dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 22:32:31 +02:00
Code Releases Activity

Add openssl command line examples for creation of EC keys

Browse Source 
Add openssl command line examples for creation of EC keys for EVM and IMA
CA and signing key.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-04-26 18:35:58 -04:00 committed by Mimi Zohar
parent 9f669a6b38
commit ce9bfdd091
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
README
View File

@ -217,6 +217,18 @@ asymmetric keys support:
-x509 -config x509_evm.genkey \
-outform DER -out x509_evm.der -keyout privkey_evm.pem
Create an elliptic curve (EC) key (supported since Linux v5.13)
openssl ecparam -name prime256v1 -genkey -out privkey_evm.pem
Generate self-signed x509 EC public key certificate and private key for using
kernel asymmetric key support (supported since Linux v5.13):
openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \
-x509 -config x509_evm.genkey \
-outform DER -out x509_evm.der -keyout privkey_evm.pem \
-newkey ec -pkeyopt ec_paramgen_curve:prime256v1
Configuration file x509_evm.genkey:
# Beginning of the file
@ -245,6 +257,9 @@ Generate public key for using RSA key format:
openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
Similarly generate public EC key:
openssl ec -pubout -in privkey_evm.pem -out pubkey_evm.pem
Copy keys to /etc/keys:
@ -291,6 +306,12 @@ Configuration file ima-local-ca.genkey:
keyUsage = cRLSign, keyCertSign
# EOF
Note: To generated elliptic curve keys add the following parameters to
the 'req' commands below (supported since Linux v5.13):
-newkey ec -pkeyopt ec_paramgen_curve:prime256v1
Generate private key and X509 public key certificate:
openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \