Monat: Januar 2021

Ever wondered what TLS is? You might heard about private- and public-keys, about digital certificates and don’t know what exactly that is and how you can use them? Frankly I was in the same situation and thought I write an blog article regarding these issues to make them a little bit clearer for everyone who needs or wants to learn about it.

To use Transport Layer Security (TLS) a private-public-key-pair, and a X.509 certificate is needed. With the public key, a file or message gets encoded and can only be decoded with the corresponding private key, that’s called asymmetric cryptography. The most common algorithm for the creation of these key pairs are RSA and ECC. Where the digital certificate guarantees the authenticity and integrity of a server or a client.

There are many ressources that shows how to generate a RSA signature and perform a RSA signature verfication process. Nowadays, more and more developers are looking for ECC keys and ECDSA signature, as there are many reasons to consider elliptic curve cryptography (ECC):

• Key generation is much faster for ECC keys than for RSA keys
• Key operation for ECDSA signature is faster
• The EC key size is only 1/10 of comparable RSA keys, so smart cards and HSMs may hold more ECC than RSA keys in their secure memory
• The RSA algorithm my be compromized by quantum computer using Shor algorithm
• Modern applications like WireGuard and crypto-currencies rely on elliptic curve cryptography

In this walk through I will show the full process to perform a ECDSA signature:

1. Select a supported ECC curve
2. Generate a private key (including the public key)
3. Extract the public key
4. Convert the ECC public key in DER and PEM format
5. View the public key content
6. Generate a hash
7. Create a signature using the private key and the hash
8. View the content of the signature
9. Verify the signature

This all is done with two commands only:

• OpenSSL (in my case version 1.1.1d)
• dumpasn1 (installed by Linux package dumpasn1)

OpenSSL ECDSA signature & verification