An Introduction to the OpenSSL |
OpenSSL is a C library that implements the main cryptographic
operations like symmetric encryption, public-key encryption,
digital signature, hash functions and so on... OpenSSL also
implements obviously the famous Secure Socket Layer (SSL) protocol.
OpenSSL is avaible for a wide variety of platforms. The source code
can be downloaded from www.openssl.org.
A windows distribution can be found
here.
This tutorial shows some basics funcionalities of the OpenSSL command line tool.
After the installation has been completed you should able to check for the version.
> openssl version OpenSSL 0.9.7e 25 Oct 2004
|
> openssl list-standard-commands asn1parse ca ciphers crl crl2pkcs7 ...
|
OpenSSL implements numerous secret key algorithms. To see the complete list:
> openssl list-cipher-commands aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb aes-256-cbc aes-256-ecb base64 ...
|
The list contains the algorithm base64 which is a way to code
binary information with alphanumeric characters. It is not really a secret
key algorithm as there is no secret key! Let’s see an example:
> touch number.txt > echo "123456789" > number.txt > openssl enc -base64 -in number.txt MTIzNDU2Nzg5Cg==
|
encrypted.bin is binary.If I want to decrypt this file I write:
> openssl enc -aes-256-cbc -d -in encrypted.bin -pass pass:hello I love OpenSSL!
|
To illustrate how OpenSSL manages public key algorithms we are going to use the famous RSA algorithm. Other algorithms exist of course, but the principle remains the same.
First we need to generate a pair of public/private key. In this
example we create a pair of RSA key of 1024 bits.
key.pem. The private key
is coded using the Privacy Enhanced Email (PEM) standard.
-noout option allows to avoid the display of the key in base 64 format.
Numbers in hexadecimal format can be seen (except the public exponent by default is always 65537
for 1024 bit keys): the modulus, the public exponent, the private, the two primes that compose
the modules and three other numbers that are use to optimize the algorithm. So now it’s time to encrypt the private key:
> openssl rsa -in key.pem -des3 -out enc-key.pem writing RSA key Enter PEM pass phrase: Verifying - Enter PEM pass phrase:
|
3-des).
The private key alone is not of much interest as other users
need the public key to be able to send you encrypted messages (or check
if a piece of information has been signed by you). So let’s
extract the public from the file key.pem
> openssl rsa -in key.pem -pubout -out pub-key.pem
|
We are ready to perform encryption or produce digital signature.
> openssl rsautl -encrypt -in <input_file> -inkey <llave> \
-out <output_file>
|
input_file is the file to encrypt. This file must no be
longer that 116 bytes =928 bits because RSA is a block cipher,
and this command is low level command, i.e. it does not do the
work of cutting your text in piece of 1024 bits (less indeed
because a few bits are used for special purposes.)
key
File that contains the public key. If this file contains only the public key
(not both private and public), then the option -pubin must be used.
output_file the encrypted file.
To decrypt only replace -encrypt by -decrypt, and invert
the input / output file as for decryption the input is the encrypted text, and
the output the plain text.
The next step is to be create a digital signature and to verify it. It is not very efficient to sign a big file using directly a public key algorithm. That is why first we compute the digest of the information to sign. Note that in practice things are a bit more complex. The security provided by this scheme (hashing and then signing directly using RSA) is not the same (is less in fact) than signing directly the whole document with the RSA algorithm. The scheme used in real application is called RSA-PSS which is efficient and proven to keep the best level of security.
> openssl dgst -<hash_algorithm> -out <digest> <input_file>
|
hash_algorithm is the hash algorithm used to compute the digest.
Among the available algorithm there are: SHA-1 (option -sha1 which
computes a 160 bits digests), MD5(option -md5) with 128 bits output length and
RIPEMD160 (option -ripemd160) with 160 bits output length.
digest is the file that contains the result of the hash application on input_file.
input_file file that contains the data to be hashed.
This command can be used to check the hash values of some archive files like the openssl source code for example.
To compute the signature of the digest:
> openssl rsautl -sign -in <digest> -out <signature> -inkey <key>
|
To check to validity of a given signature:
> openssl rsautl -verify -in <signature> -out <digest> \
-inkey <key> -pubin
|
-pubin is used like before when the key is the public one, which is
natural as we are verifying a signature.To complete the verification, one needs
to compute the digest of the input file and to compare it to the digest
obtained in the verification of the digital signature.
One of the major breakthrough of public key cryptography is to solve the problem of key distribution. Secret key cryptography supposes the participants already agreed on a common secret. But how do they manage this in practice? Sending the key through an encrypted channel seems the more natural and practical solution but once again we need a common secret key to do this. With public key cryptography things are a lot simpler: if I want to send a message to Bob, I only need to find Bob’s public key (on his homepage, on a public key directory ...) encrypt the message using this key and send the result to Bob. Then Bob using his own private key can recover the plain text. However a big problem remains. What happens if a malicious person called The Ugly makes me believe that the public key he owns is in fact Bob’s one? Simply I will send an encrypted message using The Ugly’s public key thinking I’m communicating with Bob. The Ugly will receive the message, decrypt it, and will then encrypt the plaintext with Bob’s (real) public key. Bob will receive the encrypted message, will answer probably with another encrypted message using The Ugly’s public key (who once again managed to convince Bob, this public key belongs to me). Afterwards The Ugly will decrypt the message, reencrypt it with my public key, so I will really receive the Bob’s answer. Indeed I will be communicating with Bob, but without confidentiality. This attack is called “Man in the middle Attack”, where the man is of course The Ugly of our little story. So we need a mechanism to associate in a trustworthy way a public key to the identity of a person (name, identity card number ...). One of this mechanism is implemented in PGP. The idea is that every one builds his own net of trust, by having a list of trusted public keys, and by sharing these keys. The other solution is the use of a PKI.
Public Key Infrastructure is a centralized solution to the problem of trust. The idea is to have a trusted entity (organization, corporation) that will do the job of certifying that a given public key belongs really to a given person. This person must be identified by his name, address and other useful information that may allow to know who this person is. Once this work his done, the PKI emits a public certificate for this person. This certificate contains between others:
So now, if I want to send a private message to Bob, I can ask for his certificate. When I received the certificate, I must check the signature of the PKI who emitted it and for the date of revocation. If verifications pass then I can safely use the public key of the certificate to communicate with Bob. Indeed, in practice the way a PKI works is much more complicated. For example sometimes a certificate may be revocated before the date of end of validity has been reached. So a kind of list of revocated certificated has to be maintained and accessed every time you want to use a certificate. The problem of certificate revocation is really difficult in practice.
This section will show how to create your own small PKI. Obviously this is only a tutorial and you SHOULD NOT base a real application only on the information contained in this page!
openssl.cnf: let’s configure a few things
Before starting to create certificates it is necesarry to configure a
few parameters. That can be done editing the file openssl.cnf
the is usually located in the bin directory of OpenSSL. This file looks
like this:
openssl.cnf
#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = "/home/philippe/openssl" # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem # The private key
RANDFILE = $dir/private/.rnd # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
....
|
openssl.cnf file with the demoCA directory (also in the bin
directory of OpenSSL) that contains all the necesarry files.
You should ensure that all the directories are valid ones, and that the private
key that will be created in the next section (cakey.pem) is well linked.
Also check of the presence of a file .rand or .rnd that will bee
created with cakey.pem.
For the certificates database you can create an empty file index.txt. Also
create a serial file serial with the text for example 011E. 011E is the
serial number for the next certificate.
First we must create a certificate for the PKI that will contain
a pair of public / private key. The private key will be used to sign the certificates.
> openssl req -new -x509 -keyout cakey.pem -out cacert.pem
|
cakey.pem and the certificate
(which does NOT contain the private key, only the public) is
saved in cacert.pem.
During the execution you will be asked for many informations about
your organization (name, country, and so on ...).
The private key contained in cakey.pem is encrypted with
a password. This file should be put in a very secure place (although it
is encrypted). -x509 refers to a standard that defines
how information of the certificate is coded.
It can be useful to export the certificate of the PKI in DER format
as to be able to load it into your browser.
> openssl x509 -in cacert.pem -outform DER -out cacert.der
|
Now the PKI has got its own pair of keys and certificate, let’s suppose
a user wants to get a certificate from the PKI. To do so he must
create a certificate request, that will contain all the information
needed for the certificate (name, country, ... and the public key of the user of
course). This certificate request is sent to the PKI.
> openssl req -new -keyout userkey.pem -out usercert-req.pem
|
userkey.pem and the certificate request
in usercert-req.pem.
The PKI is ready for the next step: signing the certificate request to obtain
the user’s certificate.
usercert.pem is the public certificate signed by the PKI.
If you want to import this certificate into your browser you need
to convert it in PKCS12 format:
> openssl pkcs12 -export -in usercert.pem -inkey userkey.pem > usercert.p12
|
This document was translated from LATEX by HEVEA.