Encrypting and Decrypting Private Key Files with OpenSSL

Welcome to another informative lesson on OpenSSL! In this video, we will explore the commands related to inspecting RSA, DSA, and elliptic curve keys. Today, we will focus on adding and removing encryption from private key files.

Examining the RSA Key Files

Before we dive into the encryption process, let’s take a quick look at the RSA key files we generated in previous lessons. We have three files: rsa_key1, rsa_key2, and rsa_key3. The first file is an unencrypted key, while the other two are encrypted with AES 128 and DES, respectively.

To view the files in the directory, we can use the command:

$ ls rsa*

Adding Encryption to a Private Key File

Now, let’s say we need to import one of these key files into a device that expects it to be encrypted. We can easily add encryption to an unencrypted key file using the following command:

$ openssl rsa -aes192 -in rsa_key1 -out rsa_key1_encrypted.pem

In this example, we chose to use AES-192 encryption. After executing the command, OpenSSL will prompt you to enter a passphrase to encrypt the file. For demonstration purposes, we will use “pracnet” as the passphrase.

Once the encryption process is complete, you will find a new file in the directory named rsa_key1_encrypted.pem. This file will have an encrypted header indicating the encryption algorithm used.

Removing Encryption from a Private Key File

Conversely, if we need to remove encryption from a key file, we can use the following command:

$ openssl rsa -in rsa_key1_encrypted.pem -out rsa_key1_decrypted.pem

Here, OpenSSL extracts the unencrypted key from the encrypted file and saves it as rsa_key1_decrypted.pem. Note that we don’t need to provide any additional arguments as the default behavior of OpenSSL is to output the unencrypted file in PEM format.

To decrypt the file, you will be prompted to enter the passphrase used during encryption.

Verifying File Integrity

To ensure that the decrypted file is identical to the original unencrypted file, we can compare their SHA-1 hashes. The SHA-1 hashing algorithm calculates a digest that uniquely represents the contents of a file.

We can calculate the SHA-1 hash of both files using the following command:

$ sha1sum rsa_key1*

The resulting digests can be compared to validate the integrity of the files. If the digests match, it confirms that the original and decrypted files are 100% identical.

FAQs

Q: Can I use a different encryption algorithm when adding encryption?
Yes, you can choose from various symmetric encryption algorithms like AES-128, AES-192, or AES-256 to encrypt your private key files.

Q: What if I forget the passphrase used to encrypt a private key file?
If you forget the passphrase, there is no way to recover it. Make sure to keep a secure record of the passphrase to prevent data loss.

Conclusion

In this lesson, we learned how to add and remove encryption from RSA key files using OpenSSL. This skill is essential for engineers and system administrators who need to import key files into devices that expect specific encryption formats.

Stay tuned for our next lesson, where we will explore the PKey utility in OpenSSL. Thank you for watching, and we hope you found this video informative. For more technology-related content, visit Techal.