I've scoured this website and the OpenSSL wiki pages, and done numerous internet searches, and I've come to the seemingly incredible conclusion that one cannot generate an ECDH shared secret key using a given public key and a given private key from the openssl command line. There is at least one other post on this web site that claims you can, without providing an example.

I know the wiki does provide 'C' code examples, but my use case is such that having the command line capability would've been much preferred.

If anyone can kindly disabuse me of this notion by providing an example, I would surely appreciate it.


Here's one way to do roughly what you described:

openssl genpkey -out alice.pem -algorithm EC \
  -pkeyopt ec_paramgen_curve:P-256 \
  -pkeyopt ec_param_enc:named_curve
openssl pkey -pubout -in alice.pem -out alice.pub
openssl genpkey -out bob.pem -algorithm EC \
  -pkeyopt ec_paramgen_curve:P-256 \
  -pkeyopt ec_param_enc:named_curve
openssl pkey -pubout -in bob.pem -out bob.pub
openssl pkeyutl -derive -out alicebob.key -inkey alice.pem -peerkey bob.pub
openssl pkeyutl -derive -out bobalice.key -inkey bob.pem -peerkey alice.pub
cmp alicebob.key bobalice.key

But, who knows whether this implements a secure DH system? You should really consider using X25519, e.g. via NaCl crypto_box, rather than stringing together generic OpenSSL incantations like this.

  • $\begingroup$ "pkeyutl -derive"!!! That's what I was looking for. How come nobody ever posted this anywhere, least of all in the wiki pages? Because no one had a use case until now? Trust me, my use case does not involve implementing a secure DH system. $\endgroup$
    – Phil
    Nov 5 '19 at 23:10
  • $\begingroup$ So the output format of the key does not appear to be DER, or PEM, or ASN1? It looks to be raw hex. And as usual, the man page is silent on this point. Can I also assume then that the shared secret key is the X coordinate of the calculated curve point? $\endgroup$
    – Phil
    Nov 5 '19 at 23:38
  • 1
    $\begingroup$ @Phil It's the output of whatever EVP_PKEY_derive computes. Good luck chasing the chain of abstracted indirections down the rabbit hole of OpenSSL guts to find out what this really is! $\endgroup$ Nov 5 '19 at 23:45
  • $\begingroup$ No kidding. I got to this point after some hours and hit a brick wall: inside openssl/crypto/evp/exchange.c, line #72: exchange->derive = OSSL_get_OP_keyexch_derive(fns); This is supposedly the function that does the heavy lifting? Except, guess what: It's not defined ANYWHERE that google can find. I didn't just search the git repo, I searched the internet and couldn't find this function. So WTH?? Pith poor documentation just seriously chaps my hide. $\endgroup$
    – Phil
    Nov 6 '19 at 23:11
  • $\begingroup$ @Phil It is defined here: github.com/openssl/openssl/blob/…. The macro OSSL_CORE_MAKE_FUNC concatenates OSSL_get_ with OP_keyexch_derive. The effect is to set exchange->derive to (OSSL_OP_keyexch_derive_fn *)fns->function. That said, I think you might actually be looking for pkey_ec_kdf_derive in crypto/ec/ec_pmeth.c. $\endgroup$ Nov 6 '19 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.