For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only OpenSSL. Is it possible to create such key exchange only using OpenSSL?
ECDH is included in the ciphersuites, so the only answer is: yes, this should be possible.
For your further research, it might help to know that Crypto.SE features a lot of Q&As related to “OpenSSL ECDH”.
Also see the related documentation at the OpenSSL wiki for practical code examples showing how to use ECDH in OpenSSL, how to use the low-level APIs to achieve the same, and infos about how to handle ECDH and Named Curves.
You did not mention whether your academic project was C code or a command line tool was enough? As OpenSSL provides both, the simplest way to start is to use the OpenSSL command line tool. The OpenSSL wiki is useful:
In short, use the OpenSSL command line tool to generate:
- The EC Name Curve parameter file
- The EC Key Pair (which uses the EC named curve parameter file as input)
- Extract the Public key from the Key Pair. This is the key you need to share with the other side.
- Derive the Shared Secret with the Peer's public key and the Key Pair you generated. The derived value is likely to be binary, so on a Linux / mac machine can use use the
xxdtool to print it in hex
Please remember, ECDH is designed as a Key Agreement Protocol over an insecure channel. So you should not use the Derived Shared Secret as the actual key. That is where you need to add an Authenticity step. I used HMAC-SHA-256 on the derived Shared Secret. That means both sides need a pre-agreed HMAC Key to complete the process otherwise you risk not knowing who you are exchanging messages with.