Generate Aes Key Command Line Commands
Generate Aes Key Command Line Download

The public key, however, is meant to be saved on the servers you intend to access, in the “/.ssh/authorizedkeys” file (or rather, pasted/added to this file). To open this key, to copy, and then paste, wherever necessary, enter the following in Command Prompt. @Mawg: Your openssl command is outputting the public key corresponding to the supplied private key - public keys aren't encrypted (they're not secret), so using -passout makes no sense. You probably want to use -passin there, to supply the passphrase that was used to encrypt the private key in the first step.

Encrypt and decrypt files to public keys via the OpenSSL Command Line

Published: 25-10-2018 | Author: Remy van Elst | Text only version of this article

❗ This post is over two years old. It may no longer be up to date. Opinions may have changed.

Generate Aes Key Command Line Commands

This small tutorial will show you how to use the openssl command line to encryptand decrypt a file using a public key. We will first generate a random key,encrypt that random key against the public key of the other person and use thatrandom key to encrypt the actual file with using symmetric encryption.

Consider sponsoring me on Github. It means the world to me if you show your appreciation and you'll help pay the server costs.
You can also sponsor me by getting a Digital Ocean VPS. With this referral link you'll get $100 credit for 60 days.

Because of how the RSA algorithm works it is not possible to encrypt largefiles. If you create a key of n bits, then the file you want to encrypt mustnot larger than (n minus 11) bits. The most effective use of RSA crypto is toencrypt a random generated password, then encrypt the file with the passwordusing symmetric crypto. If the file is larger then the key size the encryptioncommand will fail:

We generate a random file and use that as the key to encrypt the large file withsymmetric crypto. That random file acts as the password so to say. We encryptthe large file with the small password file as password. Then we send theencrypted file and the encrypted key to the other party and then can decrypt thekey with their public key, the use that key to decrypt the large file.

The following commands are relevant when you work with RSA keys:

openssl genrsa: Generates an RSA private keys.
openssl rsa: Manage RSA private keys (includes generating a public key from it).
openssl rsautl: Encrypt and decrypt files with RSA keys.

The key is just a string of random bytes. We use a base64 encoded string of 128bytes, which is 175 characters. Since 175 characters is 1400 bits, even a smallRSA key will be able to encrypt it.

Get the public key

Let the other party send you a certificate or their public key. If they send toa certificate you can extract the public key using this command:

Generate the random password file

Use the following command to generate the random key:

Do this every time you encrypt a file. Use a new key every time!

Update 25-10-2018

The key format is HEX because the base64 format adds newlines. The -passargument later on only takes the first line of the file, so the full key is notused. (Thanks Ken Larson for pointing this to me)

Encrypt the file with the random key

Use the following command to encrypt the large file with the random key:

The file size doesn't grows that much:

It's encrypted however:

Encrypt the random key with the public keyfile

Use the following command to encrypt the random keyfile with the other personspublic key:

You can safely send the key.bin.enc and the largefile.pdf.enc to the otherparty.

You might want to sign the two files with your public key as well.

Decrypt the random key with our private key file

If you want to decrypt a file encrypted with this setup, use the followingcommand with your privte key (beloning to the pubkey the random key was cryptedto) to decrypt the random key:

This will result in the decrypted random key we encrypted the file in.

Decrypt the large file with the random key

Once you have the random key, you can decrypt the encrypted file with thedecrypted key:

This will result in the decrypted large file.

Tags: ca, certificate, decrypt, encrypt, openssl, pki, ssl, tls, tutorials

OpenSSL is a program and library that supports many different cryptographic operations, including:

Symmetric key encryption
Public/private key pair generation
Public key encryption
Hash functions
Certificate creation
Digital signatures
Random number generation

Each of the operations supported by OpenSSL have a variety of options, such as input/output files, algorithms, algorithm parameters and formats. This article aims to give a demonstration of some simple and common operations.

To start learning the details of OpenSSL, read the man page, i.e. man openssl. You'll soon learn that each of the operations (or commands) have their own man pages. For example, the operation of symmetric key encryption is enc, which is described in man enc. Although it is good to read the man pages, in my (and others) experience, the man pages of OpenSSL can be very detailed, hard to follow, confusing and out of date. So hopefully this article will make life easier for those getting started.

There are otherwebsites that give an overview of OpenSSL operations, as well as programming with the API. I used some of them to write the following notes. Check them out for more details.

Initial Steps

Lets first determine the current versions of Ubuntu, Linux and OpenSSL I am using:

If you are using different versions, then it is still a very good chance that all the following commands will work. In the past I have had problems with different versions of OpenSSL but for only for very specific operations.

Update (2013-08-02): I just tested on a Apple iMac using OS X 10.8.4 and OpenSSL version 0.9.8x 10 May 2012. Most operations worked. See my additional comments at the end of this article if you are using a similar version of OpenSSL.

As input plaintext I will copy some files on Ubuntu Linux into my home directory. You don't need to do this if you already have some files to encrypt. It doesn't matter what files you use. I have chosen the following three, and will rename them simply to plaintext1.in, plaintext2.in, plaintext3.in:

/usr/share/dict/words - a large text file containing a list of words, i.e. a dictionary
/usr/bin/openssl - the binary for the program OpenSSL
/etc/legal - a short text file containing the Ubuntu legal notice

Symmetric Key Encryption

The most common cryptographic operation is encryption. Lets encrypt some files using selected symmetric key (conventional) ciphers such as DES, 3DES and AES.

Symmetric key encryption is performed using the enc operation of OpenSSL. To encrypt we need to choose a cipher. A list of supported ciphers can be found using:

The lowercase seed is an alias for the actual cipher SEED-CBC, i.e. SEED using CBC mode of operation. You can use the cipher names in either lowercase or uppercase.

Now lets encrypt using DES and ECB, creating an output file ciphertext1.bin. Enter a password when prompted - OpenSSL will automatically convert it to a key appropriate for DES:

To decrypt, include the -d option:

The lack of output from the diff indicates the files plaintext1.in and plaintext1.out are identical. We've retrieved the original plaintext.

xxd was used to view the first 96 bytes, in hexadecimal, of the ciphertext. The first 8 bytes contain the special string Salted__ meaning the DES key was generated using a password and a salt. The salt is stored in the next 8 bytes of ciphertext, i.e. the value f2538361b87d1a3e in hexadecimal. So when decrypting, the user supplies the password and Op