{ "content": [ { "type": "text", "text": "# Crypt::PK::ECC (perldoc)\n\n## NAME\n\nCrypt::PK::ECC - Public key cryptography based on EC\n\n## SYNOPSIS\n\n### OO interface\n#Encryption: Alice\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $ct = $pub->encrypt(\"secret message\");\n#\n#Encryption: Bob (received ciphertext $ct)\nmy $priv = Crypt::PK::ECC->new('Bobprivecc1.der');\nmy $pt = $priv->decrypt($ct);\n#Signature: Alice\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $sig = $priv->signmessage($message);\n#\n#Signature: Bob (received $message + $sig)\nmy $pub = Crypt::PK::ECC->new('Alicepubecc1.der');\n$pub->verifymessage($sig, $message) or die \"ERROR\";\n#Shared secret\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $sharedsecret = $priv->sharedsecret($pub);\n#Key generation\nmy $pk = Crypt::PK::ECC->new();\n$pk->generatekey('secp160r1');\nmy $privateder = $pk->exportkeyder('private');\nmy $publicder = $pk->exportkeyder('public');\nmy $privatepem = $pk->exportkeypem('private');\nmy $publicpem = $pk->exportkeypem('public');\nmy $publicraw = $pk->exportkeyraw('public');\n### Functional interface\n#Encryption: Alice\nmy $ct = eccencrypt('Bobpubecc1.der', \"secret message\");\n#Encryption: Bob (received ciphertext $ct)\nmy $pt = eccdecrypt('Bobprivecc1.der', $ct);\n#Signature: Alice\nmy $sig = eccsignmessage('Aliceprivecc1.der', $message);\n#Signature: Bob (received $message + $sig)\neccverifymessage('Alicepubecc1.der', $sig, $message) or die \"ERROR\";\n#Shared secret\nmy $sharedsecret = eccsharedsecret('Aliceprivecc1.der', 'Bobpubecc1.der');\n\n## DESCRIPTION\n\nThe module provides a set of core ECC functions as well as implementation of ECDSA and ECDH.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **METHODS**\n- **FUNCTIONS**\n- **OpenSSL interoperability** (4 subsections)\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "Crypt::PK::ECC", "section": "", "mode": "perldoc", "summary": "Crypt::PK::ECC - Public key cryptography based on EC", "synopsis": "### OO interface\n#Encryption: Alice\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $ct = $pub->encrypt(\"secret message\");\n#\n#Encryption: Bob (received ciphertext $ct)\nmy $priv = Crypt::PK::ECC->new('Bobprivecc1.der');\nmy $pt = $priv->decrypt($ct);\n#Signature: Alice\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $sig = $priv->signmessage($message);\n#\n#Signature: Bob (received $message + $sig)\nmy $pub = Crypt::PK::ECC->new('Alicepubecc1.der');\n$pub->verifymessage($sig, $message) or die \"ERROR\";\n#Shared secret\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $sharedsecret = $priv->sharedsecret($pub);\n#Key generation\nmy $pk = Crypt::PK::ECC->new();\n$pk->generatekey('secp160r1');\nmy $privateder = $pk->exportkeyder('private');\nmy $publicder = $pk->exportkeyder('public');\nmy $privatepem = $pk->exportkeypem('private');\nmy $publicpem = $pk->exportkeypem('public');\nmy $publicraw = $pk->exportkeyraw('public');\n### Functional interface\n#Encryption: Alice\nmy $ct = eccencrypt('Bobpubecc1.der', \"secret message\");\n#Encryption: Bob (received ciphertext $ct)\nmy $pt = eccdecrypt('Bobprivecc1.der', $ct);\n#Signature: Alice\nmy $sig = eccsignmessage('Aliceprivecc1.der', $message);\n#Signature: Bob (received $message + $sig)\neccverifymessage('Alicepubecc1.der', $sig, $message) or die \"ERROR\";\n#Shared secret\nmy $sharedsecret = eccsharedsecret('Aliceprivecc1.der', 'Bobpubecc1.der');", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [], "see_also": [], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 47, "subsections": [] }, { "name": "DESCRIPTION", "lines": 5, "subsections": [] }, { "name": "METHODS", "lines": 514, "subsections": [] }, { "name": "FUNCTIONS", "lines": 69, "subsections": [] }, { "name": "OpenSSL interoperability", "lines": 5, "subsections": [ { "name": "Sign by OpenSSL, verify by Crypt::PK::ECC", "lines": 15 }, { "name": "Sign by Crypt::PK::ECC, verify by OpenSSL", "lines": 14 }, { "name": "Keys generated by Crypt::PK::ECC", "lines": 21 }, { "name": "Keys generated by OpenSSL", "lines": 23 } ] }, { "name": "SEE ALSO", "lines": 6, "subsections": [] } ], "sections": { "NAME": { "content": "Crypt::PK::ECC - Public key cryptography based on EC\n", "subsections": [] }, "SYNOPSIS": { "content": "### OO interface\n\n#Encryption: Alice\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $ct = $pub->encrypt(\"secret message\");\n#\n#Encryption: Bob (received ciphertext $ct)\nmy $priv = Crypt::PK::ECC->new('Bobprivecc1.der');\nmy $pt = $priv->decrypt($ct);\n\n#Signature: Alice\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $sig = $priv->signmessage($message);\n#\n#Signature: Bob (received $message + $sig)\nmy $pub = Crypt::PK::ECC->new('Alicepubecc1.der');\n$pub->verifymessage($sig, $message) or die \"ERROR\";\n\n#Shared secret\nmy $priv = Crypt::PK::ECC->new('Aliceprivecc1.der');\nmy $pub = Crypt::PK::ECC->new('Bobpubecc1.der');\nmy $sharedsecret = $priv->sharedsecret($pub);\n\n#Key generation\nmy $pk = Crypt::PK::ECC->new();\n$pk->generatekey('secp160r1');\nmy $privateder = $pk->exportkeyder('private');\nmy $publicder = $pk->exportkeyder('public');\nmy $privatepem = $pk->exportkeypem('private');\nmy $publicpem = $pk->exportkeypem('public');\nmy $publicraw = $pk->exportkeyraw('public');\n\n### Functional interface\n\n#Encryption: Alice\nmy $ct = eccencrypt('Bobpubecc1.der', \"secret message\");\n#Encryption: Bob (received ciphertext $ct)\nmy $pt = eccdecrypt('Bobprivecc1.der', $ct);\n\n#Signature: Alice\nmy $sig = eccsignmessage('Aliceprivecc1.der', $message);\n#Signature: Bob (received $message + $sig)\neccverifymessage('Alicepubecc1.der', $sig, $message) or die \"ERROR\";\n\n#Shared secret\nmy $sharedsecret = eccsharedsecret('Aliceprivecc1.der', 'Bobpubecc1.der');\n", "subsections": [] }, "DESCRIPTION": { "content": "The module provides a set of core ECC functions as well as implementation of ECDSA and ECDH.\n\nSupports elliptic curves \"y^2 = x^3 + a*x + b\" over prime fields \"Fp = Z/pZ\" (binary fields not\nsupported).\n", "subsections": [] }, "METHODS": { "content": "new\nmy $pk = Crypt::PK::ECC->new();\n#or\nmy $pk = Crypt::PK::ECC->new($privorpubkeyfilename);\n#or\nmy $pk = Crypt::PK::ECC->new(\\$buffercontainingprivorpubkey);\n\nSupport for password protected PEM keys\n\nmy $pk = Crypt::PK::ECC->new($privpemkeyfilename, $password);\n#or\nmy $pk = Crypt::PK::ECC->new(\\$buffercontainingprivpemkey, $password);\n\ngeneratekey\nUses Yarrow-based cryptographically strong random number generator seeded with random data taken\nfrom \"/dev/random\" (UNIX) or \"CryptGenRandom\" (Win32).\n\n$pk->generatekey($curvename);\n#or\n$pk->generatekey($hashrefwithcurveparams);\n\nThe following predefined $curvename values are supported:\n\n# curves from http://www.ecc-brainpool.org/download/Domain-parameters.pdf\n'brainpoolp160r1'\n'brainpoolp192r1'\n'brainpoolp224r1'\n'brainpoolp256r1'\n'brainpoolp320r1'\n'brainpoolp384r1'\n'brainpoolp512r1'\n# curves from http://www.secg.org/collateral/sec2final.pdf\n'secp112r1'\n'secp112r2'\n'secp128r1'\n'secp128r2'\n'secp160k1'\n'secp160r1'\n'secp160r2'\n'secp192k1'\n'secp192r1' ... same as nistp192, prime192v1\n'secp224k1'\n'secp224r1' ... same as nistp224\n'secp256k1' ... used by Bitcoin\n'secp256r1' ... same as nistp256, prime256v1\n'secp384r1' ... same as nistp384\n'secp521r1' ... same as nistp521\n#curves from http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf\n'nistp192' ... same as secp192r1, prime192v1\n'nistp224' ... same as secp224r1\n'nistp256' ... same as secp256r1, prime256v1\n'nistp384' ... same as secp384r1\n'nistp521' ... same as secp521r1\n# curves from ANS X9.62\n'prime192v1' ... same as nistp192, secp192r1\n'prime192v2'\n'prime192v3'\n'prime239v1'\n'prime239v2'\n'prime239v3'\n'prime256v1' ... same as nistp256, secp256r1\n\nUsing custom curve parameters:\n\n$pk->generatekey({ prime => 'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF',\nA => 'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC',\nB => '22123DC2395A05CAA7423DAECCC94760A7D462256BD56916',\nGx => '7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896',\nGy => '38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0',\norder => 'FFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13',\ncofactor => 1 });\n\nSee ,\n,\n\n\nimportkey\nLoads private or public key in DER or PEM format.\n\n$pk->importkey($filename);\n#or\n$pk->importkey(\\$buffercontainingkey);\n\nSupport for password protected PEM keys:\n\n$pk->importkey($filename, $password);\n#or\n$pk->importkey(\\$buffercontainingkey, $password);\n\nLoading private or public keys form perl hash:\n\n$pk->importkey($hashref);\n\n# the $hashref is either a key exported via key2hash\n$pk->importkey({\ncurveA => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC\",\ncurveB => \"1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45\",\ncurvebits => 160,\ncurvebytes => 20,\ncurvecofactor => 1,\ncurveGx => \"4A96B5688EF573284664698968C38BB913CBFC82\",\ncurveGy => \"23A628553168947D59DCC912042351377AC5FB32\",\ncurveorder => \"0100000000000000000001F4C8F927AED3CA752257\",\ncurveprime => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF\",\nk => \"B0EE84A749FE95DF997E33B8F333E12101E824C3\",\npubx => \"5AE1ACE3ED0AEA9707CE5C0BCE014F6A2F15023A\",\npuby => \"895D57E992D0A15F88D6680B27B701F615FCDC0F\",\n});\n\n# or with the curve defined just by name\n$pk->importkey({\ncurvename => \"secp160r1\",\nk => \"B0EE84A749FE95DF997E33B8F333E12101E824C3\",\npubx => \"5AE1ACE3ED0AEA9707CE5C0BCE014F6A2F15023A\",\npuby => \"895D57E992D0A15F88D6680B27B701F615FCDC0F\",\n});\n\n# or a hash with items corresponding to JWK (JSON Web Key)\n$pk->importkey({\nkty => \"EC\",\ncrv => \"P-256\",\nx => \"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4\",\ny => \"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM\",\nd => \"870MB6gfuTJ4HtUnUvYMyJpr5eUZNP4Bk43bVdj3eAE\",\n});\n\nSupported key formats:\n\n# all formats can be loaded from a file\nmy $pk = Crypt::PK::ECC->new($filename);\n\n# or from a buffer containing the key\nmy $pk = Crypt::PK::ECC->new(\\$bufferwithkey);\n\n* EC private keys with with all curve parameters\n\n-----BEGIN EC PRIVATE KEY-----\nMIIB+gIBAQQwCKEAcA6cIt6CGfyLKm57LyXWv2PgTjydrHSbvhDJTOl+7bzUW8DS\nrgSdtSPONPq1oIIBWzCCAVcCAQEwPAYHKoZIzj0BAQIxAP//////////////////\n///////////////////////+/////wAAAAAAAAAA/////zB7BDD/////////////\n/////////////////////////////v////8AAAAAAAAAAP////wEMLMxL6fiPufk\nmI4Fa+P4LRkYHZxu/oFBEgMUCI9QE4daxlY5jYou0Z0qhcjt0+wq7wMVAKM1kmqj\nGaJ6HQCJamdzpIJ6zaxzBGEEqofKIr6LBTeOscce8yCtdG4dO2KLp5uYWfdB4IJU\nKjhVAvJdv1UpbDpUXjhydgq3NhfeSpYmLG9dnpi/kpLcKfj0Hb0omhR86doxE7Xw\nuMAKYLHOHX6BnXpDHXyQ6g5fAjEA////////////////////////////////x2NN\ngfQ3Ld9YGg2ySLCneuzsGWrMxSlzAgEBoWQDYgAEeGyHPLmHcszPQ9MIIYnznpzi\nQbvuJtYSjCqtIGxDfzgcLcc3nCc5tBxo+qX6OJEzcWdDAC0bwplY+9Z9jHR3ylNy\novlHoK4ItdWkVO8NH89SLSRyVuOF8N5t3CHIo93B\n-----END EC PRIVATE KEY-----\n\n* EC private keys with curve defined by OID (short form)\n\n-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIBG1c3z52T8XwMsahGVdOZWgKCQJfv+l7djuJjgetdbDoAoGCCqGSM49\nAwEHoUQDQgAEoBUyo8CQAFPeYPvv78ylh5MwFZjTCLQeb042TjiMJxG+9DLFmRSM\nlBQ9T/RsLLc+PmpB1+7yPAR+oR5gZn3kJQ==\n-----END EC PRIVATE KEY-----\n\n* EC private keys with curve defined by OID + compressed form (supported since: CryptX-0.059)\n\n-----BEGIN EC PRIVATE KEY-----\nMFcCAQEEIBG1c3z52T8XwMsahGVdOZWgKCQJfv+l7djuJjgetdbDoAoGCCqGSM49\nAwEHoSQDIgADoBUyo8CQAFPeYPvv78ylh5MwFZjTCLQeb042TjiMJxE=\n-----END EC PRIVATE KEY-----\n\n* EC private keys in password protected PEM format\n\n-----BEGIN EC PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info: AES-128-CBC,98245C830C9282F7937E13D1D5BA11EC\n\n0Y85oZ2+BKXYwrkBjsZdj6gnhOAfS5yDVmEsxFCDug+R3+Kw3QvyIfO4MVo9iWoA\nD7wtoRfbt2OlBaLVl553+6QrUoa2DyKf8kLHQs1x1/J7tJOMM4SCXjlrOaToQ0dT\no7fOnjQjHne16pjgBVqGilY/I79Ab85AnE4uw7vgEucBEiU0d3nrhwuS2Opnhzyx\n009q9VLDPwY2+q7tXjTqnk9mCmQgsiaDJqY09wlauSukYPgVuOJFmi1VdkRSDKYZ\nrUUsQvz6Q6Q+QirSlfHna+NhUgQ2eyhGszwcP6NU8iqIxI+NCwfFVuAzw539yYwS\n8SICczoC/YRlaclayXuomQ==\n-----END EC PRIVATE KEY-----\n\n* EC public keys with all curve parameters\n\n-----BEGIN PUBLIC KEY-----\nMIH1MIGuBgcqhkjOPQIBMIGiAgEBMCwGByqGSM49AQECIQD/////////////////\n///////////////////+///8LzAGBAEABAEHBEEEeb5mfvncu6xVoGKVzocLBwKb\n/NstzijZWfKBWxb4F5hIOtp3JqPEZV2k+/wOEQio/Re0SKaFVBmcR9CP+xDUuAIh\nAP////////////////////66rtzmr0igO7/SXozQNkFBAgEBA0IABITjF/nKK3jg\npjmBRXKWAv7ekR1Ko/Nb5FFPHXjH0sDrpS7qRxFALwJHv7ylGnekgfKU3vzcewNs\nlvjpBYt0Yg4=\n-----END PUBLIC KEY-----\n\n* EC public keys with curve defined by OID (short form)\n\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoBUyo8CQAFPeYPvv78ylh5MwFZjT\nCLQeb042TjiMJxG+9DLFmRSMlBQ9T/RsLLc+PmpB1+7yPAR+oR5gZn3kJQ==\n-----END PUBLIC KEY-----\n\n* EC public keys with curve defined by OID + public point in compressed form (supported since:\nCryptX-0.059)\n\n-----BEGIN PUBLIC KEY-----\nMDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADoBUyo8CQAFPeYPvv78ylh5MwFZjT\nCLQeb042TjiMJxE=\n-----END PUBLIC KEY-----\n\n* PKCS#8 private keys with all curve parameters\n\n-----BEGIN PRIVATE KEY-----\nMIIBMAIBADCB0wYHKoZIzj0CATCBxwIBATAkBgcqhkjOPQEBAhkA////////////\n/////////v//////////MEsEGP////////////////////7//////////AQYIhI9\nwjlaBcqnQj2uzMlHYKfUYiVr1WkWAxUAxGloRDXes3jEtlypWR4qV2MFmi4EMQR9\nKXeBAMZaHaF4NxZYjc4ri0rujiKPGJY4qQ8iY3M3M0tJ3LZqbcj5l4rKdkipQ7AC\nGQD///////////////96YtAxyD9ClPZA7BMCAQEEVTBTAgEBBBiKolTGIsTgOCtl\n6dpdos0LvuaExCDFyT6hNAMyAAREwaCX0VY1LZxLW3G75tmft4p9uhc0J7/+NGaP\nDN3Tr7SXkT9+co2a+8KPJhQy10k=\n-----END PRIVATE KEY-----\n\n* PKCS#8 private keys with curve defined by OID (short form)\n\n-----BEGIN PRIVATE KEY-----\nMG8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQMEVTBTAgEBBBjFP/caeQV4WO3fnWWS\nf917PGzwtypd/t+hNAMyAATSg6pBT7RO6l/p+aKcrFsGuthUdfwJWS5V3NGcVt1b\nlEHQYjWya2YnHaPq/iMFa7A=\n-----END PRIVATE KEY-----\n\n* PKCS#8 encrypted private keys - password protected keys (supported since: CryptX-0.059)\n\n-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIGYMBwGCiqGSIb3DQEMAQMwDgQINApjTa6oFl0CAggABHi+59l4d4e6KtG9yci2\nBSC65LEsQSnrnFAExfKptNU1zMFsDLCRvDeDQDbxc6HlfoxyqFL4SmH1g3RvC/Vv\nNfckdL5O2L8MRnM+ljkFtV2Te4fszWcJFdd7KiNOkPpn+7sWLfzQdvhHChLKUzmz\n4INKZyMv/G7VpZ0=\n-----END ENCRYPTED PRIVATE KEY-----\n\n* EC public key from X509 certificate\n\n-----BEGIN CERTIFICATE-----\nMIIBdDCCARqgAwIBAgIJAL2BBClDEnnOMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM\nDFRlc3QgQ2VydCBFQzAgFw0xNzEyMzAyMDMzNDFaGA8zMDE3MDUwMjIwMzM0MVow\nFzEVMBMGA1UEAwwMVGVzdCBDZXJ0IEVDMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE\nKvkL2r5xZp7RzxLQJK+6tn/7lic+L70e1fmNbHOdxRaRvbK5G0AQWrdsbjJb92Ni\nlCQk2+w/i+VuS2Q3MSR5TaNQME4wHQYDVR0OBBYEFGbJkDyKgaMcIGHS8/WuqIVw\n+R8sMB8GA1UdIwQYMBaAFGbJkDyKgaMcIGHS8/WuqIVw+R8sMAwGA1UdEwQFMAMB\nAf8wCgYIKoZIzj0EAwQDSAAwRQIhAJtOsmrM+gJpImoynAyqTN+7myL71uxd+YeC\n6ze4MnzWAiBQi5/BqEr/SQ1+BC2TPtswvJPRFh2ZvT/6Km3gKoNVXQ==\n-----END CERTIFICATE-----\n\n* SSH public EC keys\n\necdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT...T3xYfJIs=\n\n* SSH public EC keys (RFC-4716 format)\n\n---- BEGIN SSH2 PUBLIC KEY ----\nComment: \"521-bit ECDSA, converted from OpenSSH\"\nAAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFk35srteP9twCwYK\nvU9ovMBi77Dd6lEBPrFaMEb0CZdZ5MC3nSqflGHRWkSbUpjdPdO7cYQNpK9YXHbNSO5hbU\n1gFZgyiGFxwJYYz8NAjedBXMgyH4JWplK5FQm5P5cvaglItC9qkKioUXhCc67YMYBtivXl\nUe0PgIq6kbHTqbX6+5Nw==\n---- END SSH2 PUBLIC KEY ----\n\n* EC private keys in JSON Web Key (JWK) format\n\nSee \n\n{\n\"kty\":\"EC\",\n\"crv\":\"P-256\",\n\"x\":\"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4\",\n\"y\":\"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM\",\n\"d\":\"870MB6gfuTJ4HtUnUvYMyJpr5eUZNP4Bk43bVdj3eAE\",\n}\n\nBEWARE: For JWK support you need to have JSON module installed.\n\n* EC public keys in JSON Web Key (JWK) format\n\n{\n\"kty\":\"EC\",\n\"crv\":\"P-256\",\n\"x\":\"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4\",\n\"y\":\"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM\",\n}\n\nBEWARE: For JWK support you need to have JSON module installed.\n\nimportkeyraw\nImport raw public/private key - can load data exported by \"exportkeyraw\".\n\n$pk->importkeyraw($key, $curve);\n# $key .... data exported by exportkeyraw()\n# $curve .. curve name or hashref with curve parameters - same as by generatekey()\n\nexportkeyder\nmy $privateder = $pk->exportkeyder('private');\n#or\nmy $publicder = $pk->exportkeyder('public');\n\nSince CryptX-0.36 \"exportkeyder\" can also export keys in a format that does not explicitly\ncontain curve parameters but only curve OID.\n\nmy $privateder = $pk->exportkeyder('privateshort');\n#or\nmy $publicder = $pk->exportkeyder('publicshort');\n\nSince CryptX-0.59 \"exportkeyder\" can also export keys in \"compressed\" format that defines\ncurve by OID + stores public point in compressed form.\n\nmy $privatepem = $pk->exportkeyder('privatecompressed');\n#or\nmy $publicpem = $pk->exportkeyder('publiccompressed');\n\nexportkeypem\nmy $privatepem = $pk->exportkeypem('private');\n#or\nmy $publicpem = $pk->exportkeypem('public');\n\nSince CryptX-0.36 \"exportkeypem\" can also export keys in a format that does not explicitly\ncontain curve parameters but only curve OID.\n\nmy $privatepem = $pk->exportkeypem('privateshort');\n#or\nmy $publicpem = $pk->exportkeypem('publicshort');\n\nSince CryptX-0.59 \"exportkeypem\" can also export keys in \"compressed\" format that defines\ncurve by OID + stores public point in compressed form.\n\nmy $privatepem = $pk->exportkeypem('privatecompressed');\n#or\nmy $publicpem = $pk->exportkeypem('publiccompressed');\n\nSupport for password protected PEM keys\n\nmy $privatepem = $pk->exportkeypem('private', $password);\n#or\nmy $privatepem = $pk->exportkeypem('private', $password, $cipher);\n\n# supported ciphers: 'DES-CBC'\n# 'DES-EDE3-CBC'\n# 'SEED-CBC'\n# 'CAMELLIA-128-CBC'\n# 'CAMELLIA-192-CBC'\n# 'CAMELLIA-256-CBC'\n# 'AES-128-CBC'\n# 'AES-192-CBC'\n# 'AES-256-CBC' (DEFAULT)\n\nexportkeyjwk\n*Since: CryptX-0.022*\n\nExports public/private keys as a JSON Web Key (JWK).\n\nmy $privatejsontext = $pk->exportkeyjwk('private');\n#or\nmy $publicjsontext = $pk->exportkeyjwk('public');\n\nAlso exports public/private keys as a perl HASH with JWK structure.\n\nmy $jwkhash = $pk->exportkeyjwk('private', 1);\n#or\nmy $jwkhash = $pk->exportkeyjwk('public', 1);\n\nBEWARE: For JWK support you need to have JSON module installed.\n\nexportkeyjwkthumbprint\n*Since: CryptX-0.031*\n\nExports the key's JSON Web Key Thumbprint as a string.\n\nIf you don't know what this is, see RFC 7638 .\n\nmy $thumbprint = $pk->exportkeyjwkthumbprint('SHA256');\n\nexportkeyraw\nExport raw public/private key. Public key is exported in ASN X9.62 format (compressed or\nuncompressed), private key is exported as raw bytes (padded with leading zeros to have the same\nsize as the ECC curve).\n\nmy $pubkeyoctets = $pk->exportkeyraw('public');\n#or\nmy $pubckeyoctets = $pk->exportkeyraw('publiccompressed');\n#or\nmy $privkeyoctets = $pk->exportkeyraw('private');\n\nencrypt\nmy $pk = Crypt::PK::ECC->new($pubkeyfilename);\nmy $ct = $pk->encrypt($message);\n#or\nmy $ct = $pk->encrypt($message, $hashname);\n\n#NOTE: $hashname can be 'SHA1' (DEFAULT), 'SHA256' or any other hash supported by Crypt::Digest\n\ndecrypt\nmy $pk = Crypt::PK::ECC->new($privkeyfilename);\nmy $pt = $pk->decrypt($ciphertext);\n\nsignmessage\nmy $pk = Crypt::PK::ECC->new($privkeyfilename);\nmy $signature = $priv->signmessage($message);\n#or\nmy $signature = $priv->signmessage($message, $hashname);\n\n#NOTE: $hashname can be 'SHA1' (DEFAULT), 'SHA256' or any other hash supported by Crypt::Digest\n\nsignmessagerfc7518\n*Since: CryptX-0.024*\n\nSame as signmessage only the signature format is as defined by\n (JWA - JSON Web Algorithms).\n\nBEWARE: This creates signatures according to the structure that RFC 7518 describes but does not\napply the RFC logic for the hashing algorithm selection. You'll still need to specify, e.g.,\nSHA256 for a P-256 key to get a fully RFC-7518-compliant signature.\n\nverifymessage\nmy $pk = Crypt::PK::ECC->new($pubkeyfilename);\nmy $valid = $pub->verifymessage($signature, $message)\n#or\nmy $valid = $pub->verifymessage($signature, $message, $hashname);\n\n#NOTE: $hashname can be 'SHA1' (DEFAULT), 'SHA256' or any other hash supported by Crypt::Digest\n\nverifymessagerfc7518\n*Since: CryptX-0.024*\n\nSame as verifymessage only the signature format is as defined by\n (JWA - JSON Web Algorithms).\n\nBEWARE: This verifies signatures according to the structure that RFC 7518 describes but does not\napply the RFC logic for the hashing algorithm selection. You'll still need to specify, e.g.,\nSHA256 for a P-256 key to get a fully RFC-7518-compliant signature.\n\nsignhash\nmy $pk = Crypt::PK::ECC->new($privkeyfilename);\nmy $signature = $priv->signhash($messagehash);\n\nsignhashrfc7518\n*Since: CryptX-0.059*\n\nSame as signhash only the signature format is as defined by\n (JWA - JSON Web Algorithms).\n\nverifyhash\nmy $pk = Crypt::PK::ECC->new($pubkeyfilename);\nmy $valid = $pub->verifyhash($signature, $messagehash);\n\nverifyhashrfc7518\n*Since: CryptX-0.059*\n\nSame as verifyhash only the signature format is as defined by\n (JWA - JSON Web Algorithms).\n\nsharedsecret\n# Alice having her priv key $pk and Bob's public key $pkb\nmy $pk = Crypt::PK::ECC->new($privkeyfilename);\nmy $pkb = Crypt::PK::ECC->new($pubkeyfilename);\nmy $sharedsecret = $pk->sharedsecret($pkb);\n\n# Bob having his priv key $pk and Alice's public key $pka\nmy $pk = Crypt::PK::ECC->new($privkeyfilename);\nmy $pka = Crypt::PK::ECC->new($pubkeyfilename);\nmy $sharedsecret = $pk->sharedsecret($pka); # same value as computed by Alice\n\nisprivate\nmy $rv = $pk->isprivate;\n# 1 .. private key loaded\n# 0 .. public key loaded\n# undef .. no key loaded\n\nsize\nmy $size = $pk->size;\n# returns key size in bytes or undef if no key loaded\n\nkey2hash\nmy $hash = $pk->key2hash;\n\n# returns hash like this (or undef if no key loaded):\n{\nsize => 20, # integer: key (curve) size in bytes\ntype => 1, # integer: 1 .. private, 0 .. public\n#curve parameters\ncurveA => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC\",\ncurveB => \"1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45\",\ncurvebits => 160,\ncurvebytes => 20,\ncurvecofactor => 1,\ncurveGx => \"4A96B5688EF573284664698968C38BB913CBFC82\",\ncurveGy => \"23A628553168947D59DCC912042351377AC5FB32\",\ncurvename => \"secp160r1\",\ncurveorder => \"0100000000000000000001F4C8F927AED3CA752257\",\ncurveprime => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF\",\n#private key\nk => \"B0EE84A749FE95DF997E33B8F333E12101E824C3\",\n#public key point coordinates\npubx => \"5AE1ACE3ED0AEA9707CE5C0BCE014F6A2F15023A\",\npuby => \"895D57E992D0A15F88D6680B27B701F615FCDC0F\",\n}\n\ncurve2hash\n*Since: CryptX-0.024*\n\nmy $crv = $pk->curve2hash;\n\n# returns a hash that can be passed to: $pk->generatekey($crv)\n{\nA => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC\",\nB => \"1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45\",\ncofactor => 1,\nGx => \"4A96B5688EF573284664698968C38BB913CBFC82\",\nGy => \"23A628553168947D59DCC912042351377AC5FB32\",\norder => \"0100000000000000000001F4C8F927AED3CA752257\",\nprime => \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF\",\n}\n", "subsections": [] }, "FUNCTIONS": { "content": "eccencrypt\nElliptic Curve Diffie-Hellman (ECDH) encryption as implemented by libtomcrypt. See method\n\"encrypt\" below.\n\nmy $ct = eccencrypt($pubkeyfilename, $message);\n#or\nmy $ct = eccencrypt(\\$buffercontainingpubkey, $message);\n#or\nmy $ct = eccencrypt($pubkeyfilename, $message, $hashname);\n\n#NOTE: $hashname can be 'SHA1' (DEFAULT), 'SHA256' or any other hash supported by Crypt::Digest\n\nECCDH Encryption is performed by producing a random key, hashing it, and XOR'ing the digest\nagainst the plaintext.\n\neccdecrypt\nElliptic Curve Diffie-Hellman (ECDH) decryption as implemented by libtomcrypt. See method\n\"decrypt\" below.\n\nmy $pt = eccdecrypt($privkeyfilename, $ciphertext);\n#or\nmy $pt = eccdecrypt(\\$buffercontainingprivkey, $ciphertext);\n\neccsignmessage\nElliptic Curve Digital Signature Algorithm (ECDSA) - signature generation. See method\n\"signmessage\" below.\n\nmy $sig = eccsignmessage($privkeyfilename, $message);\n#or\nmy $sig = eccsignmessage(\\$buffercontainingprivkey, $message);\n#or\nmy $sig = eccsignmessage($privkey, $message, $hashname);\n\neccverifymessage\nElliptic Curve Digital Signature Algorithm (ECDSA) - signature verification. See method\n\"verifymessage\" below.\n\neccverifymessage($pubkeyfilename, $signature, $message) or die \"ERROR\";\n#or\neccverifymessage(\\$buffercontainingpubkey, $signature, $message) or die \"ERROR\";\n#or\neccverifymessage($pubkey, $signature, $message, $hashname) or die \"ERROR\";\n\neccsignhash\nElliptic Curve Digital Signature Algorithm (ECDSA) - signature generation. See method\n\"signhash\" below.\n\nmy $sig = eccsignhash($privkeyfilename, $messagehash);\n#or\nmy $sig = eccsignhash(\\$buffercontainingprivkey, $messagehash);\n\neccverifyhash\nElliptic Curve Digital Signature Algorithm (ECDSA) - signature verification. See method\n\"verifyhash\" below.\n\neccverifyhash($pubkeyfilename, $signature, $messagehash) or die \"ERROR\";\n#or\neccverifyhash(\\$buffercontainingpubkey, $signature, $messagehash) or die \"ERROR\";\n\neccsharedsecret\nElliptic curve Diffie-Hellman (ECDH) - construct a Diffie-Hellman shared secret with a private\nand public ECC key. See method \"sharedsecret\" below.\n\n#on Alice side\nmy $sharedsecret = eccsharedsecret('Aliceprivecc1.der', 'Bobpubecc1.der');\n\n#on Bob side\nmy $sharedsecret = eccsharedsecret('Bobprivecc1.der', 'Alicepubecc1.der');\n", "subsections": [] }, "OpenSSL interoperability": { "content": "### let's have:\n# ECC private key in PEM format - eckey.priv.pem\n# ECC public key in PEM format - eckey.pub.pem\n# data file to be signed - input.data\n", "subsections": [ { "name": "Sign by OpenSSL, verify by Crypt::PK::ECC", "content": "Create signature (from commandline):\n\nopenssl dgst -sha1 -sign eckey.priv.pem -out input.sha1-ec.sig input.data\n\nVerify signature (Perl code):\n\nuse Crypt::PK::ECC;\nuse Crypt::Digest 'digestfile';\nuse Crypt::Misc 'readrawfile';\n\nmy $pkec = Crypt::PK::ECC->new(\"eckey.pub.pem\");\nmy $signature = readrawfile(\"input.sha1-ec.sig\");\nmy $valid = $pkec->verifyhash($signature, digestfile(\"SHA1\", \"input.data\"), \"SHA1\", \"v1.5\");\nprint $valid ? \"SUCCESS\" : \"FAILURE\";\n" }, { "name": "Sign by Crypt::PK::ECC, verify by OpenSSL", "content": "Create signature (Perl code):\n\nuse Crypt::PK::ECC;\nuse Crypt::Digest 'digestfile';\nuse Crypt::Misc 'writerawfile';\n\nmy $pkec = Crypt::PK::ECC->new(\"eckey.priv.pem\");\nmy $signature = $pkec->signhash(digestfile(\"SHA1\", \"input.data\"), \"SHA1\", \"v1.5\");\nwriterawfile(\"input.sha1-ec.sig\", $signature);\n\nVerify signature (from commandline):\n\nopenssl dgst -sha1 -verify eckey.pub.pem -signature input.sha1-ec.sig input.data\n" }, { "name": "Keys generated by Crypt::PK::ECC", "content": "Generate keys (Perl code):\n\nuse Crypt::PK::ECC;\nuse Crypt::Misc 'writerawfile';\n\nmy $pkec = Crypt::PK::ECC->new;\n$pkec->generatekey('secp160k1');\nwriterawfile(\"eckey.pub.der\", $pkec->exportkeyder('public'));\nwriterawfile(\"eckey.priv.der\", $pkec->exportkeyder('private'));\nwriterawfile(\"eckey.pub.pem\", $pkec->exportkeypem('public'));\nwriterawfile(\"eckey.priv.pem\", $pkec->exportkeypem('private'));\nwriterawfile(\"eckey-passwd.priv.pem\", $pkec->exportkeypem('private', 'secret'));\n\nUse keys by OpenSSL:\n\nopenssl ec -in eckey.priv.der -text -inform der\nopenssl ec -in eckey.priv.pem -text\nopenssl ec -in eckey-passwd.priv.pem -text -inform pem -passin pass:secret\nopenssl ec -in eckey.pub.der -pubin -text -inform der\nopenssl ec -in eckey.pub.pem -pubin -text\n" }, { "name": "Keys generated by OpenSSL", "content": "Generate keys:\n\nopenssl ecparam -paramenc explicit -name prime192v3 -genkey -out eckey.priv.pem\nopenssl ec -paramenc explicit -in eckey.priv.pem -out eckey.pub.pem -pubout\nopenssl ec -paramenc explicit -in eckey.priv.pem -out eckey.priv.der -outform der\nopenssl ec -paramenc explicit -in eckey.priv.pem -out eckey.pub.der -outform der -pubout\nopenssl ec -paramenc explicit -in eckey.priv.pem -out eckey.privc.der -outform der -convform compressed\nopenssl ec -paramenc explicit -in eckey.priv.pem -out eckey.pubc.der -outform der -pubout -convform compressed\nopenssl ec -paramenc explicit -in eckey.priv.pem -passout pass:secret -des3 -out eckey-passwd.priv.pem\n\nLoad keys (Perl code):\n\nuse Crypt::PK::ECC;\n\nmy $pkec = Crypt::PK::ECC->new;\n$pkec->importkey(\"eckey.pub.der\");\n$pkec->importkey(\"eckey.pubc.der\");\n$pkec->importkey(\"eckey.priv.der\");\n$pkec->importkey(\"eckey.privc.der\");\n$pkec->importkey(\"eckey.pub.pem\");\n$pkec->importkey(\"eckey.priv.pem\");\n$pkec->importkey(\"eckey-passwd.priv.pem\", \"secret\");\n" } ] }, "SEE ALSO": { "content": "* \n\n* \n\n* \n", "subsections": [] } } } }