[ruby-core:109863] [Ruby master Feature#12354] PKey::EC Can't output public key pem when private key exists

Issue #12354 has been updated by brandur (Brandur Leach).


If you're linked against OpenSSL >= 3, the workarounds suggested here don't seem to work any longer because a pkey is not allowed to be modified:

```
Failure/Error: pub.public_key = SIGNING_KEY.public_key

OpenSSL::PKey::PKeyError:
  pkeys are immutable on OpenSSL 3.0
# ./app/pellet.rb:41:in `public_key='
```

And seen from Ruby's OpenSSL source:

``` c
static VALUE ossl_ec_key_set_private_key(VALUE self, VALUE private_key)
{
#if OSSL_OPENSSL_PREREQ(3, 0, 0)
    rb_raise(ePKeyError, "pkeys are immutable on OpenSSL 3.0");
#else
...
```

I looked around for some other workaround, but I wasn't able to find one (although I don't know this code well, so I'm hoping someone else can suggest one). For what it's worth, I'd intuitively expect something like `key.public_key.to_pem` to work.

Given the OpenSSL 3 incompatibility, I wonder if this should be upgraded back to a bug?

----------------------------------------
Feature #12354: PKey::EC Can't output public key pem when private key exists
https://bugs.ruby-lang.org/issues/12354#change-99103

* Author: armour (Armour Comms)
* Status: Assigned
* Priority: Normal
* Assignee: rhenium (Kazuki Yamaguchi)
----------------------------------------
Steps to reproduce:

Create EC key:

```ruby
key = OpenSSL::PKey::EC.new("prime256v1")
key.generate_key
```

Try and output in pem format

```ruby
key.to_pem #Outputs private key pem
key.public_key.to_pem #Error
```

In order to output a public key pem, a new key object must be created with no private key:

```ruby
key_pub = OpenSSL::PKey::EC.new(key.group)
key_pub.public_key = key.public_key
```

Output pem

```ruby
key_pub.to_pem #Success!
```

From viewing the source, http://rxr.whitequark.org/mri/source/ext/openssl/ossl_pkey_ec.c#466 it seems that if the key is private there is no way to output a public key for that key object



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>