ec.pod 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190
  1. =pod
  2. =head1 NAME
  3. ec - EC key processing
  4. =head1 SYNOPSIS
  5. B<openssl> B<ec>
  6. [B<-inform PEM|DER>]
  7. [B<-outform PEM|DER>]
  8. [B<-in filename>]
  9. [B<-passin arg>]
  10. [B<-out filename>]
  11. [B<-passout arg>]
  12. [B<-des>]
  13. [B<-des3>]
  14. [B<-idea>]
  15. [B<-text>]
  16. [B<-noout>]
  17. [B<-param_out>]
  18. [B<-pubin>]
  19. [B<-pubout>]
  20. [B<-conv_form arg>]
  21. [B<-param_enc arg>]
  22. [B<-engine id>]
  23. =head1 DESCRIPTION
  24. The B<ec> command processes EC keys. They can be converted between various
  25. forms and their components printed out. B<Note> OpenSSL uses the
  26. private key format specified in 'SEC 1: Elliptic Curve Cryptography'
  27. (http://www.secg.org/). To convert a OpenSSL EC private key into the
  28. PKCS#8 private key format use the B<pkcs8> command.
  29. =head1 COMMAND OPTIONS
  30. =over 4
  31. =item B<-inform DER|PEM>
  32. This specifies the input format. The B<DER> option with a private key uses
  33. an ASN.1 DER encoded SEC1 private key. When used with a public key it
  34. uses the SubjectPublicKeyInfo structur as specified in RFC 3280.
  35. The B<PEM> form is the default format: it consists of the B<DER> format base64
  36. encoded with additional header and footer lines. In the case of a private key
  37. PKCS#8 format is also accepted.
  38. =item B<-outform DER|PEM>
  39. This specifies the output format, the options have the same meaning as the
  40. B<-inform> option.
  41. =item B<-in filename>
  42. This specifies the input filename to read a key from or standard input if this
  43. option is not specified. If the key is encrypted a pass phrase will be
  44. prompted for.
  45. =item B<-passin arg>
  46. the input file password source. For more information about the format of B<arg>
  47. see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
  48. =item B<-out filename>
  49. This specifies the output filename to write a key to or standard output by
  50. is not specified. If any encryption options are set then a pass phrase will be
  51. prompted for. The output filename should B<not> be the same as the input
  52. filename.
  53. =item B<-passout arg>
  54. the output file password source. For more information about the format of B<arg>
  55. see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
  56. =item B<-des|-des3|-idea>
  57. These options encrypt the private key with the DES, triple DES, IDEA or
  58. any other cipher supported by OpenSSL before outputting it. A pass phrase is
  59. prompted for.
  60. If none of these options is specified the key is written in plain text. This
  61. means that using the B<ec> utility to read in an encrypted key with no
  62. encryption option can be used to remove the pass phrase from a key, or by
  63. setting the encryption options it can be use to add or change the pass phrase.
  64. These options can only be used with PEM format output files.
  65. =item B<-text>
  66. prints out the public, private key components and parameters.
  67. =item B<-noout>
  68. this option prevents output of the encoded version of the key.
  69. =item B<-modulus>
  70. this option prints out the value of the public key component of the key.
  71. =item B<-pubin>
  72. by default a private key is read from the input file: with this option a
  73. public key is read instead.
  74. =item B<-pubout>
  75. by default a private key is output. With this option a public
  76. key will be output instead. This option is automatically set if the input is
  77. a public key.
  78. =item B<-conv_form>
  79. This specifies how the points on the elliptic curve are converted
  80. into octet strings. Possible values are: B<compressed> (the default
  81. value), B<uncompressed> and B<hybrid>. For more information regarding
  82. the point conversion forms please read the X9.62 standard.
  83. B<Note> Due to patent issues the B<compressed> option is disabled
  84. by default for binary curves and can be enabled by defining
  85. the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
  86. =item B<-param_enc arg>
  87. This specifies how the elliptic curve parameters are encoded.
  88. Possible value are: B<named_curve>, i.e. the ec parameters are
  89. specified by a OID, or B<explicit> where the ec parameters are
  90. explicitly given (see RFC 3279 for the definition of the
  91. EC parameters structures). The default value is B<named_curve>.
  92. B<Note> the B<implicitlyCA> alternative ,as specified in RFC 3279,
  93. is currently not implemented in OpenSSL.
  94. =item B<-engine id>
  95. specifying an engine (by its unique B<id> string) will cause B<ec>
  96. to attempt to obtain a functional reference to the specified engine,
  97. thus initialising it if needed. The engine will then be set as the default
  98. for all available algorithms.
  99. =back
  100. =head1 NOTES
  101. The PEM private key format uses the header and footer lines:
  102. -----BEGIN EC PRIVATE KEY-----
  103. -----END EC PRIVATE KEY-----
  104. The PEM public key format uses the header and footer lines:
  105. -----BEGIN PUBLIC KEY-----
  106. -----END PUBLIC KEY-----
  107. =head1 EXAMPLES
  108. To encrypt a private key using triple DES:
  109. openssl ec -in key.pem -des3 -out keyout.pem
  110. To convert a private key from PEM to DER format:
  111. openssl ec -in key.pem -outform DER -out keyout.der
  112. To print out the components of a private key to standard output:
  113. openssl ec -in key.pem -text -noout
  114. To just output the public part of a private key:
  115. openssl ec -in key.pem -pubout -out pubkey.pem
  116. To change the parameters encoding to B<explicit>:
  117. openssl ec -in key.pem -param_enc explicit -out keyout.pem
  118. To change the point conversion form to B<compressed>:
  119. openssl ec -in key.pem -conv_form compressed -out keyout.pem
  120. =head1 SEE ALSO
  121. L<ecparam(1)|ecparam(1)>, L<dsa(1)|dsa(1)>, L<rsa(1)|rsa(1)>
  122. =head1 HISTORY
  123. The ec command was first introduced in OpenSSL 0.9.8.
  124. =head1 AUTHOR
  125. Nils Larsch for the OpenSSL project (http://www.openssl.org).
  126. =cut