使用OpenSSL libcrypto加载未加密PEM格式SECP256R1公钥异常

Hey there! Let's figure out why your program is crashing when loading the SECP256R1 public key. The exit code 1 without any hints usually points to missing error handling, an incorrect key format, or a compilation/linking misstep. Here's how to debug and fix it step by step:

Step 1: Add Proper Error Handling to Get Clear Clues #

Your original code doesn't check for errors from PEM_read_EC_PUBKEY or print OpenSSL's internal error logs. This is critical because OpenSSL tells you exactly what went wrong if you ask it to. Update your code like this:

#include <stdio.h>
#include <openssl/pem.h>
#include <openssl/ec.h>
#include <openssl/err.h>

int main() {
    EC_KEY *pk = NULL;
    FILE *in = fopen("pk.pem", "rt");
    if (!in) {
        perror("Failed to open public key file");
        return 2;
    }

    // Initialize OpenSSL error handling
    ERR_load_crypto_strings();
    OpenSSL_add_all_algorithms();

    pk = PEM_read_EC_PUBKEY(in, NULL, NULL, NULL);
    if (!pk) {
        fprintf(stderr, "Failed to load EC public key:\n");
        ERR_print_errors_fp(stderr);
        fclose(in);
        return 1;
    }

    // Verify the key uses the SECP256R1 curve (NIST P-256)
    const EC_GROUP *group = EC_KEY_get0_group(pk);
    if (EC_GROUP_get_curve_name(group) != NID_X9_62_prime256v1) {
        fprintf(stderr, "Public key is not using SECP256R1 curve!\n");
        EC_KEY_free(pk);
        fclose(in);
        return 3;
    }

    printf("Successfully loaded SECP256R1 public key!\n");
    
    // Cleanup resources
    EC_KEY_free(pk);
    fclose(in);
    ERR_free_strings();
    return 0;
}

When you run this updated code, it will print detailed error messages (like invalid PEM format or curve mismatch) instead of just crashing.

Step 2: Verify Your Public Key Format #

PEM_read_EC_PUBKEY expects the public key to be in SubjectPublicKeyInfo format (the standard PKCS#8 public key format), which looks like this:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----

If your key uses the traditional EC-specific header (-----BEGIN EC PUBLIC KEY-----), PEM_read_EC_PUBKEY will fail to parse it. To fix this, convert it to the standard format with OpenSSL:

openssl pkcs8 -topk8 -nocrypt -in pk.pem -out pk_spki.pem

Then use pk_spki.pem in your program.

Alternatively, if you generated the key yourself, make sure you use this command to create the correct format:

openssl ec -in secp256r1_private.key -pubout -out pk.pem

Step 3: Check Your Compilation & Linking Command #

A common mistake is forgetting to link against OpenSSL's crypto library during compilation. If you're using GCC, your command should look like this:

gcc -o load_ec_pub load_ec_pub.c -lcrypto

Without the -lcrypto flag, the program will compile but crash at runtime (exit code 1) because it can't find the OpenSSL functions it needs.

Step 4: Ensure OpenSSL Version Compatibility #

Older versions of OpenSSL (pre-1.0.1) have limited support for SECP256R1 or may have bugs in PEM_read_EC_PUBKEY. Check your OpenSSL version with:

openssl version

We recommend using OpenSSL 1.1.1 or newer (LTS versions) for reliable EC key support.

内容的提问来源于stack exchange，提问作者Arya Pourtabatabaie