8

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key file, it starts and ends with -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----, which gives feeling that this file is just the private key. Why is that? This makes me very confused.

If I want to encrypt a message using private key, do I apply the entire yourdomain.key key? Or should I extract the private key part from it and use that?

12

Do not use the OpenSSL command line to encrypt or sign anything. The OpenSSL command line is a debugging tool. To encrypt or sign a message, use a tool designed for this purpose, such as GPG.

A private key file contains all the information needed to construct the public key. If you have a private key in a format that OpenSSL understands and you want to get the corresponding public key, you can use openssl pkey -pubout …. But that's not the format GPG needs. GPG generates its own keys.

  • 4
    "The OpenSSL command line is a debugging tool." Why would that disqualify it? You could still use the generated key to encrypt a message, right? Whether it's compatible with GPG is another matter. – Mast Sep 18 at 9:11
  • 8
    It's not a debugging tool. It's perfectly fine to use it to encrypt things. GPG is just easier to use so you're less likely to do the wrong thing. – Stop Harming Monica Sep 18 at 9:38
  • 1
    @LightnessRacesinOrbit Precisely: the question makes an incorrect (but excusable) assumption that openssl is in any way a usable tool to encrypt data. You can do it if you know exactly what you're doing and you avoid the myriad ways to do it wrong and you don't care about using any standard format. It's one of those things where if you need to ask, don't do it. – Gilles 'SO- stop being evil' Sep 18 at 10:20
  • 1
    Except they did ask, and so now they know how to do it. – Lightness Races with Monica Sep 18 at 10:55
  • 3
    @LightnessRacesinOrbit No. They now know how to get something that works functionally. We're on Information Security, getting something that works functionally is not the goal. – Gilles 'SO- stop being evil' Sep 18 at 11:23
10

The private key is used to decrypt, and to sign things. You don't use it to encrypt. You use the public key for that. But openssl genrsa will not generate the public key, only the private. To encrypt things, you must first generate the public key (so you have a keypair: private and public):

openssl rsa -in yourdomain.key -outform PEM -pubout -out public.pem

This will create public.pem file with, well, the public key. Use it to encript the file:

openssl rsautl -encrypt -inkey public.pem  -pubin -in file.txt -out file.enc

To decrypt later, you use the private key:

openssl rsautl -decrypt -inkey yourdomain.key -in file.enc  -out file.dec
  • 1
    what do you think signing is if not encrypting information? Related: security.stackexchange.com/questions/9957/… – eis Sep 18 at 5:21
  • but in general, of course, you're correct, and this answer is probably what OP needs – eis Sep 18 at 5:23
  • 1
    "You don't use it to encrypt" Depends on what you're trying to do, obviously. – Hugo Zink Sep 18 at 8:31
  • 1
    @eis As I understand it, signing usually involves only encrypting a hash of the data being signed: the data itself usually isn't encrypted (as part of the signing process). – TripeHound Sep 18 at 9:26
  • @eis Signing is not encrypting. Not at all. They're completely different operations. Even with RSA. RSA is more than just the exponentiation operation, which is the only part that works the same in both direction. Key generation and encoding are completely different. – Gilles 'SO- stop being evil' Sep 18 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.