openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_RSA_keygen.c

这篇具有很好参考价值的文章主要介绍了openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_RSA_keygen.c。希望对大家有所帮助。如果存在错误或未考虑完全的地方,请大家不吝赐教,您也可以点击"举报违法"按钮提交疑问。

openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_RSA_keygen.c

概述

官方指出 : RSA key 如果小于2048位, 就属于弱key
官方demo中, 给出的默认key长度为4096位

从名字生成上下文
初始化上下文
设置上下的key位数
设置质数数量为2
产生RSA Key. (在我的本本上, 单步调试时, 感觉产生 RSA key时, 卡了一下, 大概不到1秒钟)
打印rsa key内容(可以得到 n, e, d, p, q, key的位数, 公钥, 私钥)
PEM_write_x时, 如果文件句柄是具体的文件, 就是将公钥/密钥保存成了PEM文件.文章来源地址https://www.toymoban.com/news/detail-798786.html

笔记

/*!
\file EVP_PKEY_RSA_keygen.c
\note
openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_RSA_keygen.c

官方指出 : RSA key 如果小于2048位, 就属于弱key
官方demo中, 给出的默认key长度为4096位

从名字生成上下文
初始化上下文
设置上下的key位数
设置质数数量为2
产生RSA Key. (在我的本本上, 单步调试时, 感觉产生 RSA key时, 卡了一下, 大概不到1秒钟)
打印rsa key内容(可以得到 n, e, d, p, q, key的位数, 公钥, 私钥)
PEM_write_x时, 如果文件句柄是具体的文件, 就是将公钥/密钥保存成了PEM文件.
*/

/*-
 * Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

 /*
  * Example showing how to generate an RSA key pair.
  *
  * When generating an RSA key, you must specify the number of bits in the key. A
  * reasonable value would be 4096. Avoid using values below 2048. These values
  * are reasonable as of 2022.
  */

#include <string.h>
#include <stdio.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/core_names.h>
#include <openssl/pem.h>

#include "my_openSSL_lib.h"

  /* A property query used for selecting algorithm implementations. */
static const char* propq = NULL;

/*
 * Generates an RSA public-private key pair and returns it.
 * The number of bits is specified by the bits argument.
 *
 * This uses the long way of generating an RSA key.
 */
static EVP_PKEY* generate_rsa_key_long(OSSL_LIB_CTX* libctx, unsigned int bits)
{
	EVP_PKEY_CTX* genctx = NULL;
	EVP_PKEY* pkey = NULL;
	unsigned int primes = 2;

	/* Create context using RSA algorithm. "RSA-PSS" could also be used here. */
	genctx = EVP_PKEY_CTX_new_from_name(libctx, "RSA", propq);
	if (genctx == NULL) {
		fprintf(stderr, "EVP_PKEY_CTX_new_from_name() failed\n");
		goto cleanup;
	}

	/* Initialize context for key generation purposes. */
	if (EVP_PKEY_keygen_init(genctx) <= 0) {
		fprintf(stderr, "EVP_PKEY_keygen_init() failed\n");
		goto cleanup;
	}

	/*
	 * Here we set the number of bits to use in the RSA key.
	 * See comment at top of file for information on appropriate values.
	 */
	if (EVP_PKEY_CTX_set_rsa_keygen_bits(genctx, bits) <= 0) {
		fprintf(stderr, "EVP_PKEY_CTX_set_rsa_keygen_bits() failed\n");
		goto cleanup;
	}

	/*
	 * It is possible to create an RSA key using more than two primes.
	 * Do not do this unless you know why you need this.
	 * You ordinarily do not need to specify this, as the default is two.
	 *
	 * Both of these parameters can also be set via EVP_PKEY_CTX_set_params, but
	 * these functions provide a more concise way to do so.
	 */
	if (EVP_PKEY_CTX_set_rsa_keygen_primes(genctx, primes) <= 0) {
		fprintf(stderr, "EVP_PKEY_CTX_set_rsa_keygen_primes() failed\n");
		goto cleanup;
	}

	/*
	 * Generating an RSA key with a number of bits large enough to be secure for
	 * modern applications can take a fairly substantial amount of time (e.g.
	 * one second). If you require fast key generation, consider using an EC key
	 * instead.
	 *
	 * If you require progress information during the key generation process,
	 * you can set a progress callback using EVP_PKEY_set_cb; see the example in
	 * EVP_PKEY_generate(3).
	 */
	fprintf(stderr, "Generating RSA key, this may take some time...\n");
	if (EVP_PKEY_generate(genctx, &pkey) <= 0) {
		fprintf(stderr, "EVP_PKEY_generate() failed\n");
		goto cleanup;
	}

	/* pkey is now set to an object representing the generated key pair. */

cleanup:
	EVP_PKEY_CTX_free(genctx);
	return pkey;
}

/*
 * Generates an RSA public-private key pair and returns it.
 * The number of bits is specified by the bits argument.
 *
 * This uses a more concise way of generating an RSA key, which is suitable for
 * simple cases. It is used if -s is passed on the command line, otherwise the
 * long method above is used. The ability to choose between these two methods is
 * shown here only for demonstration; the results are equivalent.
 */
static EVP_PKEY* generate_rsa_key_short(OSSL_LIB_CTX* libctx, unsigned int bits)
{
	EVP_PKEY* pkey = NULL;

	fprintf(stderr, "Generating RSA key, this may take some time...\n");
	pkey = EVP_PKEY_Q_keygen(libctx, propq, "RSA", (size_t)bits);

	if (pkey == NULL)
		fprintf(stderr, "EVP_PKEY_Q_keygen() failed\n");

	return pkey;
}

/*
 * Prints information on an EVP_PKEY object representing an RSA key pair.
 */
static int dump_key(const EVP_PKEY* pkey)
{
	int ret = 0;
	int bits = 0;
	BIGNUM* n = NULL, * e = NULL, * d = NULL, * p = NULL, * q = NULL;

	/*
	 * Retrieve value of n. This value is not secret and forms part of the
	 * public key.
	 *
	 * Calling EVP_PKEY_get_bn_param with a NULL BIGNUM pointer causes
	 * a new BIGNUM to be allocated, so these must be freed subsequently.
	 */
	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_N, &n) == 0) {
		fprintf(stderr, "Failed to retrieve n\n");
		goto cleanup;
	}

	/*
	 * Retrieve value of e. This value is not secret and forms part of the
	 * public key. It is typically 65537 and need not be changed.
	 */
	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &e) == 0) {
		fprintf(stderr, "Failed to retrieve e\n");
		goto cleanup;
	}

	/*
	 * Retrieve value of d. This value is secret and forms part of the private
	 * key. It must not be published.
	 */
	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_D, &d) == 0) {
		fprintf(stderr, "Failed to retrieve d\n");
		goto cleanup;
	}

	/*
	 * Retrieve value of the first prime factor, commonly known as p. This value
	 * is secret and forms part of the private key. It must not be published.
	 */
	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_FACTOR1, &p) == 0) {
		fprintf(stderr, "Failed to retrieve p\n");
		goto cleanup;
	}

	/*
	 * Retrieve value of the second prime factor, commonly known as q. This value
	 * is secret and forms part of the private key. It must not be published.
	 *
	 * If you are creating an RSA key with more than two primes for special
	 * applications, you can retrieve these primes with
	 * OSSL_PKEY_PARAM_RSA_FACTOR3, etc.
	 */
	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_FACTOR2, &q) == 0) {
		fprintf(stderr, "Failed to retrieve q\n");
		goto cleanup;
	}

	/*
	 * We can also retrieve the key size in bits for informational purposes.
	 */
	if (EVP_PKEY_get_int_param(pkey, OSSL_PKEY_PARAM_BITS, &bits) == 0) {
		fprintf(stderr, "Failed to retrieve bits\n");
		goto cleanup;
	}

	/* Output hexadecimal representations of the BIGNUM objects. */
	fprintf(stdout, "\nNumber of bits: %d\n\n", bits);
	fprintf(stderr, "Public values:\n");
	fprintf(stdout, "  n = 0x");
	BN_print_fp(stdout, n);
	fprintf(stdout, "\n");

	fprintf(stdout, "  e = 0x");
	BN_print_fp(stdout, e);
	fprintf(stdout, "\n\n");

	fprintf(stdout, "Private values:\n");
	fprintf(stdout, "  d = 0x");
	BN_print_fp(stdout, d);
	fprintf(stdout, "\n");

	fprintf(stdout, "  p = 0x");
	BN_print_fp(stdout, p);
	fprintf(stdout, "\n");

	fprintf(stdout, "  q = 0x");
	BN_print_fp(stdout, q);
	fprintf(stdout, "\n\n");

	/* Output a PEM encoding of the public key. */
	if (PEM_write_PUBKEY(stdout, pkey) == 0) {
		fprintf(stderr, "Failed to output PEM-encoded public key\n");
		goto cleanup;
	}

	/*
	 * Output a PEM encoding of the private key. Please note that this output is
	 * not encrypted. You may wish to use the arguments to specify encryption of
	 * the key if you are storing it on disk. See PEM_write_PrivateKey(3).
	 */
	if (PEM_write_PrivateKey(stdout, pkey, NULL, NULL, 0, NULL, NULL) == 0) {
		fprintf(stderr, "Failed to output PEM-encoded private key\n");
		goto cleanup;
	}

	ret = 1;
cleanup:
	BN_free(n); /* not secret */
	BN_free(e); /* not secret */
	BN_clear_free(d); /* secret - scrub before freeing */
	BN_clear_free(p); /* secret - scrub before freeing */
	BN_clear_free(q); /* secret - scrub before freeing */
	return ret;
}

int main(int argc, char** argv)
{
	int ret = EXIT_FAILURE;
	OSSL_LIB_CTX* libctx = NULL;
	EVP_PKEY* pkey = NULL;
	unsigned int bits = 4096;
	int bits_i, use_short = 0;

	/* usage: [-s] [<bits>] */
	if (argc > 1 && strcmp(argv[1], "-s") == 0) {
		--argc;
		++argv;
		use_short = 1;
	}

	if (argc > 1) {
		bits_i = atoi(argv[1]);
		if (bits < 512) {
			fprintf(stderr, "Invalid RSA key size\n");
			return EXIT_FAILURE;
		}

		bits = (unsigned int)bits_i;
	}

	/* Avoid using key sizes less than 2048 bits; see comment at top of file. */
	if (bits < 2048)
		fprintf(stderr, "Warning: very weak key size\n\n");

	/* Generate RSA key. */
	if (use_short)
		pkey = generate_rsa_key_short(libctx, bits);
	else
		pkey = generate_rsa_key_long(libctx, bits);

	if (pkey == NULL)
		goto cleanup;

	/* Dump the integers comprising the key. */
	if (dump_key(pkey) == 0) {
		fprintf(stderr, "Failed to dump key\n");
		goto cleanup;
	}

	ret = EXIT_SUCCESS;
cleanup:
	EVP_PKEY_free(pkey);
	OSSL_LIB_CTX_free(libctx);
	return ret;
}

END

到了这里,关于openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_RSA_keygen.c的文章就介绍完了。如果您还想了解更多内容,请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章,希望大家以后多多支持TOY模板网!

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处: 如若内容造成侵权/违法违规/事实不符,请点击违法举报进行投诉反馈,一经查实,立即删除!

领支付宝红包 赞助服务器费用

相关文章

  • openssl3.2 - 官方demo学习 - pkey - EVP_PKEY_DSA_keygen.c

    das.h 中有2个公共函数(给pkey目录的所有工程公用): print_bn() 打印大数值 dsa_print_key() 打印key值 打印_evp_pkey_dsa的共有数据(p,q,g, seed, pcounter) + 公钥/私钥 + DSA参数 每次产生的pkey都不一样(因为seed不一样)

    2024年01月17日
    浏览(35)
  • openssl3.2 - 官方demo学习 - signature - EVP_ED_Signature_demo.c

    ED25519 签名/验签算法, 现在是最好的. 产生ED25519私钥/公钥 用私钥对明文签名, 得到签名数据 用公钥对明文和签名数据进行验签

    2024年01月17日
    浏览(39)
  • openssl3.2 - 官方demo学习 - signature - EVP_EC_Signature_demo.c

    EC的签名/验签实现, 摘要算法为 SHA3-512 签名验签时的update铭文可以进行多次. openssl的API封装的真好, 只要是一类流程(e.g. 签名/验签), 采用不同算法时, 差别不大. 以前看资料, 那个老师说, 最好不要用名字来取算法指针, 容易写错. 而且调用的API比较麻烦. 已经单步调试了几十个

    2024年01月17日
    浏览(40)
  • openssl3.2 - 官方demo学习 - signature - EVP_DSA_Signature_demo.c

    DSA签名(摘要算法SHA256), DSA验签(摘要算法SHA256) 签名 : 用发送者的私钥进行签名. 验签 : 用发送者的公钥进行验签. 看下API调用顺序就行, 自己弄的时候, 跟着demo的流程弄就行. 对于openssl3.2, 越看越眼熟了.

    2024年01月21日
    浏览(30)
  • openssl3.2 - 官方demo学习 - digest - EVP_MD_xof.c

    使用支持XOF方式的摘要算法(e.g. SHAKE256), 对buffer进行摘要, 并和预留的摘要值进行比对

    2024年02月01日
    浏览(33)
  • openssl3.2 - 官方demo学习 - certs

    打开官方demos的certs目录, 没看到.c. 茫然了一下. 官方在这个目录中要展示啥呢? 看了readme, 懂了. 原来官方在这个目录中, 要展示如何使用openssl.exe的命令行来操作证书(建立证书, 证书入库, 吊销证书, 查询证书). 官方通过3个.sh来展示证书操作. mkcerts.sh - 一组操作, 用来建立证书

    2024年02月01日
    浏览(43)
  • openssl3.2 - 官方demo学习 - 索引贴

    如果要将openssl在自己的业务逻辑中用起来, 只从网上找零星的代码片段肯定不行的. 且不说人家写的好不好, 主要是我们不知道人家为啥那么写. openSSL的API, 不同版本, API调用名称, 调用顺序. 是否为已经废弃, 都不同. 如果不是官方demo中推荐的写法, 如果有问题, 那也不好找问题

    2024年02月02日
    浏览(43)
  • openssl3.2 - 官方demo学习 - sconnect.c

    TLS客户端 - 使用根证书, 非阻塞, 向服务器要东西. 开始一个新demo学习时, 要从头配置包含路径, 麻烦. 直接拷贝上一个实现工程, 换掉实现.c方便一些. 换的新demo实现, 要加入库包含和头包含, 麻烦, 做一个公用头文件, 直接include方便一些.

    2024年02月01日
    浏览(49)
  • openssl3.2 - 官方demo学习 - test - certs

    官方demos目录有证书操作的例子 已经做了笔记 openssl3.2 - 官方demo学习 - certs 但是这个demos/certs目录的脚本, 并没有演示如何操作PKCS12证书. 在官方给的程序例子中, 有操作PKCS12证书的工程, 但是却没有配套的PKCS12证书. 这咋弄? 翻了一下openssl源码工程, 发现测试目录中有2个脚本

    2024年01月18日
    浏览(47)
  • openssl3.2 - 官方demo学习 - saccept.c

    建立TLSServer(使用了证书, 和证书中的私钥), 接收客户端的连接, 并将客户端发来的信息打印到屏幕 笔记

    2024年01月20日
    浏览(41)

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

博客赞助

微信扫一扫打赏

请作者喝杯咖啡吧~博客赞助

支付宝扫一扫领取红包,优惠每天领

二维码1

领取红包

二维码2

领红包