我正在使用openssl建立一个系统。 我们将使用Diffie Hellman在各方之间共享信息。
我已经能够使用openssl创建一个DH。 现在我想使用PEM格式将公钥发送到客户端,但我找不到任何将DH公钥转换为PEM格式的功能。
任何人都知道如何进行此转换?
这里有你用来生成DH结构的代码:
BIGNUM * p = NULL, * g = NULL;
//Create DH MOD Group
DH * dh = dh_new_group14();
if (!dh)
puts("DH_new failed");
//Check everything is OK
int codes = 0;
if (!DH_check(dh, &codes))
puts("DH_check failed");
//Generate DH key
if (!DH_generate_key(dh))
puts("DH_generate_key failed");
我也能够构建ASN1_INTEGER结构,但我再也找不到任何从这个结构生成PEM的函数。
答案 0 :(得分:1)
好的,我想我已经接近了。 我已经设法用Java获得了一个例子,它产生的是:
SEQUENCE {
SEQUENCE {
OBJECTIDENTIFIER 1.2.840.113549.1.3.1
SEQUENCE {
INTEGER 0x00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff
INTEGER 0x02 (2 decimal)
}
}
BITSTRING 0x0282010100b9c13521bc982e69de3e139d2521f32187ca932fdb579344c37cf2a8effb1c589ac27446656c911aefb84c961be5c389cabae7012b9edbec439ce5b57df4ad427e8baaa334c18c8bbf0fc3b19b197d484ae174f3fb538183368cdb11ecc228fc3fbb0029ff9aa0c06ccebbba47c1d1208410e9506cc08ae3bdc71924e95ae74994268822637ad628af95cf8b09cba0e070c7a8126921f6a700792ef45d844b8812f4d67f19bbc809ad33ac1ea59f4e3a9542e26b3a5f1738de6b9f8092c5a323747a716f39a17f879b87981c00944c8e5fb8f1e4d5ace6c81c182f80711bc55865c8562688b7084ae42f706fb80081f9e97982ef0242df221b202cee9b9ffcaf : 0 unused bit(s)
}
但是我使用PEM_write_bio_DHparams得到的几乎是相同但没有BITSTRING和OBJECTIDENTIFIER。
SEQUENCE {
INTEGER 0x00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff
INTEGER 0x02 (2 decimal)
}
关于问题在哪里的任何线索?
我已经看到Java版本会生成X.509证书来发送数据,也许我应该在我的c ++版本上从DH生成X509证书?
答案 1 :(得分:1)
我认为公钥不是单独存储的,而是存储在证书请求(csr)或证书中。因此,您可以使用PEM_write_bio_X509_REQ()或PEM_write_bio_X509()将它们以PEM格式存储。结果将:
Certificate Request: Data: Version: 0 (0x0) Subject: CN=DH Server Certificate (DSA-signed) Subject Public Key Info: Public Key Algorithm: dhKeyAgreement PKCS#3 DH Public-Key: (1024 bit) public-key: 00:ad:0c:c3:73:26:1b:68:2e:b2:1f:36:0c:eb:3c: 0b:bb:62:b2:fd:ac:8a:92:97:b9:79:6f:1a:f9:2e: 20:21:ff:fd:c4:e2:70:2a:62:ad:62:fc:67:d8:33: 58:09:19:8f:92:a3:b8:5b:41:30:d7:a9:b9:49:01: 07:24:76:ec:f9:88:e6:58:4e:a7:21:83:a4:a8:18: 4e:9a:ca:c5:14:04:9d:85:65:ee:7b:6a:59:80:af: 5e:fd:56:34:3e:95:34:14:64:0c:99:2e:c7:cc:4d: 9f:60:0f:a2:18:60:80:fe:6f:ed:4a:45:f3:4e:49: 97:42:a2:ec:86:c4:fd:5e:e9 prime: 00:e6:7f:e7:4b:4c:5a:55:bf:5e:2d:42:5d:17:62: f0:6f:ff:d2:55:3f:18:a1:9e:51:02:34:ac:2b:64: 1b:c6:07:5f:ea:02:4f:f0:31:ed:71:ad:06:21:47: 4b:36:2a:65:a0:2a:dc:fb:3a:6f:24:6f:fc:4a:67: 0a:50:eb:6d:73:a3:35:fd:6a:d8:2d:68:b4:f2:c5: c1:0b:6e:a1:5a:49:47:d6:bc:ab:9c:3f:d2:7a:7b: 2a:cf:be:2b:34:7e:0c:4f:00:0d:20:3e:83:6e:f3: 6c:65:f6:f0:f5:2a:5d:5f:1a:f2:c1:86:b6:0c:44: 19:1e:b0:66:ee:ea:eb:83:73 generator: 2 (0x2) Attributes: a0:00 Signature Algorithm: itu-t -----BEGIN CERTIFICATE REQUEST----- MIIBZDCCAVgCAQAwLTErMCkGA1UEAxMiREggU2VydmVyIENlcnRpZmljYXRlIChE U0Etc2lnbmVkKTCCASAwgZUGCSqGSIb3DQEDATCBhwKBgQDmf+dLTFpVv14tQl0X YvBv/9JVPxihnlECNKwrZBvGB1/qAk/wMe1xrQYhR0s2KmWgKtz7Om8kb/xKZwpQ 621zozX9atgtaLTyxcELbqFaSUfWvKucP9J6eyrPvis0fgxPAA0gPoNu82xl9vD1 Kl1fGvLBhrYMRBkesGbu6uuDcwIBAgOBhQACgYEArQzDcyYbaC6yHzYM6zwLu2Ky /ayKkpe5eW8a+S4gIf/9xOJwKmKtYvxn2DNYCRmPkqO4W0Ew16m5SQEHJHbs+Yjm WE6nIYOkqBhOmsrFFASdhWXue2pZgK9e/VY0PpU0FGQMmS7HzE2fYA+iGGCA/m/t SkXzTkmXQqLshsT9XumgADADBgEAAwEA -----END CERTIFICATE REQUEST-----
和
Certificate: Data: Version: 1 (0x0) Serial Number: 1407830109 (0x53e9c85d) Signature Algorithm: dsaWithSHA1 Issuer: CN=DSA Server Certificate Validity Not Before: Aug 12 07:55:14 2014 GMT Not After : Aug 9 07:55:14 2024 GMT Subject: CN=DH Server Certificate (DSA-signed) Subject Public Key Info: Public Key Algorithm: dhKeyAgreement PKCS#3 DH Public-Key: (1024 bit) public-key: 00:ad:0c:c3:73:26:1b:68:2e:b2:1f:36:0c:eb:3c: 0b:bb:62:b2:fd:ac:8a:92:97:b9:79:6f:1a:f9:2e: 20:21:ff:fd:c4:e2:70:2a:62:ad:62:fc:67:d8:33: 58:09:19:8f:92:a3:b8:5b:41:30:d7:a9:b9:49:01: 07:24:76:ec:f9:88:e6:58:4e:a7:21:83:a4:a8:18: 4e:9a:ca:c5:14:04:9d:85:65:ee:7b:6a:59:80:af: 5e:fd:56:34:3e:95:34:14:64:0c:99:2e:c7:cc:4d: 9f:60:0f:a2:18:60:80:fe:6f:ed:4a:45:f3:4e:49: 97:42:a2:ec:86:c4:fd:5e:e9 prime: 00:e6:7f:e7:4b:4c:5a:55:bf:5e:2d:42:5d:17:62: f0:6f:ff:d2:55:3f:18:a1:9e:51:02:34:ac:2b:64: 1b:c6:07:5f:ea:02:4f:f0:31:ed:71:ad:06:21:47: 4b:36:2a:65:a0:2a:dc:fb:3a:6f:24:6f:fc:4a:67: 0a:50:eb:6d:73:a3:35:fd:6a:d8:2d:68:b4:f2:c5: c1:0b:6e:a1:5a:49:47:d6:bc:ab:9c:3f:d2:7a:7b: 2a:cf:be:2b:34:7e:0c:4f:00:0d:20:3e:83:6e:f3: 6c:65:f6:f0:f5:2a:5d:5f:1a:f2:c1:86:b6:0c:44: 19:1e:b0:66:ee:ea:eb:83:73 generator: 2 (0x2) Signature Algorithm: dsaWithSHA1 r: 30:1c:1d:8a:87:b3:83:de:b2:4b:a4:1c:69:71:a1: 93:ae:1b:c0:30:0e:e0:b1:94:eb:92:da:e8:3b:12: 8c:59 s: 36:14:4c:fd:ce:a3:de:ef:6a:ac:49:45:b3:69:7d: bf:98:72:9a:b0:6c:7b:59:bc:80:ee:96:32:a6:a3: e8:e0 -----BEGIN CERTIFICATE----- MIIB/zCCAacCBFPpyF0wCQYHKoZIzjgEAzAhMR8wHQYDVQQDExZEU0EgU2VydmVy IENlcnRpZmljYXRlMB4XDTE0MDgxMjA3NTUxNFoXDTI0MDgwOTA3NTUxNFowLTEr MCkGA1UEAxMiREggU2VydmVyIENlcnRpZmljYXRlIChEU0Etc2lnbmVkKTCCASAw gZUGCSqGSIb3DQEDATCBhwKBgQDmf+dLTFpVv14tQl0XYvBv/9JVPxihnlECNKwr ZBvGB1/qAk/wMe1xrQYhR0s2KmWgKtz7Om8kb/xKZwpQ621zozX9atgtaLTyxcEL bqFaSUfWvKucP9J6eyrPvis0fgxPAA0gPoNu82xl9vD1Kl1fGvLBhrYMRBkesGbu 6uuDcwIBAgOBhQACgYEArQzDcyYbaC6yHzYM6zwLu2Ky/ayKkpe5eW8a+S4gIf/9 xOJwKmKtYvxn2DNYCRmPkqO4W0Ew16m5SQEHJHbs+YjmWE6nIYOkqBhOmsrFFASd hWXue2pZgK9e/VY0PpU0FGQMmS7HzE2fYA+iGGCA/m/tSkXzTkmXQqLshsT9Xukw CQYHKoZIzjgEAwNHADBEAiAwHB2Kh7OD3rJLpBxpcaGTrhvAMA7gsZTrktroOxKM WQIgNhRM/c6j3u9qrElFs2l9v5hymrBse1m8gO6WMqaj6OA= -----END CERTIFICATE-----
答案 2 :(得分:0)
看看PEM_write_bio_DHparams()函数做了什么,我认为它可以做你想要的。
[编辑:对不起,错误的功能第一次]
答案 3 :(得分:0)
试试这个;
EVP 用于通用密钥(密钥对)
BIO *b;
b = BIO_new(BIO_s_file());
BIO_set_fp(b, stdout, BIO_NOCLOSE);
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_assign_DH(key, DHAlice);
PEM_write_bio_PUBKEY(b, key);