0

Is there anyway to generate, sign, verify, and use ECDH keys with OpenSSL on the command line? I'm somewhat familiar with the normal Diffie-Hellman facilities that the utility provides, but I cannot see anything about the elliptic curve variant.

Improve this question
0

For signatures you would need ECDSA, not ECDH – the latter is a key exchange algorithm, mostly used for encryption.

There's openssl dgst -sign:

openssl dgst -sha256 -sign <priv_key_file> -out <sig_file> <data_file>

There's also openssl pkeyutl:

openssl pkeyutl -sign -in <data_file> -inkey <priv_key_file> -out <sig_file>

(Note that pkeyutl only supports SHA1 with ECDSA; -pkeyopt digest:sha256 is only accepted with RSA keys. Meanwhile dgst seems to work with all digests, but I'm not 100% sure about it.)

Other tools exist, such as ecdsatool.

If you have an ECDSA-based X.509 certificate, you would want openssl cms.

Improve this answer
  • No, no, no, no, no. Signing an ECDH public key. – Melab Apr 6 '16 at 19:38
  • Signing the key itself? – user1686 Apr 6 '16 at 20:00
  • Yes, the elliptic curve Diffie-Hellman public key file so it can be verified by the receiving party. – Melab Apr 6 '16 at 20:16
  • Well, you sign DH keys just like you would sign any other data. And that depends on what kind of signing key you have... – user1686 Apr 6 '16 at 20:17
  • What is openssl cms used for? – Melab Apr 6 '16 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.