OpenSSL also allows you to implement a series of asymmetric cryptographic features-key pair generation, encryption of decryption of information with OpenSSL.
Key pair generation
You can see which parameters the key generation uses:
openssl genrsa -help
usage: genrsa [args] [numbits]
-des encrypt the generated key with DES in cbc mode
-des3 encrypt the generated key with DES in ede cbc mode (168 bit key)
-idea encrypt the generated key with IDEA in cbc mode
-seed
encrypt PEM output with cbc seed
-aes128, -aes192, -aes256
encrypt PEM output with cbc aes
-camellia128, -camellia192, -camellia256
encrypt PEM output with cbc camellia
-out file output the key to 'file
-passout arg output file pass phrase source
-f4 use F4 (0x10001) for the E value
-3 use 3 for the E value
-engine e use engine e, possibly a hardware device.
-rand file:file:...
load the file (or the files in the directory) into
the random number generator
Generate a key pair
Let's generate a key pair with 4096 bits of dimension.
openssl genrsa -out ./keypair.pem 4096
Generating RSA private key, 4096 bit long modulus
........................................................................................................................................................................++
..........................++
e is 65537 (0x10001)
The key generation process follows the recommendations of PKCS#1, with the following structure represented in ASN.1:
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponent INTEGER, -- e
privateExponent INTEGER, -- d
prime1 INTEGER, -- p
prime2 INTEGER, -- q
exponent1 INTEGER, -- d mod (p-1)
exponent2 INTEGER, -- d mod (q-1)
coefficient INTEGER, -- (inverse of q) mod p
otherPrimeInfos OtherPrimeInfos OPTIONAL
}
Also, you may notice that the file format that we are using uses the PEM format, which is a standard file format for storing cryptographic keys and certificates. This format is specified in the following RFC 7468.
To view it, we can do:
openssl rsa -in keypair.pem -text
Generate a key pair and protect the private key
We are going to create a keypair and protect the private key with a password (PKCS#5).
openssl genrsa -out ./keypair.pem -aes128 4096
Generating RSA private key, 4096 bit long modulus
...................................................................................++
.......................................................................................................................................................................................................................................................................................................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for ./keypair.pem:
Verifying - Enter pass phrase for ./keypair.pem:
Print the various components of the key pair
Prints the key components, in PKCS#1 format (see above). openssl rsa -in ./keypair.pem -text
It is only suitable for encrypting small blocks of information. In this case a "secretkey" file was created, with a small random value using the command "openssl rand -out ./secretkey 32". Then this file was encrypted using the public key.