How to encrypt and decrypt with RSA on the command line
The openssl tool provides two subcommands for encrypting with RSA – pkeyutl and the deprecated, RSA-specific rsautl subcommand. We will, of course, use pkeyutl. Documentation for that subcommand can be found on the openssl-pkeyutl man page:
man openssl-pkeyutl
As explained previously, RSA is usually used for encrypting a session key, which will then be used to encrypt useful data. Let’s generate a 256-bit session key:
$ openssl rand -out session_key.bin 32
Now, let’s use openssl pkeyutl with our public RSA key for encrypting the session key:
$ openssl pkeyutl \ -encrypt \ -in session_key.bin \ -out session_key.bin.encrypted \ -pubin \ -inkey rsa_public_key.pem \ -pkeyopt rsa_padding_mode:oaep
Note the -pkeyopt rsa_padding_mode:oaep switch. It instructs...