OpenSSL: A Powerful Tool for Secure Communication

Introduction

In the vast realm of secure communication over the internet, OpenSSL emerges as a widely adopted cryptographic library. This open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols provides a comprehensive set of tools, algorithms, and protocols to safeguard data during transmission. In this blog, we will embark on a journey through the basics of OpenSSL, unraveling its significance and functionality.

OpenSSL is a versatile open-source toolkit that arms developers, system administrators, and security professionals with an array of cryptographic functions. Whether it's securing data transmissions, protecting data at rest, or establishing secure connections, OpenSSL proves instrumental. Developed primarily in the C programming language, OpenSSL caters to various platforms such as Linux, Unix, and Windows, making it accessible and widely used.

Key Features

OpenSSL boasts an impressive range of features that contribute to its popularity among tech enthusiasts. Here are some highlights:

• Support for Various Cryptographic Algorithms: OpenSSL supports a wide range of cryptographic algorithms, including symmetric and asymmetric encryption, hashing, and digital signatures. This versatility enables developers to choose the most suitable algorithm for their specific use cases.
• SSL/TLS Protocol Support: OpenSSL includes robust support for the SSL/TLS protocols, facilitating secure communication over the internet. These protocols play a vital role in encrypting data in transit, ensuring confidentiality and integrity.
• Digital Certificate Management: With OpenSSL, developers can create and verify digital certificates, which establish trust between communicating parties. This feature enhances the security of communication sessions by validating the authenticity of participants.
• Language Compatibility: OpenSSL offers compatibility with multiple programming languages such as C, C++, Java, Python, and Perl. This flexibility empowers developers to seamlessly integrate OpenSSL into their preferred programming environments.

Encryption and Decryption

OpenSSL can be used for encryption and decryption using both symmetric and asymmetric encryption techniques.

• Symmetric key encryption uses a single key to encrypt and decrypt data. This type of encryption is typically faster than asymmetric encryption, but it requires that both parties share the same key.
• Asymmetric key encryption uses two keys, a public key and a private key. The public key can be used to encrypt data, but only the private key can be used to decrypt it. This type of encryption is typically slower than symmetric encryption, but it does not require that both parties share the same key.

Let’s explore how we can use Symmetric and Asymmetric encryption techniques for secure communication between two parties. For illustration, let’s create a sample file called plaintext.txt and add some data in that by following this command.

foo@bar:~$ echo "this is raw data...." > plaintext.txt

Symmetric Key Encryption

In symmetric key encryption, we have common key for encryption and decryption:

1. Generating a Random Key: To initiate the encryption process, we generate a random key of 256 bits (32 bytes) and store it to aes.key using the following command:

   foo@bar:~$ openssl rand -hex 32 > aes.key
   

2. Encrypting Data: Next, we encrypt a sample file called plaintext.txt using the generated key in step 1 and store encrypted data encrypted_message.enc file using the following command:

   foo@bar:~$ openssl enc -aes-256-cbc -in plaintext.txt -out encrypted_message.enc -kfile aes.key
   

3. Decrypting Data: To decrypt the encrypted message and retrieve the original data, we have to execute the command:

   foo@bar:~$ openssl enc -d -aes-256-cbc -in encrypted_message.enc -out decrypted_message.dec -kfile aes.key
   

💡 If you have looked at the content of generated encrypted file encrypted_message.enc you may have noted that encrypted text which started with Salted__ keyword. It is added by default to the original data before encryption to prevent rainbow table attacks. If you would like to encrypt data without using salt then you can use -nosalt flag.

foo@bar:~$ openssl enc -aes-256-cbc -nosalt -in plaintext.txt -out encrypted_message_nosalt.enc -kfile aes.key

💡 You may have noticed, we have used the AES-128-CBC cipher algorithm while encrypting the data in example. However, OpenSSL supports many other cipher algorithms that can be used for encrypting and decrypting data. These include AES-256-CBC, DES-EDE3-CBC, and RC4, among others. Each of these algorithms has its own strengths and weaknesses, and may be more suitable for different use cases. We encourage you to explore these other options and choose the one that best fits your needs. One can get the list of ciphers supported by openSSL via following command.

foo@bar:~$ openssl enc -ciphers

Asymmetric Key Encryption

Now, let's explore asymmetric key encryption, which involves two keys: a public key and a private key:

1. Generating a Key Pair: We generate a private key using the RSA algorithm with a key size of 2048 bits:

   foo@bar:~$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key.pem
   

2. Then, we derive the corresponding public key from the private key:

   foo@bar:~$ openssl pkey -in private-key.pem -out public-key.pem -pubout
   

3. Encrypting Data: To encrypt a file (plaintext.txt) using the recipient's public key (public-key.pem) and RSA, we execute the command:

   foo@bar:~$ openssl pkeyutl -encrypt -pubin -inkey public-key.pem -in plaintext.txt -out ciphertext.bin
   

4. Decrypting Data: To decrypt the encrypted message with the private key (private-key.pem), we use the following command:

   foo@bar:~$ openssl pkeyutl -decrypt -inkey private-key.pem -in ciphertext.bin
   

💡 We have used RSA algorithm for encrypting and decrypting the message in above example but openSSL does support other algorithms like DSA, DH or DHX. You can check the full list od such algorithm using following command:

foo@bar:~$ openssl list -public-key-algorithms

Hashing

In addition to encryption, OpenSSL provides support for various hashing algorithms. Hashing is a one-way function that converts an input (or 'message') into a fixed-sized string of output, also known as the 'hash value', 'digest', or 'checksum'. Hash functions play a crucial role in data integrity verification and password storage. OpenSSL offers a wide range of hashing algorithms, including MD5, SHA-1, SHA-256, and more. Here's a brief overview of how to use OpenSSL for hashing:

For illustration, let’s create a sample file called raw_data.txt similar to the previous section and add some data in that by following this command.

foo@bar:~$ echo "This data is not changed" > raw_data.txt

1. Generate a Hash: To generate the hash value of a file raw_data.txt using a specific algorithm (e.g., SHA-256), you can use the following command:

   foo@bar:~$ openssl dgst -sha256 raw_data.txt > raw_hash.txt
   

   Output: SHA512(raw_data.txt)= 372ddcf7b71489de1a75a60cb6b9c8d7

• Change the data of raw_data.txt and again generate hash

  foo@bar:~$ echo 'This data is changed' > new_raw_data.txt && openssl dgst -sha256 new_raw_data.txt
  

  Output: sha512(raw_data.txt)= c1330184ec891dddbdad184f8ccfe45d

  As you can see the hash value has drastically changed after removing just one word from the file. It is almost impossible to generate two strings that have the same hash value.

2. Verify a Hash: To verify the integrity of a file, generate the hash of input file with same hashing algo and compare it with given hash value using the following command:

   foo@bar:~$ openssl dgst -sha256 raw_data.txt | cmp -s - raw_hash.txt && echo "Hash verification successful" || echo "Hash verification failed"
   

   Output: Hash verification successful

💡 The SHA-256 and SHA-512 are currently the most widely used hashing algorithms.There are many other algorithms provided by OpenSSL tool. You can find all available algorithm by following command:

foo@bar:~$ openssl list -digest-algorithms

To learn more about the difference between different hashing algorithms, check out here. ❗MD5 hashing algorithm is no longer considered secure and is not recommended for new applications.

Hashing can be used in combination with other cryptographic concepts such as sign-verify to generate and verify digital signatures for providing stronger level of security.

Digital Signature

OpenSSL enables the generation and verification of digital signatures, which provide authenticity and integrity to data. Digital signatures use asymmetric key pairs, where the sender signs the data with their private key, and the recipient verifies the signature using the sender's public key. Here's a high-level overview of how to use OpenSSL for digital signature verification:

1. Generate a Digital Signature: To generate a digital signature for a file (raw_data.txt) using your private key (private-key.pem), you can use the following command. The resulting digital signature will be stored in signature.bin.

   foo@bar:~$ openssl dgst -sha256 -sign private-key.pem -out signature.bin raw_data.txt
   

2. Verify a Digital Signature: To verify the authenticity and integrity of a file by verifying its digital signature (signature.bin) using the sender's public key (public-key.pem), use the following command:

   foo@bar:~$ openssl dgst -sha256 -verify public-key.pem -signature signature.bin raw_data.txt
   

   If the signature is valid, OpenSSL will display a "Verified OK" message.

Conclusion

OpenSSL is a powerful and widely-used cryptographic library that enables secure communication over the internet. With its support for various algorithms, encryption techniques, and digital signatures, OpenSSL empowers developers and security professionals to protect data confidentiality, integrity, and authenticity. Whether it's encrypting data, generating hash values, or verifying digital signatures, OpenSSL provides essential tools for ensuring secure and trustworthy communication.

In our next blog, we will explore the significance of digital certificates and their role in establishing secure communication using OpenSSL. Stay tuned for an in-depth understanding on certificate management and its importance in ensuring trust and authenticity.