Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running SCEP client to enroll certificates on NDES server. If OpenSSL is not in FIPS mode - everything works fine.

In FIPS mode i get the following error:

pkcs7_unwrap():pkcs7.c:708] error decrypting inner PKCS#7
139968442623728:error:060A60A3:digital envelope routines:FIPS_CIPHERINIT:disabled for fips:fips_enc.c:142:
139968442623728:error:21072077:PKCS7 routines:PKCS7_decrypt:decrypt error:pk7_smime.c:557:

That's because NDES server uses DES algorithm to encrypt returned PKCS#7 packet. I used the following debug code:

/* Copy enveloped data from PKCS#7 */
    bytes = BIO_read(pkcs7bio, buffer, sizeof(buffer));
    BIO_write(outbio, buffer, bytes);

    p7enc = d2i_PKCS7_bio(outbio, NULL);

/* Get encryption  PKCS#7 algorithm */

    enc_alg=p7enc->d.enveloped->enc_data->algorithm;
    evp_cipher=EVP_get_cipherbyobj(enc_alg->algorithm);
    printf("evp_cipher->nid = %d\n", evp_cipher->nid);

The last string always prints:

evp_cipher->nid = 31

defined in openssl-1.0.1c/include/openssl/objects.h

#define SN_des_cbc "DES-CBC"
#define LN_des_cbc "des-cbc"
#define NID_des_cbc 31

I use 3DES algorithm for PKCS7 requests encryption in my code (pscep.enc_alg = (EVP_CIPHER *)EVP_des_ede3_cbc()) and NDES server accepts these requests, but it always returns answer encrypted with DES.

Can I configure Wndows NDES server to use Triple DES (3DES) algorithm for PKCS#7 answer encryption?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

I got answer from Microsoft support (Diana Zhang) saying this is impossible: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/83a6680c-6610-4cf7-a4fa-1bc63f32a8be

After in-depth research, want to let you know:
The content encryption algorithm for P7 in hardcoded to DES(in CBC mode).
Regards,
Diana
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.