encryption - OpenSSL : Encrypt with private key and decrypt with public key in RSA

Question

我想使用带有 RSA 算法的 OpenSSL 使用私钥加密文件:

openssl rsautl -in txt.txt -out txt2.txt -inkey private.pem -encrypt

现在，如果我进行解密操作:

openssl rsautl -in txt2.txt -pubin -inkey public.pem -decrypt

A private key is needed for this operation

我知道我应该使用公钥来加密，如果我使用私钥，我会得到一个签名。
但是，我想这样做是为了学习目的。

Answer 1

您错误地使用了 key 。在公钥密码学中，加密使用公钥:

openssl rsautl -in txt.txt -out txt2.txt -inkey public.pem -pubin -encrypt

对于解密，使用与公钥相关的私钥:

openssl rsautl -in txt2.txt -inkey private.pem -decrypt

私钥(没有 -pubin )可用于加密，因为它实际上包含公共(public)指数。请注意，RSA 通常不应用于直接加密数据，而应仅用于“封装”(RSA-KEM)或“包装”用于对称加密的 key 。
但是你提到你实际上想学习签名。尽管历史上 RSA 签名有时被描述为“使用私钥加密”，但该描述具有误导性，并且实际实现被发现是不安全的。签名和验证实际上是独立于加密和解密的不同操作，而 rsautl只执行其中的一部分。例如，您可以执行以下操作:

# hash the data and encode the result in ASN.1 
openssl rsautl -sign -in hashenc.dat -out sig.dat -inkey private.pem
...
# on the recipient (with signature and purportedly correct data)
openssl rsautl -verify -in sig.dat -out hashenc.dat -inkey public.pem -pubin 
# or often more appropriate use a certificate for the public key
openssl rsautl -verify -in sig.dat -out hashenc.dat -inkey cert.pem -certin
# now either decode hashenc.dat and compare the hash
# to a new hash of the data (which should be the same)
# or compare all of hashenc.dat to an encoding of a new hash

相反，最好使用 openssl dgst执行 PKCS1 e.g. rfc8017 指定的整个签名和验证序列.例如对于带有 SHA256 的 RSASSA-PKCS1v1_5 签名:

openssl dgst -sha256 -sign private.pem -in data.txt -out sig.dat
# or can be abbreviated
openssl sha256 -sign private.pem -in data.txt -out sig.dat
# hashes the data, encodes the hash, does type 1 padding and modexp d
...
openssl dgst -sha256 -verify public.pem -in data.txt -signature     sig.dat
# or abbreviated 
openssl sha256 -verify public.pem -in data.txt -signature sig.dat 
# does modexp e and type 1 unpadding, and compares the result to a hash of the data

# notice you don't specify which key is public or private
# because this command knows what to expect

# however it does not accept the public key from a certificate, 
# you must extract the public key from the cert first

这种形式(但不是 rsautl)也支持更新的、技术上更好的、但没有被广泛使用的 PSS 填充。这仅在 dgst 上被引用手册页，主要记录在 pkeyutl手册页，这不是很明显。
在其他更主题的堆栈上，请参阅例如:
https://security.stackexchange.com/questions/93603/understanding-digitial-certifications
https://security.stackexchange.com/questions/87325/if-the-public-key-cant-be-used-for-decrypting
https://security.stackexchange.com/questions/11879/is-encrypting-data-with-a-private-key-dangerous
https://security.stackexchange.com/questions/68822/trying-to-understand-rsa-and-its-terminology
https://crypto.stackexchange.com/questions/2123/rsa-encryption-with-private-key-and-decryption-with-a-public-key
https://crypto.stackexchange.com/questions/15997/is-rsa-encryption-the-same-as-signature-generation
https://crypto.stackexchange.com/questions/15295/why-the-need-to-hash-before-signing-small-data