mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-03-19 19:50:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add EC key generation paragraph in doc/HOWTO/keys.txt

Browse Source 
Seems this documentation is not dead, so add this missing part

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4037)
This commit is contained in:
Paul Yang 2017-07-28 15:11:48 +08:00 committed by Andy Polyakov
parent 07c54e598c
commit 003ef7ef9a
1 changed files with 46 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
doc/HOWTO/keys.txt
View File

@ -27,12 +27,6 @@ With this variant, you will be prompted for a protecting password. If
you don't want your key to be protected by a password, remove the flag
'-des3' from the command line above.
NOTE: if you intend to use the key together with a server
certificate, it may be a good thing to avoid protecting it
with a password, since that would mean someone would have to
type in the password every time the server needs to access
the key.
The number 2048 is the size of the key, in bits. Today, 2048 or
higher is recommended for RSA keys, as fewer amount of bits is
consider insecure or to be insecure pretty soon.
@ -62,11 +56,50 @@ With this variant, you will be prompted for a protecting password. If
you don't want your key to be protected by a password, remove the flag
'-des3' from the command line above.
NOTE: if you intend to use the key together with a server
certificate, it may be a good thing to avoid protecting it
with a password, since that would mean someone would have to
type in the password every time the server needs to access
the key.
--
Richard Levitte
4. To generate an EC key
An EC key can be used both for key agreement (ECDH) and signing (ECDSA).
Generating a key for ECC is similar to generating a DSA key. These are
two-step processes. First, you have to get the EC parameters from which
the key will be generated:
openssl ecparam -name prime256v1 -out prime256v1.pem
The prime256v1, or NIST P-256, which stands for 'X9.62/SECG curve over
a 256-bit prime field', is the name of an elliptic curve which generates the
parameters. You can use the following command to list all supported curves:
openssl ecparam -list_curves
When that is done, you can generate a key using the created parameters (several
keys can be produced from the same parameters):
openssl genpkey -des3 -paramfile prime256v1.pem -out private.key
With this variant, you will be prompted for a password to protect your key.
If you don't want your key to be protected by a password, remove the flag
'-des3' from the command line above.
You can also directly generate the key in one step:
openssl ecparam -genkey -name prime256v1 -out private.key
or
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256
5. NOTE
If you intend to use the key together with a server certificate,
it may be reasonable to avoid protecting it with a password, since
otherwise someone would have to type in the password every time the
server needs to access the key.
For X25519, it's treated as a distinct algorithm but not as one of
the curves listed with 'ecparam -list_curves' option. You can use
the following command to generate an X25519 key:
openssl genpkey -algorithm X25519 -out xkey.pem