkey  -in server-key.der -inform der -out server-P521-key.pem -outform pem
+mv server-key.priv server-P521-key.pem
 
 cp ../certs/mldsa87_server_key.pem server-mldsa87-key-pq.pem
 ```
 
 Then in wolfssl's source directory:
 
-```
+```sh
 examples/server/server -d -v 4 -c ../wolfssl-examples/X9.146/server-P521-mldsa87-cert.pem -k ../wolfssl-examples/X9.146/server-P521-key.pem --altPrivKey ../wolfssl-examples/X9.146/server-mldsa87-key-pq.pem
 
 examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P521-mldsa87-cert.pem
@@ -191,34 +236,39 @@ examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-P521-mldsa87-cert.p
 Generate the various conventional keys; the post-quantum key are pre-generated:
 
 ```sh
-openssl genpkey -algorithm rsa  -pkeyopt rsa_keygen_bits:3072 -out ca-key.der -outform der
+# CA
+wolfssl -genkey rsa -size 3072 -out ca-key -outform der -output priv
 
-openssl genpkey -algorithm rsa  -pkeyopt rsa_keygen_bits:3072 -out server-key.der -outform der
-```
+mv ca-key.priv ca-key.der
 
-Generate the certificate chain:
+# Server
+wolfssl -genkey rsa -size 3072 -out server-key -outform der -output priv
 
+mv server-key.priv server-key.der
 ```
 
+Generate the certificate chain:
+
+```sh
 ./gen_rsa_mldsa_dual_keysig_root_cert
 
 ./gen_rsa_mldsa_dual_keysig_server_cert
 ```
 
 Convert the DER encoded resulting certificates and keys into PEM:
 
-```
-openssl x509  -in ca-cert-pq.der -inform der -out ca-rsa3072-mldsa44-cert.pem -outform pem
+```sh
+wolfssl x509 -in ca-cert-pq.der -inform der -out ca-rsa3072-mldsa44-cert.pem -outform pem
 
-openssl x509  -in server-cert-pq.der -inform der -out server-rsa3072-mldsa44-cert.pem -outform pem
+wolfssl x509  -in server-cert-pq.der -inform der -out server-rsa3072-mldsa44-cert.pem -outform pem
 
-openssl pkey  -in server-key.der -inform der -out server-rsa3072-key.pem -outform pem
+wolfssl pkey  -in server-key.der -inform der -out server-rsa3072-key.pem -outform pem
 
 cp ../certs/mldsa44_server_key.pem server-mldsa44-key-pq.pem
 ```
 Then in wolfssl's source directory:
 
-```
+```sh
 examples/server/server -d -v 4 -c ../wolfssl-examples/X9.146/server-rsa3072-mldsa44-cert.pem -k ../wolfssl-examples/X9.146/server-rsa3072-key.pem --altPrivKey ../wolfssl-examples/X9.146/server-mldsa44-key-pq.pem
 
 examples/client/client -v 4 -A ../wolfssl-examples/X9.146/ca-rsa3072-mldsa44-cert.pem
@@ -249,15 +299,15 @@ openssl pkey -in alt-server-key.der -inform der -pubout -out alt-server-pub-key.
 
 Generate the certificate chain:
 
-```
+```sh
 ./gen_dual_keysig_root_cert
 
 ./gen_dual_keysig_server_cert
 ```
 
 Convert the DER encoded resulting certificates and keys into PEM:
 
-```
+```sh
 openssl x509  -in ./ca-cert.der -inform der -out ca-cert.pem -outform pem
 
 openssl x509  -in ./server-cert.der -inform der -out server-cert.pem -outform pem