Cyberstudy
Supplementary — not from your PDF Intermediate ~40 min

Encrypt, decrypt and sign with OpenSSL

Use symmetric encryption on a file, then create an RSA key pair to sign and verify it, which ties together three sections of Lesson 3.

Environment

A Linux VM, WSL, or Git Bash on Windows (it includes openssl). Work in an empty practice folder.

Before you start

  • Read Symmetric Encryption (p.50), Asymmetric Encryption (p.53) and Digital Signatures (p.55).

You will

  • Encrypt and decrypt a file with AES-256
  • Generate an RSA key pair
  • Sign a file and verify the signature

Steps

  1. 1

    Create a file: echo "quarterly report" > report.txt.

  2. 2

    Encrypt it with a passphrase: openssl enc -aes-256-cbc -pbkdf2 -salt -in report.txt -out report.enc. Open report.enc and see it's unreadable.

  3. 3

    Decrypt it: openssl enc -d -aes-256-cbc -pbkdf2 -in report.enc -out report.dec.txt, then compare with the original.

  4. 4

    Generate a key pair: openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem, then openssl pkey -in private.pem -pubout -out public.pem.

  5. 5

    Sign the file: openssl dgst -sha256 -sign private.pem -out report.sig report.txt.

  6. 6

    Verify it: openssl dgst -sha256 -verify public.pem -signature report.sig report.txt. You should see 'Verified OK'.

  7. 7

    Change one character in report.txt and verify again. It should now fail.

Check your understanding

  • ?Which key did you share, and which must never leave your machine?
  • ?What does the -pbkdf2 option do, and which section of your guide explains why it matters?
  • ?Why does verification fail after a one-character change?