The Diffie-Hellman key exchange algorithm uses public key cryptography to exchange a secret between two users. That secret then can be used as a key for other security purposes (e.g. a key for symmetric key encryption).
Your task is to use Diffie-Hellman to exchange a secret with another user, and then use that secret to encrypt a file with AES and send that encrypted file to the other user. In this homework, I will act as the other user. In the following description this other user is referred to as friend-of-ID, meaning a friend of the student with identity number ID. Replace ID with your actual ID.
OpenSSL is used to perform Diffie-Hellman key exchange and AES encryption.
In Diffie-Hellman, the two users must first agree on public global parameters. The user friend-of-ID has already generated these public global parameters using the following OpenSSL command:
openssl genpkey -genparam -algorithm DH -out global-ID.pem
The file global-ID.pem contains the public global parameters that you will use with your friend.
The user friend-of-ID has already used OpenSSL to generate their Diffie-Hellman private and public key:
openssl genpkey -paramfile global-ID.pem -out keypair-friend-of-ID.pem
They then extracted their public key from the keypair:
openssl pkey -in keypair-friend-of-ID.pem -pubout -out public-friend-of-ID.pem
The file public-friend-of-ID.pem contains the public value of user friend-of-ID.
The user friend-of-ID has posted their parameters file and public key file on a website at:
http://ict.siit.tu.ac.th/~sgordon/css322y12s2/unprotected/hw4/
You download your friends parameters file and public key file. Then you must generate your own private/publc key pair, saved in a file called keypair-ID.pem. Also extract your public key and save it in a file called public-ID.pem. Then generate a shared secret and save it in a file secret-ID.bin. Finally, use the first 128 bits of the secret as a key to encrypt your keypair file using AES (use an IV of all 0's). The ciphertext must be called keypair-ID.enc.
Submit the following files on Moodle:
After you submit your files, your friend (me) will use public-ID.pem to generate a secret, and then use that secret to decrypt keypair-ID.enc. The decrypted file must be identical to your submitted keypair-ID.pem. The file secret-ID.pem is not used by your friend (but you still must submit so I can check if you make errors).
To generate your Diffie-Hellman keypair and extract the public key, use similar commands to what your friend did.
To generate a secret using the Diffie-Hellman values, use the pkeyutl operation of OpenSSL. There is an example in the man pages, i.e. man pkeyutl.
Note that the secret generated by OpenSSL is a binary file. You use only the first 128 bits as the AES key. You can use xxd or similar to view the binary file.
Use AES-128 (with the default CBC) to encrypt your keypair file. Remember the IV is all 0's. Padding may be needed (which means do NOT use the nopad option).
When submitting, make sure you name the 4 files correctly: use lowercase, use a dash (not underscore or space) before your ID and use the correct extension. Only the 4 files with correct names will be used in marking your submission.
Most of the OpenSSL operations in this homework produce keys that are saved using Base64 encoding. This is not a form of an encryption - its just a way to encode binary data as ASCII strings. There are different ways to view the actual values in text format (rather than Base64 encoding). For example, to view the Diffie-Hellman parameters in text format:
openssl pkeyparam -in global-ID.pem -text
Or to view your keypair:
openssl pkey -in keypair-ID.pem -text -noout
Or to view a public key:
openssl pkey -pubin -in public.pem -text
Note that the secret in secret-ID.bin is not Base64 encoded. It is a binary value. You may view the actual values in Hex:
xxd secret-ID.bin
or in binary:
xxd -b secret-ID.binReturn to: CSS322 Home | Course List | Steven Gordon's Home | SIIT