For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only OpenSSL. Is it possible to create such key exchange only using OpenSSL?


ECDH is included in the ciphersuites, so the only answer is: yes, this should be possible.

For your further research, it might help to know that Crypto.SE features a lot of Q&As related to “OpenSSL ECDH”.

Also see the related documentation at the OpenSSL wiki for practical code examples showing how to use ECDH in OpenSSL, how to use the low-level APIs to achieve the same, and infos about how to handle ECDH and Named Curves.


You did not mention whether your academic project was C code or a command line tool was enough? As OpenSSL provides both, the simplest way to start is to use the OpenSSL command line tool. The OpenSSL wiki is useful:


In short, use the OpenSSL command line tool to generate:

  • The EC Name Curve parameter file
  • The EC Key Pair (which uses the EC named curve parameter file as input)
  • Extract the Public key from the Key Pair. This is the key you need to share with the other side.
  • Derive the Shared Secret with the Peer's public key and the Key Pair you generated. The derived value is likely to be binary, so on a Linux / mac machine can use use the xxd tool to print it in hex

Please remember, ECDH is designed as a Key Agreement Protocol over an insecure channel. So you should not use the Derived Shared Secret as the actual key. That is where you need to add an Authenticity step. I used HMAC-SHA-256 on the derived Shared Secret. That means both sides need a pre-agreed HMAC Key to complete the process otherwise you risk not knowing who you are exchanging messages with.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.