Migrating from OpenSSL 1.0.2 to 3.0.8: i2d_ECPKParameters returns no parameters except curve name

Question

While migrating my code from openssl 1.0.1 to 3.0.8 I came across this issue. When I create an EC_GROUP by the curve name, the resulting data is basically empty if I link openssl 3.0.8. If openssl 1.0.2 is used, the EC_GROUP is filled with the values below. This the same behaviour for all curves.

Is there anything I am missing when migrating the code from 1.0.2? Thank you!

#include <iostream>
#include <vector>
#include <openssl/bio.h>
#include <openssl/dh.h>
#include <openssl/ec.h>
#include <openssl/obj_mac.h>
#include <openssl/evp.h>

int main(int /*argc*/, char* /*argv*/[])
{
    OpenSSL_add_all_digests();
    OpenSSL_add_all_algorithms();

    std::vector<unsigned char> oArr;
    oArr.resize(1000);
    unsigned char* out1 = &oArr[0];
    int size = i2d_ECPKParameters(group, &out1);
    oArr.resize(size);

    BIO* bio = BIO_new(BIO_s_mem());
    ECPKParameters_print(bio, group, 0);
    char buffer[1024];
    memset(buffer, 0, 1024);
    BIO_read(bio, buffer, 1024 - 1);
    std::string sBio(buffer);
    std::cout << sBio << std::endl;
    BIO_free(bio); 
}

Output on openssl 3.0.8:
'ASN1 OID: secp112r1'

Output on openssl 1.0.2:
'Field Type: prime-field
Prime:
    00:db:7c:2a:bf:62:e3:5e:66:80:76:be:ad:20:8b
A:
    61:27:c2:4c:05:f3:8a:0a:aa:f6:5c:0e:f0:2c
B:
    51:de:f1:81:5d:b5:ed:74:fc:c3:4c:85:d7:09
Generator (uncompressed):
    04:4b:a3:0a:b5:e8:92:b4:e1:64:9d:d0:92:86:43:
    ad:cd:46:f5:88:2e:37:47:de:f3:6e:95:6e:97
Order:'

Answer 1

When I create an EC_GROUP by the curve name, the resulting data is basically empty

It's not empty - its using the "named curve" form of parameters as opposed to explicit parameters. This is just an alternative format.

This behaviour is controlled by the "asn1_flag" setting on the group. See the functions EC_GROUP_set_asn1_flag() and EC_GROUP_get_asn1_flag().

https://www.openssl.org/docs/man3.0/man3/EC_GROUP_set_asn1_flag.html

From the man page:

The asn1_flag value is used to determine whether the curve encoding uses explicit parameters or a named curve using an ASN1 OID: many applications only support the latter form. If asn1_flag is OPENSSL_EC_NAMED_CURVE then the named curve form is used and the parameters must have a corresponding named curve NID set. If asn1_flags is OPENSSL_EC_EXPLICIT_CURVE the parameters are explicitly encoded. The functions EC_GROUP_get_asn1_flag() and EC_GROUP_set_asn1_flag() get and set the status of the asn1_flag for the curve. Note: OPENSSL_EC_EXPLICIT_CURVE was added in OpenSSL 1.1.0, for previous versions of OpenSSL the value 0 must be used instead. Before OpenSSL 1.1.0 the default form was to use explicit parameters (meaning that applications would have to explicitly set the named curve form) in OpenSSL 1.1.0 and later the named curve form is the default.

So, 1.0.2, is defaulting to use explicit parameters and later versions default to the name curve form.

Note that you rarely want to use explicit parameters. In most cases named curve parameters is the right answer.