☰

椭圆曲线加密：使用相同的 ECC 参数会导致每次传递都产生不同的密钥。为什么？

tag-icon • tag-icon encryption openssl ecc
椭圆曲线加密：使用相同的 ECC 参数会导致每次传递都产生不同的密钥。为什么？

我一直使用 OpenSSL 作为首选库。我通过以下方式创建了一组 ECC 参数

openssl ecparam -out ecparams.pem -name secp521r1 -genkey

然后，我创建了两个证书请求，每个证书都生成自己的一组公钥/私钥。

openssl req -x509 -newkey ec:ecparams.pem -keyform PEM -keyout ECCParam1Key1.pem -out LocalCACert1.pem -outform PEM -days 3650
openssl req -x509 -newkey ec:ecparams.pem -keyform PEM -keyout ECCParam1Key2.pem -out LocalCACert2.pem -outform PEM -days 3650

我期望生成的密钥是相同的鉴于ecparams.pem我使用的是相同的，并定义了一切非常具体来说：

-----BEGIN EC PARAMETERS-----
BgUrgQQAIw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MIHbAgEBBEF6N74mfCh946N1seJUjTrkmjSTRUKgWGqqCkNlZgwauNQD0dAHRJ9Y
PePxH1eIxOC8jDO85OUUawrP2j4n0kijbqAHBgUrgQQAI6GBiQOBhgAEAewexGGT
v3Dl40W0pTH1sWKPWhohPOo4pMDIbUJDZjtmwY9qvylU5JvtU2yvHBolMzxaHKFl
D0K7+agglcbT58dkASVYeOCK+bt7VrqtdJFuUm+TCr9vOmuWxR3bnVMuZWR+4fh5
z7XcIqRMYXO/gYdEX9bc8hPW/bdD9PDPZwZf62LC
-----END EC PRIVATE KEY-----

私钥部分。但是，当我通过

openssl ec -in ECCParam1Key1.pem -text -param_out
openssl ec -in ECCParam1Key2.pem -text -param_out

我可以看到，尽管具有相同的键控位，但它们是不同的。我将输出复制粘贴到问题末尾。

问题：似乎在创建 ECC 参数时，并非所有参数都是“固定”的；有些参数似乎是固定的，但其他参数似乎是在密钥创建期间随机生成的。哪些参数留待以后生成？为什么会这样？

谢谢

密钥转储如下（这些密钥只是为了演示而生成的，并未在任何地方使用）

$ openssl ec -in ECCParam1Key1.pem -text -param_out
read EC key
Enter PEM pass phrase:
Private-Key: (521 bit)
priv:
    6a:ef:af:bf:73:85:0f:aa:4a:92:7a:1e:ac:da:a8:
    38:ee:17:b7:c1:3e:45:ae:2d:e6:ac:4b:d6:18:19:
    f6:e5:3a:89:d2:3c:b6:79:4a:2e:e4:30:2e:74:62:
    8c:87:b0:88:a7:93:82:57:e3:0c:b9:bf:af:89:ae:
    85:94:76:3a:e1
pub:
    04:00:db:e4:59:e9:9f:f8:98:9d:31:96:69:af:e0:
    89:41:c2:8d:b0:4b:00:b4:83:31:61:c9:96:ba:22:
    88:49:5f:cc:25:87:fd:75:a4:21:ac:11:a4:f2:bf:
    08:a0:1b:ff:e2:66:5e:08:3e:21:11:d4:0e:a0:32:
    7a:17:cb:11:2a:87:e7:01:90:92:7a:b2:26:1b:5b:
    84:01:c3:7e:8f:81:1d:35:bc:59:58:ef:e3:95:5e:
    72:30:16:8c:f6:06:46:dc:34:fd:b6:33:cf:46:61:
    ec:ea:64:3f:90:0a:3a:f9:e6:78:2d:55:32:ab:00:
    b2:32:4f:be:48:82:3f:c0:09:9f:6f:cc:de
ASN1 OID: secp521r1
writing EC key
-----BEGIN EC PARAMETERS-----
BgUrgQQAIw==
-----END EC PARAMETERS-----    


$ openssl ec -in ECCParam1Key2.pem -text -param_out
read EC key
Enter PEM pass phrase:
Private-Key: (521 bit)
priv:
    01:6e:f7:03:33:18:1f:32:82:41:35:ca:11:4b:23:
    0d:1f:7b:78:9d:13:39:0a:ec:0a:f2:f9:24:09:06:
    f3:86:17:9b:20:05:a6:88:07:ed:0b:e6:c6:83:41:
    6c:87:93:57:f7:cd:8f:21:eb:3b:24:46:d4:c6:8f:
    ee:95:f5:8d:c3:01
pub:
    04:00:bd:ae:f7:8b:c4:39:6c:e0:01:ba:26:9a:a9:
    8c:72:85:cf:15:d0:24:78:a0:d2:08:a4:e8:36:f1:
    15:cd:c4:00:a9:0d:43:cc:e3:23:c0:cb:18:d3:5c:
    a7:9b:84:1e:c1:4e:3a:a8:bf:83:0f:3a:4b:11:c9:
    f1:4a:0e:ae:60:27:79:01:2f:d7:44:51:11:d2:b5:
    d1:ab:f5:a0:af:e2:eb:1e:7d:c6:b8:60:91:3e:c3:
    52:4a:a7:83:12:75:59:62:f2:15:59:b4:0f:0d:52:
    46:41:2e:29:00:94:26:49:37:5e:36:29:30:ae:fa:
    a9:2b:2b:5b:74:c4:b0:80:03:2e:ea:61:b0
ASN1 OID: secp521r1
writing EC key
-----BEGIN EC PARAMETERS-----
BgUrgQQAIw==
-----END EC PARAMETERS-----

答案1

它应该是

openssl ecparam -out ecparamAndKey.pem -name secp521r1 -genkey

然后

openssl req -x509 -new key -sha256 ecparamAndKey.pem -keyform PEM -out LocalCACert1.pem -outform PEM -days 3650
openssl req -x509 -new key -sha256 ecparamAndKey.pem -keyform PEM -out LocalCACert2.pem -outform PEM -days 3650

建议使用-sha256（或-sha512），否则会回到损坏的SHA1

相关内容