keys.txt 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. <DRAFT!>
  2. HOWTO keys
  3. 1. Introduction
  4. Keys are the basis of public key algorithms and PKI. Keys usually
  5. come in pairs, with one half being the public key and the other half
  6. being the private key. With OpenSSL, the private key contains the
  7. public key information as well, so a public key doesn't need to be
  8. generated separately.
  9. Public keys come in several flavors, using different cryptographic
  10. algorithms. The most popular ones associated with certificates are
  11. RSA and DSA, and this HOWTO will show how to generate each of them.
  12. 2. To generate a RSA key
  13. A RSA key can be used both for encryption and for signing.
  14. Generating a key for the RSA algorithm is quite easy, all you have to
  15. do is the following:
  16. openssl genrsa -des3 -out privkey.pem 2048
  17. With this variant, you will be prompted for a protecting password. If
  18. you don't want your key to be protected by a password, remove the flag
  19. '-des3' from the command line above.
  20. NOTE: if you intend to use the key together with a server
  21. certificate, it may be a good thing to avoid protecting it
  22. with a password, since that would mean someone would have to
  23. type in the password every time the server needs to access
  24. the key.
  25. The number 2048 is the size of the key, in bits. Today, 2048 or
  26. higher is recommended for RSA keys, as fewer amount of bits is
  27. consider insecure or to be insecure pretty soon.
  28. 3. To generate a DSA key
  29. A DSA key can be used for signing only. This is important to keep
  30. in mind to know what kind of purposes a certificate request with a
  31. DSA key can really be used for.
  32. Generating a key for the DSA algorithm is a two-step process. First,
  33. you have to generate parameters from which to generate the key:
  34. openssl dsaparam -out dsaparam.pem 2048
  35. The number 2048 is the size of the key, in bits. Today, 2048 or
  36. higher is recommended for DSA keys, as fewer amount of bits is
  37. consider insecure or to be insecure pretty soon.
  38. When that is done, you can generate a key using the parameters in
  39. question (actually, several keys can be generated from the same
  40. parameters):
  41. openssl gendsa -des3 -out privkey.pem dsaparam.pem
  42. With this variant, you will be prompted for a protecting password. If
  43. you don't want your key to be protected by a password, remove the flag
  44. '-des3' from the command line above.
  45. NOTE: if you intend to use the key together with a server
  46. certificate, it may be a good thing to avoid protecting it
  47. with a password, since that would mean someone would have to
  48. type in the password every time the server needs to access
  49. the key.
  50. --
  51. Richard Levitte