First Steps with OpenSSL for signature and encryption

Ever wondered what TLS is? You might heard about private- and public-keys, about digital certificates and don’t know what exactly that is and how you can use them? Frankly I was in the same situation and thought I write an blog article regarding these issues to make them a little bit clearer for everyone who needs or wants to learn about it.

To use Transport Layer Security (TLS) a private-public-key-pair, and a X.509 certificate is needed. With the public key, a file or message gets encoded and can only be decoded with the corresponding private key, that’s called asymmetric cryptography. The most common algorithm for the creation of these key pairs are RSA and ECC. Where the digital certificate guarantees the authenticity and integrity of a server or a client.

First Steps with OpenSSL for signature and encryption weiterlesen

Full working ECDSA signature with OpenSSL

There are many ressources that shows how to generate a RSA signature and perform a RSA signature verfication process. Nowadays, more and more developers are looking for ECC keys and ECDSA signature, as there are many reasons to consider elliptic curve cryptography (ECC):

  • Key generation is much faster for ECC keys than for RSA keys
  • Key operation for ECDSA signature is faster
  • The EC key size is only 1/10 of comparable RSA keys, so smart cards and HSMs may hold more ECC than RSA keys in their secure memory
  • The RSA algorithm my be compromized by quantum computer using Shor algorithm
  • Modern applications like WireGuard and crypto-currencies rely on elliptic curve cryptography

In this walk through I will show the full process to perform a ECDSA signature:

  1. Select a supported ECC curve
  2. Generate a private key (including the public key)
  3. Extract the public key
  4. Convert the ECC public key in DER and PEM format
  5. View the public key content
  6. Generate a hash
  7. Create a signature using the private key and the hash
  8. View the content of the signature
  9. Verify the signature

This all is done with two commands only:

  • OpenSSL (in my case version 1.1.1d)
  • dumpasn1 (installed by Linux package dumpasn1)

OpenSSL ECDSA signature & verification

Full working ECDSA signature with OpenSSL weiterlesen

SoftHSM2: What crypto mechanisms and ciphers are supported?

SoftHSM2 is free and easy o install or compile. But if you search how to use SoftHSM2 for symmetric and asymmetric cryptography or hashing you will notice that the OpenDNSSEC Wiki will not have any hint what mechanisms are supportet. This post will show how to view all SoftHSM mechanisms using pkcs11-tool. This references are based on version 2.6.1 and can be downloaded from OpenDNSSEC website.

To repeat the following steps you need to install or compile the following packages:

  • OpenSC (includes pkcs11-tool binary)
  • SoftHSM2

List all SoftHSM2 mechanisms (AES, DES, DH, DSA, ECDH, ECDSA, HASHES, RSA)

SoftHSM2: What crypto mechanisms and ciphers are supported? weiterlesen