Terminal labUnit 5 · Topic 5.4
Public and private keys on two machines
Generate a key pair on two machines and send an encrypted message.
New to this? Read the topic first: 5.4 Asymmetric Cryptography.
Simulation · Asymmetric encryption [5.4.A.2, 5.4.A.4, 5.4.B.1, 5.4.C.3]
Key pair lab: public key locks, private key unlocks
Two security engineers at a wind farm company, Sana and Leo, have never met and share no secret. Each generates a key pair and publishes only the public key.
Which key?
-
Sana sends Leo a confidential design file. Which key does she encrypt it with?
Show the answer
Leo's public key. To send securely, the sender uses the receiver's public key. Only Leo's private key can decrypt it.
-
Leo receives the encrypted file. Which key decrypts it?
Show the answer
Leo's private key. The receiver decrypts with their own private key, the partner of the public key used to encrypt.
-
Leo replies with an encrypted message for Sana. Which key does he encrypt it with?
Show the answer
Sana's public key. Now Sana is the receiver, so Leo uses Sana's public key.
-
Leo's laptop, which stores rsa.pem, is stolen. Which key is now compromised, so Leo must delete his key pair and generate a new one?
Show the answer
Leo's private key. The security of asymmetric encryption rests on the private key. If it is exposed or stolen, the key pair must be deleted and a new pair generated.
The same steps in OpenSSL
Real output from OpenSSL 3, run on two computers. Leo is the receiver, so he makes the key pair; Sana only ever sees his public key.
# 1. Leo generates a 2048-bit RSA key pair (no output means it worked) leo@laptop:~$ openssl genrsa -out rsa.pem 2048 # 2. Leo extracts the public key and publishes public.pem leo@laptop:~$ openssl rsa -pubout -in rsa.pem -outform PEM -out public.pem writing RSA key leo@laptop:~$ ls -l rsa.pem public.pem -rw-r--r-- 1 leo leo 451 Nov 9 09:12 public.pem -rw------- 1 leo leo 1704 Nov 9 09:12 rsa.pem leo@laptop:~$ head -2 public.pem -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkxgXAfVl32yI5H1luTxP
# 3. Sana encrypts with Leo's public key (-pubin: the key file is a public key) sana@workstation:~$ openssl pkeyutl -encrypt -pubin -inkey public.pem -in design.txt -out design.enc sana@workstation:~$ ls -l design.enc -rw-r--r-- 1 sana sana 256 Nov 9 09:20 design.enc
# 4. Leo decrypts with his private key (in rsa.pem) leo@laptop:~$ openssl pkeyutl -decrypt -inkey rsa.pem -in design.enc -out design.txt leo@laptop:~$ cat design.txt Turbine 12 patch is ready
rsa.pem holds the private key, and ls -l shows only Leo may read it (-rw-------). The public key is safe to share. A 2048-bit RSA key always makes 256 bytes of ciphertext, however short the message; a message longer than about 245 bytes cannot be encrypted this way at all. Decrypting with any other private key never recovers the message: OpenSSL writes unreadable output or an error, depending on the padding.Try it with a real key pair
Leo's public key (published)Not generated yet
Ciphertext (hex, shortened)Waiting
ResultWaiting
Key length and keyspace
An n-bit key has a keyspace of 2n. Random guessing finds the key in 2n/2 = 2n-1 guesses on average. AES 256-bit beats AES 128-bit and RSA 4096-bit beats RSA 2048-bit, but an AES key and an RSA key cannot be compared by length.
Go to the topic: 5.4 Asymmetric Cryptography