We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below,
Following command will be used to generate symmetric key of 128 bit length
openssl rand 16 > ./symmetric.key
we will use following commands to create private and public keys in PKCS#8 format
openssl genrsa 4096 | openssl pkcs8 -inform PEM -topk8 -v2 aes-128-cbc -nocrypt -out keyfile.pem
openssl pkey -inform PEM -in keyfile.pem -pubout -out keyfile_pkcs.pub
For encrypting firmware we will use following command
openssl enc -in firmware.tar -aes-128-cbc -salt -out firmware.enc -pass file:./symmetric.key
We have two choices to encrypt/decrypt symmetric key at board side,
Option 1. Encrypt symmetric key using public key at server and decrypt it using private key at board.
We thought of using following command sets,
openssl pkeyutl -encrypt -pubin -inkey keyfile_pkcs.pub -in symmetric.key -out symmetric.key.enc
openssl pkeyutl -decrypt -inkey keyfile.pem -in symmetric.key.enc -out decrypted_symmetric.key
Option 2. Encrypt(sign) it using private key at server and decrypt(verifyrecover) it using public key at board. We thought of using following command sets,
openssl pkeyutl -sign -inkey keyfile.pem -in symmetric.key -out symmetric.key.enc
openssl pkeyutl -verifyrecover -pubin -inkey keyfile_pkcs.pub -in symmetric.key.enc -out decrypted_symmetric.key
EDIT Just for completeness putting command to decrypt firmware file using symmetric key.
openssl enc -d -aes-128-cbc -in firmware.enc -pass file:./decrypted_symmetric.key -out firmware.tar
Now being new to this cryptography and OpenSSL we have following doubts,
Doubt 1: Which option to choose for encrypting symmetric key? (option 1 or option 2)
Doubt 2: Do you suggest any improvements in above commands? Do you see any problem in this method ?
Any other suggestion/correction/pointers ?