Use OQS-OpenSSL1.1.1 with OpenSSL3 for PEM_read_bio_PrivateKey

[alexandra-buzatoiu]

I am trying to build some small applications in order to get to learn more about how to use properly the liboqs and openssl fork. In this tiny program i wanted to test reading a pq key generated from the cmd line with openssl genpkey -algorithm dilithium3 -out keyfile, but in key I get NULL. I have also tried with a RSA key and that worked fine, so I think it must be something about how I'm using the lib. The code I'm trying to run is:

#include <stdio.h>
#include <string.h>

include <openssl/crypto.h>

include <openssl/pem.h>

include <openssl/err.h>

include <openssl/x509_vfy.h>

include <openssl/x509v3.h>

include <openssl/cms.h>

#include <openssl/pem.h>

int main(int argc, char **argv)
{
BIO *in = NULL, *out = NULL, *indata = NULL, *pkey = NULL, *bio_cert = NULL;
EVP_PKEY *key = NULL;
char *signerfile = NULL, *keyfile = NULL, *contfile = NULL;
char *infile = NULL, *outfile = NULL, *rctfile = NULL;
if (argc != 5)
{
printf("Wrong number of parmeters\n");
exit -3;
}
infile = argv[1];
outfile = argv[2];
signerfile = argv[3];
keyfile = argv[4];
in = BIO_new_file(infile, "rb");
out = BIO_new_file(outfile, "wb");
bio_cert = BIO_new_file(signerfile, "rb");
pkey = BIO_new_file(keyfile, "rb");
key = PEM_read_bio_PrivateKey(pkey, &key,
NULL,
NULL);
if(key == NULL)
{
printf("Private key load error!!!!!\n");
exit -5;
}
int ret = PEM_write_bio_PrivateKey(out, key, NULL, NULL, 0, NULL, NULL);
return ret;
}

And i compile it with:
┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ gcc -Ibuild/include -I/usr/lib/ssl -Lbuild/lib mycms_dir/mycms.c -o mycms_dir/mycms -loqs -lcrypto

It must be something missing because it behaves like it wouldn't recognize the key, I guess.
Thank you in advance!

[baentsch]

What appears fishy in my eyes is the build command as it seems to not force linking with OQS-OpenSSL, so you may simply be running classic openssl code -- that clearly cannot handle QSC keys:

gcc -Ibuild/include -I/usr/lib/ssl -Lbuild/lib mycms_dir/mycms.c -o mycms_dir/mycms -loqs -lcrypto

-> What ldd references are given for your executable? What happens if you first export LD_LIBRARY_PATH=build/lib?

[alexandra-buzatoiu]

I know classic openssl won't handle QSC keys, the thing is I have compiled the same way I did from the signing example on the Wiki section, but I am aware that one was not actually using openssl functions. Nothing changes after the export, and the ldd shows exactly the same output before and after the export.

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ export LD_LIBRARY_PATH=/home/kali/task5/openssl_dir/liboqs/build/lib

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ echo $LD_LIBRARY_PATH
/home/kali/task5/openssl_dir/liboqs/build/lib

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ gcc -Ibuild/include -I/usr/lib/ssl -Lbuild/lib mycms_dir/mycms.c -o mycms_dir/mycms -loqs -lcrypto

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ ldd mycms_dir/mycms
linux-vdso.so.1 (0x00007ffee3efe000)
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007fd76f576000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd76f39c000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fd76f395000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fd76f374000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd76fa11000)

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs]
└─$ cd mycms_dir

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs/mycms_dir]
└─$ ls
apps dilithium2.key infile mycms mycms.c oqs outfile rsa.key server.cert.pem server.key.pem

┌──(kali㉿kali)-[~/task5/openssl_dir/liboqs/mycms_dir]
└─$ ./mycms infile outfile server.cert.pem server.key.pem
Private key load error!!!!!

[baentsch]

Can you please specify exactly the environment you are using? The above indicates use of OpenSSL3 but there is no trace of oqs-provider being configured: How did you do that? Again, please spec your full setup: OS, package versions of liboqs, openssl, oqs-provider.

Moreover, your LD_LIBRARY_PATH does not seem to point to where libcrypto resides: Please output ls $LD_LIBRARY_PATH.

[alexandra-buzatoiu]

In order to get the fork of the openssl I followed the github guide on a KaliLinux distribution (which as far as I know comes by default with OpenSSL3).
I hope this info is useful. About liboqs, it came with openssl-oqs so taking into consideration I took these on 5th of August I guess is the newest.

┌──(kali㉿kali)-[~/task5/openssl_dir]
└─$ ./apps/openssl version -a
OpenSSL 1.1.1q 5 Jul 2022, Open Quantum Safe 2022-08 dev
built on: Fri Aug 5 09:31:00 2022 UTC
platform: linux-x86_64
options: bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Ioqs/include -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/ssl"
ENGINESDIR: "/usr/local/lib/engines-1.1"
Seeding source: os-specific

Instead of putting in LD_LIBRARY_PATH the path to ~ build/lib from liboqs i have appended the one in the director where I have my openssl-oqs.
┌──(kali㉿kali)-[ ~/task5/openssl_dir]
└─$ unset LD_LIBRARY_PATH

┌──(kali㉿kali)-[~/task5/openssl_dir]
└─$ /home/kali/task5/openssl_dir
export LD_LIBRARY_PATH=/home/kali/task5/openssl_dir/oqs/lib

┌──(kali㉿kali)-[~/task5/openssl_dir]
└─$ ls $LD_LIBRARY_PATH
cmake liboqs.a

Once again I mention that all openssl-oqs work fine, the demo from github also works and I could also run the liboqs examples.

[alexandra-buzatoiu]

Also, I get same output and impossibility to read the key if i compile ignoring the liboqs.a:

┌──(kali㉿kali)-[~/task5/openssl_dir]
└─$ gcc -I/home/kali/task5/openssl_dir/oqs/include -L/home/kali/task5/openssl_dir/oqs/lib mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto -loqs

┌──(kali㉿kali)-[~/task5/openssl_dir]
└─$ gcc -I/home/kali/task5/openssl_dir/oqs/include mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto

These 2 commands lead to identical output of the generated executable.

[baentsch]

These 2 commands lead to identical output of the generated executable.

This is expected: Your executable is not using/calling into any OQS-enabled code. Hence, it cannot decode an OQS key:

ls $LD_LIBRARY_PATH
cmake liboqs.a

does not show any shared lib... Indeed you do not point your executable to an OQS-libcrypto but instead:

ldd mycms_dir/mycms
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007fd76f576000)

your executable uses a classic (i.e., not OQS-enabled) libcrypto, namely an OpenSSL3 -lcrypto (that --again-- cannot decode an OQS key, unless you build & point it to use oqs-provider).

./apps/openssl version -a
OpenSSL 1.1.1q 5 Jul 2022, Open Quantum Safe 2022-08 dev

This output in turn shows that you try to work with (OQS-)OpenSSL1.1.1 and not use an OQS-provider for OpenSSL3 (which would be necessary as you(r executable) use(s) openssl v3 -- as evidenced by libcrypto.so.3 in the ldd output.

--> I would strongly suggest you first decide whether you want to work with OpenSSL3 or OpenSSL1.1.1:

If the former, build, install and use oqs-provider to make PEM_read_bio_PrivateKey call OQS-enabled code.

If the latter, confirm (via ldd) you link to the proper (OQS-enabled) -lcrypto(1.1 --NOT 3-- built as part of the oqs-openssl build process): Works immediately:

~/tmp/test$ gcc  -L/opt/oqssa/include pkey.c -lcrypto
~/tmp/test$ echo $LD_LIBRARY_PATH
/opt/oqssa/lib
:~/tmp/test$ ls $LD_LIBRARY_PATH
engines-1.1  libcrypto.so      libcurl.a   libcurl.so.4      liboqs.so    libssl.so      ossl-modules
engines-3    libcrypto.so.1.1  libcurl.la  libcurl.so.4.7.0  liboqs.so.0  libssl.so.1.1  pkgconfig
libcrypto.a  libcrypto.so.3    libcurl.so  liboqs.a          libssl.a     libssl.so.3
~/tmp/test$ ldd a.out 
	linux-vdso.so.1 (0x00007ffc523ef000)
	libcrypto.so.1.1 => /opt/oqssa/lib/libcrypto.so.1.1 (0x00007f49e2aec000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f49e26fb000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f49e24f7000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f49e22d8000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f49e397f000)
~/tmp/test$ ./a.out keyfile 
pkey = 0x560e752ba490

(keyfile generated the same way as you did above and pkey.c contains basically your test code). The big difference is that the executable references an OQS-enabled -lcrypto.

[alexandra-buzatoiu]

I try to use OpenSSL1.1.1, and I have to admit now that my problem has been and still is that I don't actually know where to find the proper crypto library that I should link with.

┌──(kali㉿kali)-[ ~ /task5/openssl_dir] └─$ gcc -I/home/kali/task5/openssl_dir/oqs/include -L/home/kali/task5/openssl_dir/oqs/lib mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto -loqs
┌──(kali㉿kali)-[ ~ /task5/openssl_dir] └─$ gcc -I/home/kali/task5/openssl_dir/oqs/include mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto

By now, I tried to link the ~openssl/oqs.lib as I thought there should be everything I need. As the 2 different commands gave me same output I could realize I was linking the classic OpenSSL3 library using -lcrypto. But my question right now is where do I find the OQS OpenSSL1.1.1 library to link with? From your bash I can see you are linking with /opt/oqssa/include. Does this have something to do with this? https://github.com/IBM/oqssa/
I tried to follow the steps there before writing you but for me it fails for this script https://github.com/IBM/oqssa/blob/master/build-oqssa.sh giving me this output when I run it:

Setting installation dir: /home/buzi/opt/oqssa
Downloading liboqs and open-quantum-safe openssl
Build liboqs
Build oqs-openssl
Downloading libcurl
command failed with exit code 8.
Cleaning up

and as far as I have seen it fail at Downloading libcurl and my wildguess is that the problem might be line 50 in build-oqssa.sh script that I have to run:
wget -q https://raw.githubusercontent.com/open-quantum-safe/oqs-demos/master/curl/patch-$CURL_VERSION.oqs.txt

If this is what I have to do and libcrypto.so.1.1 is in opt/oqssa/include what am I missing?
If this is not what I have to do and I don't have to follow the stept on the IBM oqssa repository, where can I find libcrypto.so.1.1?
Thank you in advance for your patience!

[alexandra-buzatoiu]

I try to use OpenSSL1.1.1, and I have to admit now that my problem has been and still is that I don't actually know where to find the proper crypto library that I should link with.

┌──(kali㉿kali)-[ ~ /task5/openssl_dir] └─$ gcc -I/home/kali/task5/openssl_dir/oqs/include -L/home/kali/task5/openssl_dir/oqs/lib mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto -loqs
┌──(kali㉿kali)-[ ~ /task5/openssl_dir] └─$ gcc -I/home/kali/task5/openssl_dir/oqs/include mycms_dir/mycms.c -o mycms_dir/mycms -lcrypto

By now, I tried to link the ~openssl/oqs.lib as I thought there should be everything I need. As the 2 different commands gave me same output I could realize I was linking the classic OpenSSL3 library using -lcrypto. But my question right now is where do I find the OQS OpenSSL1.1.1 library to link with? From your bash I can see you are linking with /opt/oqssa/include. Does this have something to do with this? https://github.com/IBM/oqssa/
I tried to follow the steps there before writing you but for me it fails for this script https://github.com/IBM/oqssa/blob/master/build-oqssa.sh giving me this output when I run it:

Setting installation dir: /home/buzi/opt/oqssa
Downloading liboqs and open-quantum-safe openssl
Build liboqs
Build oqs-openssl
Downloading libcurl
command failed with exit code 8.
Cleaning up

and as far as I have seen it fail at Downloading libcurl and my wildguess is that the problem might be line 50 in build-oqssa.sh script that I have to run:
wget -q https://raw.githubusercontent.com/open-quantum-safe/oqs-demos/master/curl/patch-$CURL_VERSION.oqs.txt

If this is what I have to do and libcrypto.so.1.1 is in opt/oqssa/include what am I missing?
If this is not what I have to do and I don't have to follow the stept on the IBM oqssa repository, where can I find libcrypto.so.1.1?
Thank you in advance for your patience!

[baentsch]

If this is not what I have to do and I don't have to follow the stept on the IBM oqssa repository, where can I find libcrypto.so.1.1?

The IBM repo just "coincidentally" :-) uses the same name and conceptually has nothing to do with your problem (except using the same path name).

, where can I find libcrypto.so.1.1?

By default, it is created in the main build folder of oqs-openssl. The oqssa path is just one (example path that may be) used when building (and installing) oqs-openssl (as in the IBM example code referred-to by INSTALLDIR).

[alexandra-buzatoiu]

I have refollowed the installation guide of openssl-oqs https://github.com/open-quantum-safe/openssl#linux-and-macOS and i have installed it into a folder named openssl_dir. The librypto.so.1.1 was not there so as I have seen in the IBM script I have retyped the ./Configure linux-x86_64, this time like this: LDFLAGS="-Wl,-rpath -Wl,openssl" ./Configure linux-x86_64. Now I also have those .so into the openssl_dir directory. This would be the content of my instalation directory:
buzi@buzi-virtual-machine: ~ $ cd openssl_dir/
buzi@buzi-virtual-machine: ~ /openssl_dir$ ls
ACKNOWLEDGEMENTS e_os.h libssl.so oqs-test
apps external libssl.so.1.1 os-dep
appveyor_build.bat FAQ LICENSE pyca-cryptography
appveyor.yml fuzz Makefile qsc.h
AUTHORS include ms README
build.info INSTALL NEWS README.ENGINE
CHANGES krb5 NOTES.ANDROID README.FIPS
config lib NOTES.DJGPP README.md
config.com libcrypto.a NOTES.PERL RELEASE.md
configdata.pm libcrypto.map NOTES.UNIX ssl
Configurations libcrypto.pc NOTES.VMS test
Configure libcrypto.so NOTES.WIN tools
CONTRIBUTING libcrypto.so.1.1 openssl.pc util
crypto liboqs.pc oqs VMS
demos libssl.a oqs-interop-test wycheproof
doc libssl.map oqs-scripts
engines libssl.pc oqs-template

Now that I finally have libcrypto.so.1.1 I put everything plus the liboqs.a file into a lib directory for a bit of order, and inspect a bit the include file from the directory I have installed openssl-oqs in following the github guide:

buzi@buzi-virtual-machine: ~/openssl_dir/include$ ls
crypto internal openssl

Because the IBM script did something before failing on libcurl, I have the opt/oqssa folder with some other folders inside, so I go to opt/oqssa/include which differs a bit from the directory where I have installed the oqs openssl in:
buzi@buzi-virtual-machine: ~/opt/oqssa$ ls
bin include lib share ssl
buzi@buzi-virtual-machine: ~/opt/oqssa$ ls include
openssl oqs

The opt/oqssa also has a lib folder with similar libs as my openssl-oqs directory:
buzi@buzi-virtual-machine: ~/opt/oqssa$ ls lib
engines-1.1 libcrypto.so.1.1 liboqs.so.2 libssl.so.1.1
libcrypto.a liboqs.so libssl.a pkgconfig
libcrypto.so liboqs.so.0.7.2 libssl.so

As there is libcrypto.so.1.1 (which I needed), I'm thinking about using this opt/oqssa (even though it lack some libcurl libraries because of the fail) so I followed your previous guide:

buzi@buzi-virtual-machine: ~/opt/oqssa$ pwd
/home/buzi/opt/oqssa

buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/opt/oqssa/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ echo $LD_LIBRARY_PATH

buzi@buzi-virtual-machine: ~$ export LD_LIBRARY_PATH=/home/buzi/opt/oqssa/lib
buzi@buzi-virtual-machine: ~$ echo $LD_LIBRARY_PATH
/home/buzi/opt/oqssa/lib
buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/opt/oqssa/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ ls
a.out Downloads liboqs opt outfile Public Videos
Desktop infile Music oqssa Pictures snap
Documents keyfile openssl_dir oqssa.sh pkey.c Templates
buzi@buzi-virtual-machine: ~$ ./a.out infile outfile keyfile
Private key load error!!!!!
Segmentation fault (core dumped)

The output of the ldd command would be:
buzi@buzi-virtual-machine: ~$ ldd a.out
linux-vdso.so.1 (0x00007ffd02107000)
libcrypto.so.1.1 => /home/buzi/opt/oqssa/lib/libcrypto.so.1.1 (0x00007f544ec68000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f544ea31000)
liboqs.so.2 => /home/buzi/opt/oqssa/lib/liboqs.so.2 (0x00007f544dfe5000)
/lib64/ld-linux-x86-64.so.2 (0x00007f544ef74000)
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f544dba3000)

And I can see that now even though I have libcrypto.so.1.1, I also have libcrypto.so.3, which might be a clash.
Before taking your commands mot-a-mot, I have compiled like this, and I think (not sure) I have spotted a potential issue:

buzi@buzi-virtual-machine: ~$ gcc -I/home/buzi/opt/oqssa/include -L/home/buzi/opt/oqssa/lib pkey.c -lcrypto
/usr/bin/ld: warning: libcrypto.so.3, needed by /home/buzi/opt/oqssa/lib/liboqs.so.2, may conflict with libcrypto.so.1.1

So the liboqs.so.2 relies on libcrypto.so.3. I can see that in your /opt/oqssa/lib you have liboqs.a, liboqs.so, liboqs.so.0. Again, just a wildguess, these might not rely on libcrypto.so.3?

However, the outputs stays:
buzi@buzi-virtual-machine: ~$ ./a.out infile outfile keyfile
Private key load error!!!!!
Segmentation fault (core dumped)

So, given the fact that I have only followed this https://github.com/open-quantum-safe/openssl#linux-and-macOS using the path to the directory where I want to have my OpenSSL-OQS, what can I do in order to have all the headers i need into a /something/somethinelse/include and all the libraries I need into a something/somethinelse/lib?

Thank you!

[alexandra-buzatoiu]

Moreover, after few more tests, I came to realize that it was a happening that it linked to libcrypto.so.1.1, as in the next tests with same commands, it links with with libcrypto.so.3

This is the output when using IBM directory
buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/opt/oqssa/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ echo $LD_LIBRARY_PATH

buzi@buzi-virtual-machine: ~$ export LD_LIBRARY_PATH=/home/buzi/opt/oqssa/lib
buzi@buzi-virtual-machine: ~$ echo $LD_LIBRARY_PATH
/home/buzi/opt/oqssa/lib
buzi@buzi-virtual-machine: ~$ ls $LD_LIBRARY_PATH
engines-1.1 libcrypto.so.1.1 liboqs.so.0.7.2 libssl.so
libcrypto.a liboqs.a liboqs.so.2 libssl.so.1.1
libcrypto.so liboqs.so libssl.a pkgconfig
buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/opt/oqssa/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ ldd a.out
linux-vdso.so.1 (0x00007ffc9f18a000)
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f3a27d14000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3a27aec000)
/lib64/ld-linux-x86-64.so.2 (0x00007f3a2816c000)

This is the output when using the openssl_dir where I have the installed everything from github and grouped the libs into the lib subdirectory:

buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/openssl_dir/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ echo $LD_LIBRARY_PATH

buzi@buzi-virtual-machine: ~$ export LD_LIBRARY_PATH=/home/buzi/openssl_dir/lib
buzi@buzi-virtual-machine: ~$ gcc -L/home/buzi/openssl_dir/include pkey.c -lcrypto
buzi@buzi-virtual-machine: ~$ ldd a.out
linux-vdso.so.1 (0x00007ffe540ac000)
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f217c9c9000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f217c7a1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f217ce21000)
buzi@buzi-virtual-machine: ~$ ls openssl_dir/lib
libcrypto.a libcrypto.pc libcrypto.so.1.1 libssl.map libssl.so
libcrypto.map libcrypto.so libssl.a

[baentsch]

gcc -L/home/buzi/openssl_dir/include pkey.c -lcrypto

You cannot pass an include directory via the -L option. Pass the proper library directory. Otherwise/in this case, the oqs-libcrypto(.1.1) is not found and the system libcrypto(.3) is used.

[baentsch]

So the liboqs.so.2 relies on libcrypto.so.3. I can see that in your /opt/oqssa/lib you have liboqs.a, liboqs.so, liboqs.so.0. Again, just a wildguess, these might not rely on libcrypto.so.3

Of course, if there's no libcrypto3 (listed), none of the libs rely on it. But, this observation finally gives us the proper problem description for your setup: indeed you built liboqs with libcrypto3 and then want to spec (oqs-)libcrypto1.1 when linking your executable. No way to do that AFAIK. Simple solution: Build liboqs without libcrypto/OpenSSL dependency if you want to keep using this "mixed OpenSSL3/1.1. setup". If all you want to do is CMS (as your sample seems to imply), a more clean solution (using only OpenSSL3) would be to use oqs-provider as already suggested above.

[alexandra-buzatoiu]

Thank you for your support! Worked fine with the 'mixture', now I will also try with the oqs-provider!