Add Demos for DSA params/DSA keygen.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19853)

demos/README.txt

@@ -37,8 +37,12 @@ poly1305.c             Demonstration of Poly1305-AES message authentication
 siphash.c              Demonstration of SIPHASH message authentication
 
 pkey:
-EVP_PKEY_EC_keygen.c   Generate an EC key.
-EVP_PKEY_RSA_keygen.c  Generate an RSA key.
+EVP_PKEY_EC_keygen.c           Generate an EC key.
+EVP_PKEY_RSA_keygen.c          Generate an RSA key.
+EVP_PKEY_DSA_keygen.c          Generate a DSA key.
+EVP_PKEY_DSA_paramgen.c        Generate a DSA param key.
+EVP_PKEY_DSA_paramvalidate.c   Validate a DSA param key.
+EVP_PKEY_DSA_paramfromdata.c   Load a DSA param key using raw data.
 
 smime:
 

demos/pkey/EVP_PKEY_DSA_keygen.c

@@ -0,0 +1,83 @@
+/*-
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * Example showing how to generate an DSA key pair.
+ */
+
+#include <openssl/evp.h>
+#include "dsa.inc"
+
+/*
+ * Generate dsa params using default values.
+ * See the EVP_PKEY_DSA_param_fromdata demo if you need
+ * to load DSA params from raw values.
+ * See the EVP_PKEY_DSA_paramgen demo if you need to
+ * use non default parameters.
+ */
+EVP_PKEY *dsa_genparams(OSSL_LIB_CTX *libctx, const char *propq)
+{
+    EVP_PKEY *dsaparamkey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+
+    /* Use the dsa params in a EVP_PKEY ctx */
+    ctx = EVP_PKEY_CTX_new_from_name(libctx, "DSA", propq);
+    if (ctx == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_name() failed\n");
+        return NULL;
+    }
+
+    if (EVP_PKEY_paramgen_init(ctx) <= 0
+            || EVP_PKEY_paramgen(ctx, &dsaparamkey) <= 0) {
+        fprintf(stderr, "DSA paramgen failed\n");
+        goto cleanup;
+    }
+cleanup:
+    EVP_PKEY_CTX_free(ctx);
+    return dsaparamkey;
+}
+
+int main(int argc, char **argv)
+{
+    int rv = EXIT_FAILURE;
+    OSSL_LIB_CTX *libctx = NULL;
+    const char *propq = NULL;
+    EVP_PKEY *dsaparamskey = NULL;
+    EVP_PKEY *dsakey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+
+    /* Generate random dsa params */
+    dsaparamskey = dsa_genparams(libctx, propq);
+    if (dsaparamskey == NULL)
+        goto cleanup;
+
+    /* Use the dsa params in a EVP_PKEY ctx */
+    ctx = EVP_PKEY_CTX_new_from_pkey(libctx, dsaparamskey, propq);
+    if (ctx == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_pkey() failed\n");
+        goto cleanup;
+    }
+
+    /* Generate a key using the dsa params */
+    if (EVP_PKEY_keygen_init(ctx) <= 0
+            || EVP_PKEY_keygen(ctx, &dsakey) <= 0) {
+        fprintf(stderr, "DSA keygen failed\n");
+        goto cleanup;
+    }
+
+    if (!dsa_print_key(dsakey, 1, libctx, propq))
+        goto cleanup;
+
+    rv = EXIT_SUCCESS;
+cleanup:
+    EVP_PKEY_free(dsakey);
+    EVP_PKEY_free(dsaparamskey);
+    EVP_PKEY_CTX_free(ctx);
+    return rv;
+}

demos/pkey/EVP_PKEY_DSA_paramfromdata.c

@@ -0,0 +1,75 @@
+/*-
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * Example showing how to load DSA params from raw data
+ * using EVP_PKEY_fromdata()
+ */
+
+#include <openssl/param_build.h>
+#include <openssl/evp.h>
+#include <openssl/core_names.h>
+#include "dsa.inc"
+
+int main(int argc, char **argv)
+{
+    int rv = EXIT_FAILURE;
+    OSSL_LIB_CTX *libctx = NULL;
+    const char *propq = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *dsaparamkey = NULL;
+    OSSL_PARAM_BLD *bld = NULL;
+    OSSL_PARAM *params = NULL;
+    BIGNUM *p = NULL, *q = NULL, *g = NULL;
+
+    p = BN_bin2bn(dsa_p, sizeof(dsa_p), NULL);
+    q = BN_bin2bn(dsa_q, sizeof(dsa_q), NULL);
+    g = BN_bin2bn(dsa_g, sizeof(dsa_g), NULL);
+    if (p == NULL || q == NULL || g == NULL)
+        goto cleanup;
+
+    /* Use OSSL_PARAM_BLD if you need to handle BIGNUM Parameters */
+    bld = OSSL_PARAM_BLD_new();
+    if (bld == NULL)
+        goto cleanup;
+    if (!OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)
+            || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)
+            || !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
+        goto cleanup;
+    params = OSSL_PARAM_BLD_to_param(bld);
+    if (params == NULL)
+        goto cleanup;
+
+    ctx = EVP_PKEY_CTX_new_from_name(libctx, "DSA", propq);
+    if (ctx == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_name() failed\n");
+        goto cleanup;
+    }
+
+    if (EVP_PKEY_fromdata_init(ctx) <= 0
+            || EVP_PKEY_fromdata(ctx, &dsaparamkey, EVP_PKEY_KEY_PARAMETERS, params) <= 0) {
+        fprintf(stderr, "EVP_PKEY_fromdata() failed\n");
+        goto cleanup;
+    }
+
+    if (!dsa_print_key(dsaparamkey, 0, libctx, propq))
+        goto cleanup;
+
+    rv = EXIT_SUCCESS;
+cleanup:
+    EVP_PKEY_free(dsaparamkey);
+    EVP_PKEY_CTX_free(ctx);
+    OSSL_PARAM_free(params);
+    OSSL_PARAM_BLD_free(bld);
+    BN_free(g);
+    BN_free(q);
+    BN_free(p);
+
+    return rv;
+}

demos/pkey/EVP_PKEY_DSA_paramgen.c

@@ -0,0 +1,66 @@
+/*-
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * Example showing how to generate DSA params using
+ * FIPS 186-4 DSA FFC parameter generation.
+ */
+
+#include <openssl/evp.h>
+#include "dsa.inc"
+
+int main(int argc, char **argv)
+{
+    int rv = EXIT_FAILURE;
+    OSSL_LIB_CTX *libctx = NULL;
+    const char *propq = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *dsaparamkey = NULL;
+    OSSL_PARAM params[7];
+    unsigned int pbits = 2048;
+    unsigned int qbits = 256;
+    int gindex = 42;
+
+    ctx = EVP_PKEY_CTX_new_from_name(libctx, "DSA", propq);
+    if (ctx == NULL)
+        goto cleanup;
+
+    /*
+     * Demonstrate how to set optional DSA fields as params.
+     * See doc/man7/EVP_PKEY-FFC.pod and doc/man7/EVP_PKEY-DSA.pod
+     * for more information.
+     */
+    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_FFC_TYPE,
+                                                 "fips186_4", 0);
+    params[1] = OSSL_PARAM_construct_uint(OSSL_PKEY_PARAM_FFC_PBITS, &pbits);
+    params[2] = OSSL_PARAM_construct_uint(OSSL_PKEY_PARAM_FFC_QBITS, &qbits);
+    params[3] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_FFC_GINDEX, &gindex);
+    params[4] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_FFC_DIGEST,
+                                                 "SHA384", 0);
+    params[5] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_FFC_DIGEST_PROPS,
+                                                 "provider=default", 0);
+    params[6] = OSSL_PARAM_construct_end();
+
+    /* Generate a dsa param key using optional params */
+    if (EVP_PKEY_paramgen_init(ctx) <= 0
+            || EVP_PKEY_CTX_set_params(ctx, params) <= 0
+            || EVP_PKEY_paramgen(ctx, &dsaparamkey) <= 0) {
+        fprintf(stderr, "DSA paramgen failed\n");
+        goto cleanup;
+    }
+
+    if (!dsa_print_key(dsaparamkey, 0, libctx, propq))
+        goto cleanup;
+
+    rv = EXIT_SUCCESS;
+cleanup:
+    EVP_PKEY_free(dsaparamkey);
+    EVP_PKEY_CTX_free(ctx);
+    return rv;
+}

demos/pkey/EVP_PKEY_DSA_paramvalidate.c

@@ -0,0 +1,202 @@
+/*-
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * Example showing how to validate DSA parameters.
+ *
+ * Proper FIPS 186-4 DSA (FFC) parameter validation requires that all
+ * the parameters used during parameter generation are supplied
+ * when doing the validation. Unfortunately saving DSA parameters as
+ * a PEM or DER file does not write out all required fields. Because
+ * of this the default provider normally only does a partial
+ * validation. The FIPS provider will however try to do a full
+ * validation. To force the default provider to use full
+ * validation the 'seed' that is output during generation must be
+ * added to the key. See doc/man7/EVP_PKEY-FFC for more information.
+ */
+
+#include <openssl/evp.h>
+#include <openssl/core_names.h>
+#include <openssl/pem.h>
+#include "dsa.inc"
+
+/* The following values were output from the EVP_PKEY_DSA_paramgen demo */
+static const char dsapem[] =
+    "-----BEGIN DSA PARAMETERS-----\n"
+    "MIICLAKCAQEA1pobSR1FJ3+Tvi0J6Tk1PSV2owZey1Nuo847hGw/59VCS6RPQEqr\n"
+    "vp5fhbvBjupBeVGA/AMH6rI4i4h6jlhurrqH1CqUHVcDhJzxV668bMLiP3mIxg5o\n"
+    "9Yq8x6BnSOtH5Je0tpeE0/fEvvLjCwBUbwnwWxzjANcvDUEt9XYeRrtB2v52fr56\n"
+    "hVYz3wMMNog4CEDOLTvx7/84eVPuUeWDRQFH1EaHMdulP34KBcatEEpEZapkepng\n"
+    "nohm9sFSPQhq2utpkH7pNXdG0EILBtRDCvUpF5720a48LYofdggh2VEZfgElAGFk\n"
+    "dW/CkvyBDmGIzil5aTz4MMsdudaVYgzt6wIhAPsSGC42Qa+X0AFGvonb5nmfUVm/\n"
+    "8aC+tHk7Nb2AYLHXAoIBADx5C0H1+QHsmGKvuOaY+WKUt7aWUrEivD1zBMJAQ6bL\n"
+    "Wv9lbCq1CFHvVzojeOVpn872NqDEpkx4HTpvqhxWL5CkbN/HaGItsQzkD59AQg3v\n"
+    "4YsLlkesq9Jq6x/aWetJXWO36fszFv1gpD3NY3wliBvMYHx62jfc5suh9D3ZZvu7\n"
+    "PLGH4X4kcfzK/R2b0oVbEBjVTe5GMRYZRqnvfSW2f2fA7BzI1OL83UxDDe58cL2M\n"
+    "GcAoUYXOBAfZ37qLMm2juf+o5gCrT4CXfRPu6kbapt7V/YIc1nsNgeAOKKoFBHBQ\n"
+    "gc5u5G6G/j79FVoSDq9DYwTJcHPsU+eHj1uWHso1AjQ=\n"
+    "-----END DSA PARAMETERS-----\n";
+
+static const char hexseed[] =
+    "cba30ccd905aa7675a0b81769704bf3c"
+    "ccf2ca1892b2eaf6b9e2b38d9bf6affc"
+    "42ada55986d8a1772b442770954d0b65";
+const int gindex = 42;
+const int pcounter = 363;
+static const char digest[] = "SHA384";
+
+/*
+ * Create a new dsa param key that is the combination of an existing param key
+ * plus extra parameters.
+ */
+EVP_PKEY_CTX *create_merged_key(EVP_PKEY *dsaparams, const OSSL_PARAM *newparams,
+                                OSSL_LIB_CTX *libctx, const char *propq)
+{
+    EVP_PKEY_CTX *out = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *pkey = NULL;
+    OSSL_PARAM *mergedparams = NULL;
+    OSSL_PARAM *loadedparams = NULL;
+
+    /* Specify EVP_PKEY_KEY_PUBLIC here if you have a public key */
+    if (EVP_PKEY_todata(dsaparams, EVP_PKEY_KEY_PARAMETERS, &loadedparams) <= 0) {
+        fprintf(stderr, "EVP_PKEY_todata() failed\n");
+        goto cleanup;
+    }
+    mergedparams = OSSL_PARAM_merge(loadedparams, newparams);
+    if (mergedparams == NULL) {
+        fprintf(stderr, "OSSL_PARAM_merge() failed\n");
+        goto cleanup;
+    }
+
+    ctx = EVP_PKEY_CTX_new_from_name(libctx, "DSA", propq);
+    if (ctx == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_name() failed\n");
+        goto cleanup;
+    }
+    if (EVP_PKEY_fromdata_init(ctx) <= 0
+            || EVP_PKEY_fromdata(ctx, &pkey,
+                                 EVP_PKEY_KEY_PARAMETERS, mergedparams) <= 0) {
+        fprintf(stderr, "EVP_PKEY_fromdata() failed\n");
+        goto cleanup;
+    }
+    out = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
+    if (out == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_pkey() failed\n");
+        goto cleanup;
+    }
+
+cleanup:
+    EVP_PKEY_free(pkey);
+    OSSL_PARAM_free(loadedparams);
+    OSSL_PARAM_free(mergedparams);
+    EVP_PKEY_CTX_free(ctx);
+    return out;
+}
+
+int main(int argc, char **argv)
+{
+    int rv = EXIT_FAILURE;
+    OSSL_LIB_CTX *libctx = NULL;
+    const char *propq = NULL;
+    EVP_PKEY *dsaparamskey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY_CTX *ctx1 = NULL;
+    EVP_PKEY_CTX *ctx2 = NULL;
+    BIO *in = NULL;
+    OSSL_PARAM params[6];
+    unsigned char seed[64];
+    size_t seedlen;
+
+    if (!OPENSSL_hexstr2buf_ex(seed, sizeof(seed), &seedlen, hexseed, '\0'))
+        goto cleanup;
+    /*
+     * This example loads the PEM data from a memory buffer
+     * Use BIO_new_fp() to load a PEM file instead
+     */
+    in = BIO_new_mem_buf(dsapem, strlen(dsapem));
+    if (in == NULL) {
+        fprintf(stderr, "BIO_new_mem_buf() failed\n");
+        goto cleanup;
+    }
+
+    /* Load DSA params from pem data */
+    dsaparamskey = PEM_read_bio_Parameters_ex(in, NULL, libctx, propq);
+    if (dsaparamskey == NULL) {
+        fprintf(stderr, "Failed to load dsa params\n");
+        goto cleanup;
+    }
+
+    ctx = EVP_PKEY_CTX_new_from_pkey(libctx, dsaparamskey, propq);
+    if (ctx == NULL) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_pkey() failed\n");
+        goto cleanup;
+    }
+    /*
+     * When using the default provider this only does a partial check to
+     * make sure that the values of p, q and g are ok.
+     * This will fail however if the FIPS provider is used since it does
+     * a proper FIPS 186-4 key validation which requires extra parameters
+     */
+    if (EVP_PKEY_param_check(ctx) <= 0) {
+        fprintf(stderr, "Simple EVP_PKEY_param_check() failed \n");
+        goto cleanup;
+    }
+
+    /*
+     * Setup parameters that we want to add.
+     * For illustration purposes it deliberately omits a required parameter.
+     */
+    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_FFC_TYPE,
+                                                "fips186_4", 0);
+    /* Force it to do a proper validation by setting the seed */
+    params[1] = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_FFC_SEED,
+                                                  (void *)seed, seedlen);
+    params[2] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_FFC_GINDEX, (int *)&gindex);
+    params[3] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, (int *)&pcounter);
+    params[4] = OSSL_PARAM_construct_end();
+
+    /* generate a new key that is the combination of the existing key and the new params */
+    ctx1 = create_merged_key(dsaparamskey, params, libctx, propq);
+    if (ctx1 == NULL)
+        goto cleanup;
+    /* This will fail since not all the parameters used for key generation are added */
+    if (EVP_PKEY_param_check(ctx1) > 0) {
+        fprintf(stderr, "EVP_PKEY_param_check() should fail\n");
+        goto cleanup;
+    }
+
+    /*
+     * Add the missing parameters onto the end of the existing list of params
+     * If the default was used for the generation then this parameter is not
+     * needed
+     */
+    params[4] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_FFC_DIGEST,
+                                                 (char *)digest, 0);
+    params[5] = OSSL_PARAM_construct_end();
+    ctx2 = create_merged_key(dsaparamskey, params, libctx, propq);
+    if (ctx2 == NULL)
+        goto cleanup;
+    if (EVP_PKEY_param_check(ctx2) <= 0) {
+        fprintf(stderr, "EVP_PKEY_param_check() failed\n");
+        goto cleanup;
+    }
+
+    if (!dsa_print_key(EVP_PKEY_CTX_get0_pkey(ctx2), 0, libctx, propq))
+        goto cleanup;
+
+    rv = EXIT_SUCCESS;
+cleanup:
+    EVP_PKEY_free(dsaparamskey);
+    EVP_PKEY_CTX_free(ctx2);
+    EVP_PKEY_CTX_free(ctx1);
+    EVP_PKEY_CTX_free(ctx);
+    BIO_free(in);
+    return rv;
+}

demos/pkey/Makefile

@@ -3,21 +3,35 @@
 #
 #    LD_LIBRARY_PATH=../.. ./EVP_PKEY_EC_keygen
 #    LD_LIBRARY_PATH=../.. ./EVP_PKEY_RSA_keygen
+#    LD_LIBRARY_PATH=../.. ./EVP_PKEY_DSA_keygen
+#    LD_LIBRARY_PATH=../.. ./EVP_PKEY_DSA_paramgen
+#    LD_LIBRARY_PATH=../.. ./EVP_PKEY_DSA_paramvalidate
+#    LD_LIBRARY_PATH=../.. ./EVP_PKEY_DSA_paramfromdata
 
 CFLAGS = -I../../include -g -Wall
 LDFLAGS = -L../..
 LDLIBS = -lcrypto
 
-all: EVP_PKEY_EC_keygen EVP_PKEY_RSA_keygen
+all: EVP_PKEY_EC_keygen EVP_PKEY_RSA_keygen EVP_PKEY_DSA_keygen \
+	 EVP_PKEY_DSA_paramgen EVP_PKEY_DSA_paramvalidate EVP_PKEY_DSA_paramfromdata \
 
-%.o: %.c
+%.o: %.c dsa.inc
 	$(CC) $(CFLAGS) -c $<
 
 EVP_PKEY_EC_keygen: EVP_PKEY_EC_keygen.o
 
 EVP_PKEY_RSA_keygen: EVP_PKEY_RSA_keygen.o
 
+EVP_PKEY_DSA_keygen: EVP_PKEY_DSA_keygen.o
+
+EVP_PKEY_DSA_paramgen: EVP_PKEY_DSA_paramgen.o
+
+EVP_PKEY_DSA_paramvalidate: EVP_PKEY_DSA_paramvalidate.o
+
+EVP_PKEY_DSA_paramfromdata: EVP_PKEY_DSA_paramfromdata.o
+
 test: ;
 
 clean:
-	$(RM) *.o EVP_PKEY_EC_keygen EVP_PKEY_RSA_keygen
+	$(RM) *.o EVP_PKEY_EC_keygen EVP_PKEY_RSA_keygen EVP_PKEY_DSA_keygen \
+	      EVP_PKEY_DSA_paramgen EVP_PKEY_DSA_paramfromdata EVP_PKEY_DSA_paramvalidate

demos/pkey/dsa.inc

@@ -0,0 +1,172 @@
+/*-
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/pem.h>
+#include <openssl/core_names.h>
+
+/* Raw DSA params for P, Q and G */
+static const unsigned char dsa_p[] = {
+    0xa2, 0x9b, 0x88, 0x72, 0xce, 0x8b, 0x84, 0x23,
+    0xb7, 0xd5, 0xd2, 0x1d, 0x4b, 0x02, 0xf5, 0x7e,
+    0x03, 0xe9, 0xe6, 0xb8, 0xa2, 0x58, 0xdc, 0x16,
+    0x61, 0x1b, 0xa0, 0x98, 0xab, 0x54, 0x34, 0x15,
+    0xe4, 0x15, 0xf1, 0x56, 0x99, 0x7a, 0x3e, 0xe2,
+    0x36, 0x65, 0x8f, 0xa0, 0x93, 0x26, 0x0d, 0xe3,
+    0xad, 0x42, 0x2e, 0x05, 0xe0, 0x46, 0xf9, 0xec,
+    0x29, 0x16, 0x1a, 0x37, 0x5f, 0x0e, 0xb4, 0xef,
+    0xfc, 0xef, 0x58, 0x28, 0x5c, 0x5d, 0x39, 0xed,
+    0x42, 0x5d, 0x7a, 0x62, 0xca, 0x12, 0x89, 0x6c,
+    0x4a, 0x92, 0xcb, 0x19, 0x46, 0xf2, 0x95, 0x2a,
+    0x48, 0x13, 0x3f, 0x07, 0xda, 0x36, 0x4d, 0x1b,
+    0xdf, 0x6b, 0x0f, 0x71, 0x39, 0x98, 0x3e, 0x69,
+    0x3c, 0x80, 0x05, 0x9b, 0x0e, 0xac, 0xd1, 0x47,
+    0x9b, 0xa9, 0xf2, 0x85, 0x77, 0x54, 0xed, 0xe7,
+    0x5f, 0x11, 0x2b, 0x07, 0xeb, 0xbf, 0x35, 0x34,
+    0x8b, 0xbf, 0x3e, 0x01, 0xe0, 0x2f, 0x2d, 0x47,
+    0x3d, 0xe3, 0x94, 0x53, 0xf9, 0x9d, 0xd2, 0x36,
+    0x75, 0x41, 0xca, 0xca, 0x3b, 0xa0, 0x11, 0x66,
+    0x34, 0x3d, 0x7b, 0x5b, 0x58, 0xa3, 0x7b, 0xd1,
+    0xb7, 0x52, 0x1d, 0xb2, 0xf1, 0x3b, 0x86, 0x70,
+    0x71, 0x32, 0xfe, 0x09, 0xf4, 0xcd, 0x09, 0xdc,
+    0x16, 0x18, 0xfa, 0x34, 0x01, 0xeb, 0xf9, 0xcc,
+    0x7b, 0x19, 0xfa, 0x94, 0xaa, 0x47, 0x20, 0x88,
+    0x13, 0x3d, 0x6c, 0xb2, 0xd3, 0x5c, 0x11, 0x79,
+    0xc8, 0xc8, 0xff, 0x36, 0x87, 0x58, 0xd5, 0x07,
+    0xd9, 0xf9, 0xa1, 0x7d, 0x46, 0xc1, 0x10, 0xfe,
+    0x31, 0x44, 0xce, 0x9b, 0x02, 0x2b, 0x42, 0xe4,
+    0x19, 0xeb, 0x4f, 0x53, 0x88, 0x61, 0x3b, 0xfc,
+    0x3e, 0x26, 0x24, 0x1a, 0x43, 0x2e, 0x87, 0x06,
+    0xbc, 0x58, 0xef, 0x76, 0x11, 0x72, 0x78, 0xde,
+    0xab, 0x6c, 0xf6, 0x92, 0x61, 0x82, 0x91, 0xb7
+};
+
+static const unsigned char dsa_q[] = {
+    0xa3, 0xbf, 0xd9, 0xab, 0x78, 0x84, 0x79, 0x4e,
+    0x38, 0x34, 0x50, 0xd5, 0x89, 0x1d, 0xc1, 0x8b,
+    0x65, 0x15, 0x7b, 0xdc, 0xfc, 0xda, 0xc5, 0x15,
+    0x18, 0x90, 0x28, 0x67
+};
+
+static const unsigned char dsa_g[] = {
+    0x68, 0x19, 0x27, 0x88, 0x69, 0xc7, 0xfd, 0x3d,
+    0x2d, 0x7b, 0x77, 0xf7, 0x7e, 0x81, 0x50, 0xd9,
+    0xad, 0x43, 0x3b, 0xea, 0x3b, 0xa8, 0x5e, 0xfc,
+    0x80, 0x41, 0x5a, 0xa3, 0x54, 0x5f, 0x78, 0xf7,
+    0x22, 0x96, 0xf0, 0x6c, 0xb1, 0x9c, 0xed, 0xa0,
+    0x6c, 0x94, 0xb0, 0x55, 0x1c, 0xfe, 0x6e, 0x6f,
+    0x86, 0x3e, 0x31, 0xd1, 0xde, 0x6e, 0xed, 0x7d,
+    0xab, 0x8b, 0x0c, 0x9d, 0xf2, 0x31, 0xe0, 0x84,
+    0x34, 0xd1, 0x18, 0x4f, 0x91, 0xd0, 0x33, 0x69,
+    0x6b, 0xb3, 0x82, 0xf8, 0x45, 0x5e, 0x98, 0x88,
+    0xf5, 0xd3, 0x1d, 0x47, 0x84, 0xec, 0x40, 0x12,
+    0x02, 0x46, 0xf4, 0xbe, 0xa6, 0x17, 0x94, 0xbb,
+    0xa5, 0x86, 0x6f, 0x09, 0x74, 0x64, 0x63, 0xbd,
+    0xf8, 0xe9, 0xe1, 0x08, 0xcd, 0x95, 0x29, 0xc3,
+    0xd0, 0xf6, 0xdf, 0x80, 0x31, 0x6e, 0x2e, 0x70,
+    0xaa, 0xeb, 0x1b, 0x26, 0xcd, 0xb8, 0xad, 0x97,
+    0xbc, 0x3d, 0x28, 0x7e, 0x0b, 0x8d, 0x61, 0x6c,
+    0x42, 0xe6, 0x5b, 0x87, 0xdb, 0x20, 0xde, 0xb7,
+    0x00, 0x5b, 0xc4, 0x16, 0x74, 0x7a, 0x64, 0x70,
+    0x14, 0x7a, 0x68, 0xa7, 0x82, 0x03, 0x88, 0xeb,
+    0xf4, 0x4d, 0x52, 0xe0, 0x62, 0x8a, 0xf9, 0xcf,
+    0x1b, 0x71, 0x66, 0xd0, 0x34, 0x65, 0xf3, 0x5a,
+    0xcc, 0x31, 0xb6, 0x11, 0x0c, 0x43, 0xda, 0xbc,
+    0x7c, 0x5d, 0x59, 0x1e, 0x67, 0x1e, 0xaf, 0x7c,
+    0x25, 0x2c, 0x1c, 0x14, 0x53, 0x36, 0xa1, 0xa4,
+    0xdd, 0xf1, 0x32, 0x44, 0xd5, 0x5e, 0x83, 0x56,
+    0x80, 0xca, 0xb2, 0x53, 0x3b, 0x82, 0xdf, 0x2e,
+    0xfe, 0x55, 0xec, 0x18, 0xc1, 0xe6, 0xcd, 0x00,
+    0x7b, 0xb0, 0x89, 0x75, 0x8b, 0xb1, 0x7c, 0x2c,
+    0xbe, 0x14, 0x44, 0x1b, 0xd0, 0x93, 0xae, 0x66,
+    0xe5, 0x97, 0x6d, 0x53, 0x73, 0x3f, 0x4f, 0xa3,
+    0x26, 0x97, 0x01, 0xd3, 0x1d, 0x23, 0xd4, 0x67
+};
+
+/* Helper function to retrieve and print a key BIGNUM field */
+static void print_bn(BIO *bio, const EVP_PKEY *pkey, const char *name)
+{
+    BIGNUM *bn = NULL;
+
+    if (EVP_PKEY_get_bn_param(pkey, name, &bn) == 0)
+        return;
+
+    BIO_printf(bio, "  %s = 0x", name);
+    BN_print(bio, bn);
+    BIO_printf(bio, "\n");
+    BN_clear_free(bn);
+}
+
+/*
+ * Print DSA key info
+ *
+ * This method shows how to extract DSA data from an EVP_PKEY.
+ * There are simpler ways to print using EVP_PKEY_print_XXXX().
+ */
+static int dsa_print_key(const EVP_PKEY *pkey, int keypair,
+                         OSSL_LIB_CTX *libctx, const char *propq)
+{
+
+    int rv = 0, gindex, counter;
+    BIO *bio = BIO_new_fp(stdout, BIO_NOCLOSE);
+    unsigned char seed[2048];
+    size_t seedlen;
+
+    if (bio == NULL)
+        return 0;
+
+    /* Output hexadecimal representations of the BIGNUM objects. */
+    BIO_printf(bio, "\nPublic values:\n");
+    print_bn(bio, pkey, OSSL_PKEY_PARAM_FFC_P);
+    print_bn(bio, pkey, OSSL_PKEY_PARAM_FFC_Q);
+    print_bn(bio, pkey, OSSL_PKEY_PARAM_FFC_G);
+
+    if (EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_FFC_SEED, seed,
+                                        sizeof(seed), &seedlen) > 0) {
+        BIO_printf(bio, "  %s\n", OSSL_PKEY_PARAM_FFC_SEED);
+        BIO_dump(bio, seed, seedlen);
+    }
+    if (EVP_PKEY_get_int_param(pkey, OSSL_PKEY_PARAM_FFC_GINDEX, &gindex) > 0) {
+        if (gindex != -1)
+            BIO_printf(bio, "  %s = %d\n", OSSL_PKEY_PARAM_FFC_GINDEX, gindex);
+    }
+    if (EVP_PKEY_get_int_param(pkey, OSSL_PKEY_PARAM_FFC_PCOUNTER, &counter) > 0) {
+        if (counter != -1)
+            BIO_printf(bio, "  %s = %d\n", OSSL_PKEY_PARAM_FFC_PCOUNTER, counter);
+    }
+
+    if (keypair) {
+        fprintf(stdout, "\nPrivate value:\n");
+        print_bn(bio, pkey, OSSL_PKEY_PARAM_PRIV_KEY);
+
+        /* Output a PEM encoding of the public key. */
+        if (PEM_write_bio_PUBKEY_ex(bio, pkey, libctx, propq) == 0) {
+            fprintf(stderr, "Failed to output PEM-encoded public key\n");
+            goto cleanup;
+        }
+
+        /*
+         * Output a PEM encoding of the private key. Please note that this output is
+         * not encrypted. You may wish to use the arguments to specify encryption of
+         * the key if you are storing it on disk. See PEM_write_bio_PrivateKey_ex(3).
+         */
+        if (PEM_write_bio_PrivateKey_ex(bio, pkey, NULL, NULL, 0, NULL, NULL, libctx, propq) == 0) {
+            fprintf(stderr, "Failed to output PEM-encoded private key\n");
+            goto cleanup;
+        }
+    } else {
+        if (PEM_write_bio_Parameters(bio, pkey) == 0) {
+            fprintf(stderr, "Failed to output PEM-encoded params\n");
+            goto cleanup;
+        }
+    }
+    rv = 1;
+cleanup:
+    BIO_free(bio);
+    return rv;
+}