Openssl Generate Rsa 256 Key

While Encrypting a File with a Password from the Command Line using OpenSSL is very useful in its own right, the real power of the OpenSSL library is its ability to support the use of public key cryptograph for encrypting or validating data in an unattended manner (where the password is not required to encrypt) is done with public keys. The Commands to Run.

This post briefly describes how to utilise AES to encrypt and decrypt files with OpenSSL.

AES - Advanced Encryption Standard (also known as Rijndael).

OpenSSL - Cryptography and SSL/TLS Toolkit

We’ll walk through the following steps:

  • Generate an AES key plus Initialization vector (iv) with openssl and
  • how to encode/decode a file with the generated key/iv pair

Note: AES is a symmetric-key algorithm which means it uses the same key during encryption/decryption.

Generating key/iv pair

We want to generate a 256-bit key and use Cipher Block Chaining (CBC).

The basic command to use is openssl enc plus some options:

  • -P — Print out the salt, key and IV used, then exit
  • -k <secret> or -pass pass:<secret> — to specify the password to use
  • -aes-256-cbc — the cipher name

Note: We decided to use no salt to keep the example simple.

Issue openssl enc --help for more details and options (e.g. other ciphernames, how to specify a salt, …).


Let's start with encoding Hello, AES! contained in the text file message.txt:



Openssl generate rsa pkcs8

Decoding is almost the same command line - just an additional -d for decrypting:

Note: Beware of the line breaks

While working with AES encryption I encountered the situation where the encoder sometimes produces base 64 encoded data with or without line breaks...

Short answer: Yes, use the OpenSSL -A option.

Skip to main content

Encrypt and decrypt files to public keys via the OpenSSL Command Line

Published: 25-10-2018 Author: Remy van Elst Text only version of this article

Table of Contents

This small tutorial will show you how to use the openssl command line to encryptand decrypt a file using a public key. We will first generate a random key,encrypt that random key against the public key of the other person and use thatrandom key to encrypt the actual file with using symmetric encryption.

Because of how the RSA algorithm works it is not possible to encrypt largefiles. If you create a key of n bits, then the file you want to encrypt mustnot larger than (n minus 11) bits. The most effective use of RSA crypto is toencrypt a random generated password, then encrypt the file with the passwordusing symmetric crypto. If the file is larger then the key size the encryptioncommand will fail:

We generate a random file and use that as the key to encrypt the large file withsymmetric crypto. That random file acts as the password so to say. We encryptthe large file with the small password file as password. Then we send theencrypted file and the encrypted key to the other party and then can decrypt thekey with their public key, the use that key to decrypt the large file.

The following commands are relevant when you work with RSA keys:

  • openssl genrsa: Generates an RSA private keys.
  • openssl rsa: Manage RSA private keys (includes generating a public key from it).
  • openssl rsautl: Encrypt and decrypt files with RSA keys.

The key is just a string of random bytes. We use a base64 encoded string of 128bytes, which is 175 characters. Since 175 characters is 1400 bits, even a smallRSA key will be able to encrypt it.

Get the public key

Let the other party send you a certificate or their public key. If they send toa certificate you can extract the public key using this command:

Generate the random password file

Use the following command to generate the random key:

Openssl Generate Rsa 256 Key Loader

Do this every time you encrypt a file. Use a new key every time!

Update 25-10-2018

The key format is HEX because the base64 format adds newlines. The -passargument later on only takes the first line of the file, so the full key is notused. (Thanks Ken Larson for pointing this to me)

Encrypt the file with the random key

Use the following command to encrypt the large file with the random key:

The file size doesn't grows that much:

It's encrypted however:

Encrypt the random key with the public keyfile

Use the following command to encrypt the random keyfile with the other personspublic key:

You can safely send the key.bin.enc and the largefile.pdf.enc to the otherparty.

You might want to sign the two files with your public key as well.

Decrypt the random key with our private key file

If you want to decrypt a file encrypted with this setup, use the followingcommand with your privte key (beloning to the pubkey the random key was cryptedto) to decrypt the random key:

This will result in the decrypted random key we encrypted the file in.

Decrypt the large file with the random key

Once you have the random key, you can decrypt the encrypted file with thedecrypted key:

This will result in the decrypted large file.

Tags: ca, certificate, decrypt, encrypt, openssl, pki, ssl, tls, tutorials

Openssl Generate Rsa Key Pair