介紹如何以 OpenSSL 的指令實作橢圓曲線 ECDH 金鑰交換,並參考 ECIES 加密架構,搭配 AES 演算法加密資料。
OpenSSL 指令實作 ECDH 金鑰交換
橢圓曲線迪菲-赫爾曼(Elliptic Curve Diffie–Hellman,簡稱 ECDH)金鑰交換方法是雙方利用由橢圓曲線密碼學建立的公鑰與私鑰對,在一個不安全的通道中,建立一組雙方共享的密鑰。
OpenSSL 支援的橢圓曲線很多,我們可以使用以下指令查詢:
# 查詢 OpenSSL 支援的橢圓曲線 openssl ecparam -list_curves
secp112r1 : SECG/WTLS curve over a 112 bit prime field secp112r2 : SECG curve over a 112 bit prime field secp128r1 : SECG curve over a 128 bit prime field secp128r2 : SECG curve over a 128 bit prime field secp160k1 : SECG curve over a 160 bit prime field secp160r1 : SECG curve over a 160 bit prime field secp160r2 : SECG/WTLS curve over a 160 bit prime field secp192k1 : SECG curve over a 192 bit prime field secp224k1 : SECG curve over a 224 bit prime field secp224r1 : NIST/SECG curve over a 224 bit prime field secp256k1 : SECG curve over a 256 bit prime field secp384r1 : NIST/SECG curve over a 384 bit prime field secp521r1 : NIST/SECG curve over a 521 bit prime field prime192v1: NIST/X9.62/SECG curve over a 192 bit prime field prime192v2: X9.62 curve over a 192 bit prime field prime192v3: X9.62 curve over a 192 bit prime field prime239v1: X9.62 curve over a 239 bit prime field prime239v2: X9.62 curve over a 239 bit prime field prime239v3: X9.62 curve over a 239 bit prime field prime256v1: X9.62/SECG curve over a 256 bit prime field sect113r1 : SECG curve over a 113 bit binary field sect113r2 : SECG curve over a 113 bit binary field sect131r1 : SECG/WTLS curve over a 131 bit binary field sect131r2 : SECG curve over a 131 bit binary field sect163k1 : NIST/SECG/WTLS curve over a 163 bit binary field sect163r1 : SECG curve over a 163 bit binary field sect163r2 : NIST/SECG curve over a 163 bit binary field sect193r1 : SECG curve over a 193 bit binary field sect193r2 : SECG curve over a 193 bit binary field sect233k1 : NIST/SECG/WTLS curve over a 233 bit binary field sect233r1 : NIST/SECG/WTLS curve over a 233 bit binary field sect239k1 : SECG curve over a 239 bit binary field sect283k1 : NIST/SECG curve over a 283 bit binary field sect283r1 : NIST/SECG curve over a 283 bit binary field sect409k1 : NIST/SECG curve over a 409 bit binary field sect409r1 : NIST/SECG curve over a 409 bit binary field sect571k1 : NIST/SECG curve over a 571 bit binary field sect571r1 : NIST/SECG curve over a 571 bit binary field c2pnb163v1: X9.62 curve over a 163 bit binary field c2pnb163v2: X9.62 curve over a 163 bit binary field c2pnb163v3: X9.62 curve over a 163 bit binary field c2pnb176v1: X9.62 curve over a 176 bit binary field c2tnb191v1: X9.62 curve over a 191 bit binary field c2tnb191v2: X9.62 curve over a 191 bit binary field c2tnb191v3: X9.62 curve over a 191 bit binary field c2pnb208w1: X9.62 curve over a 208 bit binary field c2tnb239v1: X9.62 curve over a 239 bit binary field c2tnb239v2: X9.62 curve over a 239 bit binary field c2tnb239v3: X9.62 curve over a 239 bit binary field c2pnb272w1: X9.62 curve over a 272 bit binary field c2pnb304w1: X9.62 curve over a 304 bit binary field c2tnb359v1: X9.62 curve over a 359 bit binary field c2pnb368w1: X9.62 curve over a 368 bit binary field c2tnb431r1: X9.62 curve over a 431 bit binary field wap-wsg-idm-ecid-wtls1: WTLS curve over a 113 bit binary field wap-wsg-idm-ecid-wtls3: NIST/SECG/WTLS curve over a 163 bit binary field wap-wsg-idm-ecid-wtls4: SECG curve over a 113 bit binary field wap-wsg-idm-ecid-wtls5: X9.62 curve over a 163 bit binary field wap-wsg-idm-ecid-wtls6: SECG/WTLS curve over a 112 bit prime field wap-wsg-idm-ecid-wtls7: SECG/WTLS curve over a 160 bit prime field wap-wsg-idm-ecid-wtls8: WTLS curve over a 112 bit prime field wap-wsg-idm-ecid-wtls9: WTLS curve over a 160 bit prime field wap-wsg-idm-ecid-wtls10: NIST/SECG/WTLS curve over a 233 bit binary field wap-wsg-idm-ecid-wtls11: NIST/SECG/WTLS curve over a 233 bit binary field wap-wsg-idm-ecid-wtls12: WTLS curve over a 224 bit prime field Oakley-EC2N-3: IPSec/IKE/Oakley curve #3 over a 155 bit binary field. Not suitable for ECDSA. Questionable extension field! Oakley-EC2N-4: IPSec/IKE/Oakley curve #4 over a 185 bit binary field. Not suitable for ECDSA. Questionable extension field! brainpoolP160r1: RFC 5639 curve over a 160 bit prime field brainpoolP160t1: RFC 5639 curve over a 160 bit prime field brainpoolP192r1: RFC 5639 curve over a 192 bit prime field brainpoolP192t1: RFC 5639 curve over a 192 bit prime field brainpoolP224r1: RFC 5639 curve over a 224 bit prime field brainpoolP224t1: RFC 5639 curve over a 224 bit prime field brainpoolP256r1: RFC 5639 curve over a 256 bit prime field brainpoolP256t1: RFC 5639 curve over a 256 bit prime field brainpoolP320r1: RFC 5639 curve over a 320 bit prime field brainpoolP320t1: RFC 5639 curve over a 320 bit prime field brainpoolP384r1: RFC 5639 curve over a 384 bit prime field brainpoolP384t1: RFC 5639 curve over a 384 bit prime field brainpoolP512r1: RFC 5639 curve over a 512 bit prime field brainpoolP512t1: RFC 5639 curve over a 512 bit prime field SM2 : SM2 curve over a 256 bit prime field
我們可以使用以下指令查看特定橢圓曲線的實際參數:
# 顯示 secp256k1 橢圓曲線參數 openssl ecparam -name secp256k1 -param_enc explicit -text -noout
EC-Parameters: (256 bit) Field Type: prime-field Prime: 00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff: ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:fe:ff: ff:fc:2f A: 0 B: 7 (0x7) Generator (uncompressed): 04:79:be:66:7e:f9:dc:bb:ac:55:a0:62:95:ce:87: 0b:07:02:9b:fc:db:2d:ce:28:d9:59:f2:81:5b:16: f8:17:98:48:3a:da:77:26:a3:c4:65:5d:a4:fb:fc: 0e:11:08:a8:fd:17:b4:48:a6:85:54:19:9c:47:d0: 8f:fb:10:d4:b8 Order: 00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff: ff:fe:ba:ae:dc:e6:af:48:a0:3b:bf:d2:5e:8c:d0: 36:41:41 Cofactor: 1 (0x1)
確認要採用的橢圓曲線之後,即可產生私鑰,由於我們要模擬兩方透過不安全的通道建立共享密鑰,所以這裡的操作會區分為甲方與乙方,事實上雙方的指令都是相同的。
# 產生 secp256k1 橢圓曲線私鑰(甲方) openssl ecparam -name secp256k1 -genkey -noout -out secp256k1_priv_key_1.pem
執行之後,產生的私鑰會儲存於 secp256k1_priv_key_1.pem
這個檔案中,我們可以查看私鑰的內容:
# 查看私鑰內容(甲方)
cat secp256k1_priv_key_1.pem
-----BEGIN EC PRIVATE KEY----- MHQCAQEEIJDuX0R1BbAx2PDe67bnUHMz4PCnNpMg6f41NOaoY0BpoAcGBSuBBAAK oUQDQgAEtzO2oa+wc884MGzZBn2tXciAW5AGlCLor00S6FnFFUPZHo9HEn4wAGTR hTmFn/KRvRdm8Lk3EEQ5rY+KJYRZ/g== -----END EC PRIVATE KEY-----
接著再從這把私鑰產生對應的公鑰:
# 從私鑰產生對應的公鑰(甲方) openssl ec -in secp256k1_priv_key_1.pem -pubout -out secp256k1_pub_key_1.pem
read EC key writing EC key
查看公鑰內容:
# 查看公鑰內容(甲方)
cat secp256k1_pub_key_1.pem
-----BEGIN PUBLIC KEY----- MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEtzO2oa+wc884MGzZBn2tXciAW5AGlCLo r00S6FnFFUPZHo9HEn4wAGTRhTmFn/KRvRdm8Lk3EEQ5rY+KJYRZ/g== -----END PUBLIC KEY-----
乙方也按照同樣的方式,產生另外一對私鑰與公鑰:
# 產生 secp256k1 橢圓曲線私鑰(乙方) openssl ecparam -name secp256k1 -genkey -noout -out secp256k1_priv_key_2.pem # 從私鑰產生對應的公鑰(乙方) openssl ec -in secp256k1_priv_key_2.pem -pubout -out secp256k1_pub_key_2.pem
當雙方都以相同的橢圓曲線建立私鑰與公鑰之後,即可將各自的公鑰傳輸給對方,接著各自以對方的公鑰加上自己的私鑰產生共享密鑰:
# 產生共享密鑰(甲方) openssl pkeyutl -derive -inkey secp256k1_priv_key_1.pem \ -peerkey secp256k1_pub_key_2.pem -out secret_key_1.bin # 產生共享密鑰(乙方) openssl pkeyutl -derive -inkey secp256k1_priv_key_2.pem \ -peerkey secp256k1_pub_key_1.pem -out secret_key_2.bin
這樣甲方所產生的密鑰 secret_key_1.bin
與乙方所產生的密鑰 secret_key_2.bin
就會是相同的,我們可以查看其內容:
# 查看密鑰內容(甲方) od -x secret_key_1.bin
0000000 9f5a 1f06 4f5e f0bf cf1e ba0e 1730 cbb0 0000020 4cfc fa58 484b 3699 d13f 6f77 a291 bec7 0000040
# 查看密鑰內容(乙方) od -x secret_key_2.bin
0000000 9f5a 1f06 4f5e f0bf cf1e ba0e 1730 cbb0 0000020 4cfc fa58 484b 3699 d13f 6f77 a291 bec7 0000040
當雙方產生了相同的共享密鑰 secret_key_1.bin
與 secret_key_2.bin
之後,即可使用 AES 這類的對稱式加密方式來加密所有的訊息:
# 產生原始訊息檔案(甲方) echo 'top secret!!!' > message.txt # 使用密鑰檔案以 AES-256 加密(甲方) openssl enc -aes256 -pbkdf2 -pass file:./secret_key_1.bin \ -in message.txt -out message.txt.enc # 使用密鑰檔案以 AES-256 解密(乙方) openssl enc -aes256 -d -pbkdf2 -pass file:./secret_key_2.bin \ -in message.txt.enc -out message.txt.output
這裡使用 -pass 讀取密碼檔時,根據手冊說明,只會讀取密碼檔案中的第一行,所以可能對於二進位檔案會有讀取不完全的問題。
依據 ECIES 的架構,經過 ECDH 產生的密鑰要先經過 KDF 處理之後,才會作為 AES 加密的金鑰,跟這裡 OpenSSL 指令的實作方式有些差異,對於正式的環境,建議採用其他的標準的實作方式。
OpenSSL 指令實作 X25519
X25519 是將 Curve25519 作為 DH 函數並實作 ECDH 金鑰交換的方法,然而 X25519 並不屬於標準的橢圓曲線,所以在 OpenSSL 中的指令與標準的橢圓曲線不同,不能以 ecparams
或 ec
指令來進行 X25519 的操作,必須改用 genpkey
,以下是使用 OpenSSL 指令實作 X25519 的流程。
以下同樣將指令分為甲、乙兩方,首先產生 X25519 的私鑰與公鑰:
# 產生 X25519 的私鑰(甲方) openssl genpkey -algorithm X25519 -out x25519_priv_key_1.pem # 從私鑰產生對應的公鑰(甲方) openssl pkey -pubout -in x25519_priv_key_1.pem -out x25519_pub_key_1.pem # 產生 X25519 的私鑰(乙方) openssl genpkey -algorithm X25519 -out x25519_priv_key_2.pem # 從私鑰產生對應的公鑰(乙方) openssl pkey -pubout -in x25519_priv_key_2.pem -out x25519_pub_key_2.pem
雙方交換公鑰之後,即可用自己的私鑰加上對方的公鑰產生共享密鑰:
# 產生共享密鑰(甲方) openssl pkeyutl -derive -inkey x25519_priv_key_1.pem \ -peerkey x25519_pub_key_2.pem -out secret_key_1.bin # 產生共享密鑰(乙方) openssl pkeyutl -derive -inkey x25519_priv_key_2.pem \ -peerkey x25519_pub_key_1.pem -out secret_key_2.bin
產生共享密鑰之後,後續就可以按照一般的方式採用 AES-256 進行資料的加密了。