No way to do ECDH with OpenSSL from the command line?

Question

I've scoured this website and the OpenSSL wiki pages, and done numerous internet searches, and I've come to the seemingly incredible conclusion that one cannot generate an ECDH shared secret key using a given public key and a given private key from the openssl command line. There is at least one other post on this web site that claims you can, without providing an example.

I know the wiki does provide 'C' code examples, but my use case is such that having the command line capability would've been much preferred.

If anyone can kindly disabuse me of this notion by providing an example, I would surely appreciate it.

Answer 1

Here's one way to do roughly what you described:

openssl genpkey -out alice.pem -algorithm EC \
  -pkeyopt ec_paramgen_curve:P-256 \
  -pkeyopt ec_param_enc:named_curve
openssl pkey -pubout -in alice.pem -out alice.pub
openssl genpkey -out bob.pem -algorithm EC \
  -pkeyopt ec_paramgen_curve:P-256 \
  -pkeyopt ec_param_enc:named_curve
openssl pkey -pubout -in bob.pem -out bob.pub
openssl pkeyutl -derive -out alicebob.key -inkey alice.pem -peerkey bob.pub
openssl pkeyutl -derive -out bobalice.key -inkey bob.pem -peerkey alice.pub
cmp alicebob.key bobalice.key

But, who knows whether this implements a secure DH system? You should really consider using X25519, e.g. via NaCl crypto_box, rather than stringing together generic OpenSSL incantations like this.