Creating ECDH using OpenSSL

Question

For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only OpenSSL. Is it possible to create such key exchange only using OpenSSL?

Answer 1

ECDH is included in the ciphersuites, so the only answer is: yes, this should be possible.

For your further research, it might help to know that Crypto.SE features a lot of Q&As related to “OpenSSL ECDH”.

Also see the related documentation at the OpenSSL wiki for practical code examples showing how to use ECDH in OpenSSL, how to use the low-level APIs to achieve the same, and infos about how to handle ECDH and Named Curves.

Answer 2

You did not mention whether your academic project was C code or a command line tool was enough? As OpenSSL provides both, the simplest way to start is to use the OpenSSL command line tool. The OpenSSL wiki is useful:

https://wiki.openssl.org/index.php/Command_Line_Elliptic_Curve_Operations

In short, use the OpenSSL command line tool to generate:

• The EC Name Curve parameter file
• The EC Key Pair (which uses the EC named curve parameter file as input)
• Extract the Public key from the Key Pair. This is the key you need to share with the other side.
• Derive the Shared Secret with the Peer's public key and the Key Pair you generated. The derived value is likely to be binary, so on a Linux / mac machine can use use the xxd tool to print it in hex

Please remember, ECDH is designed as a Key Agreement Protocol over an insecure channel. So you should not use the Derived Shared Secret as the actual key. That is where you need to add an Authenticity step. I used HMAC-SHA-256 on the derived Shared Secret. That means both sides need a pre-agreed HMAC Key to complete the process otherwise you risk not knowing who you are exchanging messages with.