Principles and command usage of OpenSSL encryption and decryption-not yet complete

Principles of OpenSSL encryption and decryption:

Example:

For example, if a communicates with B to send data:

Encryption principle:

After a calculates the data fingerprint of the content to be sent through one-way encryption, it uses its own private key to encrypt the data fingerprint, add the encrypted data fingerprint to the back of the original data. Then, the entire data (original data + Data fingerprint) is computed using a symmetric encryption algorithm (converting plaintext into a ciphertext), and the data obtained is the password of the entire data, use the public key of B to encrypt the password and send it to B along with the data.

 

Decryption principle:

1. B uses its own private key to decrypt --------- data is kept confidential.

2. B uses the password decrypted by the private key to decrypt the entire data and obtain the plaintext (converted from the ciphertext to the plaintext). After B obtains the data, it uses the public key of a to decrypt the data, the decryption result indicates that it was sent by. ------ Identify a now

3. B will use the data signature decrypted by a's public key, and B will use a one-way encryption algorithm to encrypt the data, so that the signature is compared with the one decrypted by the public key, if they are the same, the data is complete. ---------- the data integrity can be determined here.

 

How to obtain the public key of the other party reliably? The CA certificate authority is introduced here.

A asks for a certificate from the ca. After the CA reviews the certificate, it issues the certificate.

How to ensure the integrity of the certificate during certificate issuance:

CA encryption: Ca generates a certificate based on the information provided by a, and performs one-way encryption on the certificate. Data fingerprints are generated and placed on the back of the certificate, CA encrypts the entire data (certificate + Data fingerprint) with its own private key and sends it to.

A. decrypt and verify the certificate.

1. After receiving the certificate, a will use the CA's public key for decryption. If the certificate can be decrypted, the certificate is issued by the CA.

2. A calculates the data signature using one-way encryption and compares it with the signature decrypted using the CA Public Key. The same result indicates that the certificate is complete ------ the certificate integrity can be obtained, the string has not been modified during transmission.

 

Public key encryption algorithm:

RSA: user authentication and data encryption and decryption

DSA: can only be used for identity authentication.

One-way encryption algorithm:

MD5: 128 bits

Sha1: 160 bits

Sha256

Sha384

Sha512

Symmetric encryption algorithm:

Des, Data Encryption Standard, switch to turbine. 56-bit key algorithm

3DES, which is three times more secure than DES

AES: currently common advanced encryption algorithms, 128-bit, 256-bit, 512,384,

 

 

 

Basic command usage and example:

# OpenSSL version # view OpenSSL version information

# OpenSSL speed md4 # Time used by the md4 data encryption module

# OpenSSL ENC-des3-a-salt-in/path/from/somefile-out/path/to/somecipherfile # symmetric encryption format

# OpenSSL ENC-D-des3-a-salt-in/path/from/somecipherfile-out/path/to/somefile # symmetric encryption format

ENC # symmetric algorithm

-Des3 # encryption mechanism

-A # uses base64 to process data

-Salt # add some condiments

-In # input path

-Out # output path

Example: encrypt [[email protected] # OpenSSL ENC-des3-a-salt-in Ning. Repo. Old-out ningrepo

Enterdes-ede3-cbc encryption Password:

Verifying-enter des-ede3-cbc encryption password:

# OpenSSL DGST [-MD5 |-sha1] [-out/path/to/filename]/path/from/somefile # One-way encryption format and specify the path

Example: [[email protected]/] # OpenSSL DGST-MD5-out/Hong inittab --- output to the specified file

[[Email protected]/] # Cat Hong

MD5 (inittab) = f7b815b0638534e8aab5b3ece75a6ae

# OpenSSL passwd-1-salt 12345 --------- generate User Password

-1: MD5 Encryption Algorithm

-Salt12345: Specify the seasoning by yourself

# OpenSSL rand-base64 |-hex num --- generate a random number:

Example:

[[Email protected]/] # OpenSSL rand-hex 4

Cc86f4c0

Generate private key:

# (Umask 077; OpenSSL genrsa-out/path/to/keyfilenumberofbits) the current user generates the private key and stores it in the specified file, and gives the generated private key file a permission.

Example: [Roo [email protected] yum. Repos. d] # (umask 077; OpenSSL genrsa-out ning3 2048)

Generating RSA private key, 2048 bitlong Modulus

... + +

........................................ ........................................ ......................... ++

E is 65537 (0x10001)

Extract public key:

# OpenSSL RSA-in/path/from/private_key_file-pubout

Example: [[email protected]/] # OpenSSL RSA-In ning3-pubout-out ning4 --- output the proposed public key to a file

Writing RSA key

This article from the "struggle" blog, please be sure to keep this source http://wodemeng.blog.51cto.com/1384120/1534121