OpenSSL – An Introduction
Message Digest
Command: openssl dgst -sha1 file1
Public Key Cryptography (asymmetric)
Generation RSA keys:
Command: openssl genrsa -out rsaprivatekey.pem -des3 1024
This generates the private key and store it encrypted (using
password)
cash:/home/mukka>openssl genrsa -out rsaprivatekey.pem -des3 1024
Generating RSA private key, 1024 bit long modulus
.............................................................................
..............++++++
....++++++
e is 65537 (0x10001)
Enter pass phrase for rsaprivatekey.pem:
Verifying - Enter pass phrase for rsaprivatekey.pem:
cash:/home/mukka>more rsaprivatekey.pem
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,72CAC55096B708F2
gIuONZq6fmyUhHpZxIwEiQ8eXRyYR84tnHnSmL0NjLNNcaXdpe1WtLKhx9KHHkuA9A
5B0Wl3bsM4Zg0Ss6wdCy5lYmFZ0tfB04WckBd9IEILici8aZzIsBhhI91FGRuO
DLogp+qc/J3woVQ+ZvYnNt47qlWP8rsJ6Y8IRbr8haHrZovz1lUv3zkdrG98U11b
43OynbCVYKd4volPqW54HL6oIG2fEmRhoxeEC7UOaSYiiiuCdZh1giZmUyBvFZJ7
WAOjuXnBN+18BBZ0qMbvzWN9UY/6VRwVg8MRJxR2LFsHr/4/LrDMvQe0ToBAAoD
HveBYlAlZl+uKUoUBOLBm2B4ba+lcUbQftnmkM3eiMdqjGqpqi28f2VXAXpZn6RVKm
G7UhV1f3jatNyZQWei1zoj4Tb351uDp0QIwHb5PsGRXUWhhVaRWvbcSQBr1YM4F9q
wlpnMqmFIFS6U+OkXkXu+EpU5wdWRVMb6tQ+PP+UFm7xQswylCbY13QRjw6B+
Hc7mF+12P6dDdRFfN0JRcU3NSsj9qZOENgCcoJo4hojsXczCoqm/2CYCgefvSZiRkagY
GKsihDJ/NFKgfAsp2l5t/6UXgqy34QryK7V6qjzqpASRb9WIHh1C1c4Ra3I3pr7RZVlTGS
AUtcZapHaTntVwD8knFyIQ2rZKOxQT4k8x6tdmAxVHC34+XcSxgtYAMc6+wxbK+pu
Qo4Uqn+UiZd5J2PE1xmhlB3sP/JUHlEd3cJjvpH2mxXXqTaEcR/iBo
yeBnh71861Kpcr+dzjDnqUUDIURx3JlLN7KLQy4dp/H3P+GziXkcZg==
-----END RSA PRIVATE KEY-----
Command:openssl rsa -in rsaprivatekey.pem -pubout -out
rsapublickey.pem
This generate the corresponding public key if the correct
password is provided.
cash:/home/mukka>openssl rsa -in rsaprivatekey.pem -pubout -out rsapublickey.pem
Enter pass phrase for rsaprivatekey.pem:
writing RSA key
cash:/home/mukka>more rsapublickey.pem
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWvYson8K5BE8/UNvvmZ
t8tMkXiwPxB0h0I1bYo+0MHMQYYDbsrCywGk9bP0B0bYaaSPtOgVlf7houq1ow3sY
1IrDu/HXgfKoL8QN2dTly77w2FuaebhKV/5Wv63wKhdOQNhzfTQD5sWxaLFcssorC
1s5iyj+vqc0kiiBEgQXi0wIDAQAB
-----END PUBLIC KEY-----
Signing/Verifying message digest with RSA
Command: openssl
dgst -sha1 -sign rsaprivatekey.pem -out
mdrsasign_file1.cipher file1.txt
Generates signature in mdrsasign_file1.cipher for the file file1.txt
Command: openssl
dgst -sha1 -verify rsapublickey.pem
-signature mdrsasign_file1.cipher file1.txt
cash:/home/mukka>openssl dgst -sha1 –verify rsapublickey.pem -signature
mdrsasign_file1.cipher file1.txt
Verified OK
Change at least one character in file1.txt and try again:
cash:/home/mukka>vi file1.txtpenssl dgst -sha1 -verify rsapublickey.pem -signature
mdrsasign_file1.cipher file1.txt
Verification Failure
Message encryption/decryption with RSA
openssl rsautl -encrypt -pubin -inkey rsapublickey.pem -in
file1.txt -out file1.cipher
openssl rsautl -decrypt -inkey rsaprivatekey.pem -in
file1.cipher -out file1.txt
file1.txt has to be small (<=1024 bits or 128 bytes, the
length of the RSA key), since you are
encrypting/decryption the file itself, not its digest.
Message signature/verification with RSA
openssl rsautl -sign -inkey rsaprivatekey.pem -in
file1.txt -out file1_signature.cipher
openssl rsautl -verify -pubin -inkey rsapublickey.pem -out
file1.txt -in file1_signature.cipher
file1.txt has to be small, since you are
encrypting/decryption file1.txt itself.
Secret Key Cryptography (Symmetric)
Encrypt (-e), Decrypt (-d), Base64 encode/decode (-a)
openssl enc -des3 -e -salt -a -in file1.txt -out
file1sym.base64
openssl enc -des3 -d -salt -a -out file1.txt -in
file1sym.base64
Encode/decode to/from base64
Encrypt/decrypt without -a option to produce
file1sym.cipher:
> openssl enc -des3 -e -salt -in file1.txt -out
file1sym.cipher
enter des-ede3-cbc encryption password:
Verifying password - enter des-ede3-cbc encryption password:
> openssl enc -des3 -d -salt -out file1.txt -in
file1sym.cipher
enter des-ede3-cbc decryption password:
Now you can encode/decode file1sym.cipher to/from
file1sym.cipher64:
> openssl enc -base64 -e -out file1sym.base64 -in
file1sym.cipher
> openssl enc -base64 -d -in file1sym.base64
-out file1sym.cipher
