Skip to content

2-KeyManagement.md

Latest commit

 

History

History
142 lines (79 loc) · 3.09 KB

2-KeyManagement.md

File metadata and controls

142 lines (79 loc) · 3.09 KB

TLS Certificates 101 Workshop

Part 2: Key Management

Create a Private Key

openssl genpkey -algorithm rsa -out private.pem

Display the Private Key

openssl rsa -in private.pem -noout -text

The numbers, Mason, what do they mean?

For a quick deep dive on how RSA keys are generated click "down", otherwise click "right" to continue the workshop.

For more in-depth information visit the section about RSA Key Generation on Wikipedia.

--

How RSA Keys are generated?

--

Step 1: Choose two large prime numbers p and q.

They must be kept secret at all times.

RSA Private Key - Primes

--

Step 2: Calculate the Modulus n

Forumla: n = pq

The Modulus is used for both the Public and Private Key and thus is distrubuted as part of the Public Key. Its length, usually expressed in bits, is the key length.

RSA Modulus

--

Step 3: Compute λ(n)

λ is Carmichael's totient function and is used to calculate the Public Key Exponent and the Private Key Exponent.

--

Step 4: Calculate the Public Key Exponent

Choose an integer e such that

1 < e < λ(n) and gcd(e, λ(n)) = 1.

RSA Public Key - Exponent

--

Step 5: Determine the Private Key Exponent

Formula: d ≡ e−1 (mod λ(n))

RSA Private Key - Exponent

--

What about exponent1, exponent2, and coefficient?

Exponent1, Exponent2, and Coefficient

--

For efficiency, many popular crypto libraries (such as OpenSSL, Java and .NET) use for decryption and signing the following optimization based on the Chinese remainder theorem:

RSA Chinese Remainder Algorithm

Extract the Public Key

$ openssl rsa -in private.pem -out public.pem -pubout

Display the Public Key

$ openssl rsa -pubin -in public.pem -noout -text

Things look familier, right?

Encoding & File Extensions

There are two types of encoding widely used in the industry:

  • Binary Encoding (DER): .der, .cer, .crt, ...
  • Base64 ASCII Encoding (PEM): .pem, .crt, .cer, .key, ...

Important: The file extension does not necessarily reflect the encoding used!

Converting between DER and PEM and vice versa

Convert PEM to DER

$ openssl rsa -in private.pem -outform der -out private.der
$ openssl rsa -pubin -in public.pem -outform der -out public.der

Convert DER to PEM

$ openssl rsa -in private.der -inform der -out private.pem
$ openssl rsa -pubin -in public.der -inform der  -out public.pem

Finished!

This was the second part of the workshop.

You should now have a basic understanding of how to create and manage RSA keys.

To continue with the workshop, please proceed to the next part: Key Usage