OpenSSL is a library for general-purpose cryptography. OpenSSL is also an open-source command line tool that is commonly used to generate private keys, create CSRs, install your SSL/TLS certificate, and identify certificate information.
export LD_LIBRARY_PATH=<path till lib dir>./bin/opensslversion-a
Commands
These commands are for "secp384r1" curve. The same applies to other supported curves.
# check the version of opensslopensslversion-a# Get a random numberopensslrand-hex64# Generate Private key for secp384 curveopensslecparam-genkey-namesecp384r1-outprivatekey.pem# Generate Certificate for a given private key openssl req -new -sha256 -key privatekey.pem -out csr.csr -subj "/C=US/ST=FL/L=Orlando/O=Foo LLC/OU=IT/CN=www.example.com"
# Generate Public key for given private key and certificate.opensslreq-x509-sha256-days365-keyprivatekey.pem-incsr.csr-outpublickey.pem# Start server instance on port 8443openssls_server-tls1_3-accept8443-certpublickey.pem-curvessecp384r1-keyprivatekey.pem# Connect to the server with the clientopenssls_client-tls1_3-curvessecp384r1-connect<server_ip>:8443
-engine <engine name> : Accelarate with specified engine
-tls1_3 : Use TLSv1.3 for communication
-quiet: less verbose
-rand <path to node > : use the specified random number from node instead of kernel entrophy
API's
Leverage custom engine
OpenSSL provides flexibility to offload operations onto custom HW. The below code leverages the engine to perform all OpenSSL operations
ENGINE_load_builtin_engines();ENGINE *e =ENGINE_by_id("engine name");// Make the engine's implementations the default implementationsENGINE_init(e)ENGINE_set_default_digests(e)// Set default engineENGINE_set_default(e, ENGINE_METHOD_ALL);// Free the engineENGINE_free(e);ENGINE_cleanup();
// Allocates memory for key pairEC_KEY *eckey=EC_KEY_new();// Assign curve to the keypairEC_GROUP *ecgroup=EC_GROUP_new_by_curve_name(NID_secp384r1);// Map the keypair and curveset_group_status =EC_KEY_set_group(eckey,ecgroup);// Generate key pair, it will offload to engine,// performs 2 PM operations.gen_status =EC_KEY_generate_key(eckey);//Free the handlersEC_GROUP_free(ecgroup);EC_KEY_free(eckey);
Sign Key
// Sign the key with given hashECDSA_SIG *signature;signature =ECDSA_do_sign(hash,strlen(hash), eckey);// Free SignatureECDSA_SIG_free(signature);
// Perform point multiplicationret =EC_POINT_mul(ecgroup, pub_key, privKeyBN,NULL,NULL, ctx);
Engine
OpenSSL provides flexibility to offload operations onto custom HW.
openssl command searches for the custom engine library (so) in
default : /usr/lib/engines-1.1/
OpenSSL : <path to openssl>/lib/engines-1.1/
Check Custom Engine
openssl engine <engine name>
-engine <engine name>
Benchmarking
# Benchmark all curves ecdsa operationsopensslspeed-elapsedecdsa# Benchmark single curve ecdsa operationsopensslspeed-elapsedecdsap384# Benchmark all curves point multiplicationopensslspeed-elapsedecdh# Benchmark single curve point multiplicationopensslspeed-elapsedecdhp384
-elapsed gives wall clock time ( actual time lapse ).
Without elapsed it measures only active CPU time.
-multi <n> : runs on multiple instances on multiple cores.