Windows openssl gost engine

GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.

engine / INSTALL.md

Building and Installation

To build and install OpenSSL GOST Engine, you will need

OpenSSL 3.0 development version
an ANSI C compiler
CMake (3.0 or newer)

Here is a quick build guide:

Instead of Release you can use Debug , RelWithDebInfo or MinSizeRel configuration. See cmake docs for details. You will find built binaries in ../bin directory.

If you want to build against a specific OpenSSL instance (you will need it if you have more than one OpenSSL instance for example), you can use the cmake variable OPENSSL_ROOT_DIR to specify absolute path of the desirable OpenSSL instance:

If you use Visual Studio, you can also set CMAKE_INSTALL_PREFIX variable to set install path, like this:

Also instead of cmake —build tool you can just open gost-engine.sln in Visual Studio, select configuration and call Build Solution manually.

Instructions how to build OpenSSL 1.1.0 with Microsoft Visual Studio you can find there.

To install GOST Engine you can call:

or old plain and Unix only:

The engine library gost.so should be installed into OpenSSL engine directory.

To ensure that it is installed propery call:

Then check that gost.so there

Finally, to start using GOST Engine through OpenSSL, you should edit openssl.cnf configuration file as specified below.

The very minimal example of the configuration file is provided in this distribution and named example.conf .

Configuration file should include following statement in the global section, i.e. before first bracketed section header (see config(5) for details)

where openssl_def is name of the section in configuration file which describes global defaults.

This section should contain following statement:

which points to the section which describes list of the engines to be loaded. This section should contain:

And section which describes configuration of the engine should contain

Various cryptoproviders (e.g. BouncyCastle) has some problems with private key parsing from PrivateKeyInfo, so if you want to use old private key representation format, which supported by BC, you will have to add:

Where engine_id parameter specifies name of engine (should be gost ).

dynamic_path is a location of the loadable shared library implementing the engine. If the engine is compiled statically or is located in the OpenSSL engines directory, this line can be omitted.

default_algorithms parameter specifies that all algorithms, provided by engine, should be used.

The CRYPT_PARAMS parameter is engine-specific. It allows the user to choose between different parameter sets of symmetric cipher algorithm. RFC 4357 specifies several parameters for the GOST 28147-89 algorithm, but OpenSSL doesn’t provide user interface to choose one when encrypting. So use engine configuration parameter instead. It SHOULD NOT be used nowadays because all the parameters except the default one are deprecated now.

Value of this parameter can be either short name, defined in OpenSSL obj_dat.h header file or numeric representation of OID, defined in RFC 4357.

Источник