Is there anyway to generate, sign, verify, and use ECDH keys with OpenSSL on the command line? I'm somewhat familiar with the normal Diffie-Hellman facilities that the utility provides, but I cannot see anything about the elliptic curve variant.
For signatures you would need ECDSA, not ECDH – the latter is a key exchange algorithm, mostly used for encryption.
There's openssl dgst -sign
:
openssl dgst -sha256 -sign <priv_key_file> -out <sig_file> <data_file>
There's also openssl pkeyutl
:
openssl pkeyutl -sign -in <data_file> -inkey <priv_key_file> -out <sig_file>
(Note that pkeyutl
only supports SHA1 with ECDSA; -pkeyopt digest:sha256
is only accepted with RSA keys. Meanwhile dgst
seems to work with all digests, but I'm not 100% sure about it.)
Other tools exist, such as ecdsatool.
If you have an ECDSA-based X.509 certificate, you would want openssl cms
.