Asymmetric encryption with openssl

Wrap a pair of openssl keys. You should pass your private key and the public key of the person that you are communicating with.

Usage

keypair_openssl(
  pub,
  key,
  envelope = TRUE,
  password = NULL,
  authenticated = TRUE
)

Arguments

pub

An openssl public key. Usually this will be the path to the key, in which case it may either the path to a public key or be the path to a directory containing a file id_rsa.pub. If NULL, then your public key will be used (found via the environment variable USER_PUBKEY, then ~/.ssh/id_rsa.pub). However, it is not that common to use your own public key - typically you want either the sender of a message you are going to decrypt, or the recipient of a message you want to send.

key

An openssl private key. Usually this will be the path to the key, in which case it may either the path to a private key or be the path to a directory containing a file. You may specify NULL here, in which case the environment variable USER_KEY is checked and if that is not defined then ~/.ssh/id_rsa will be used.

envelope

A logical indicating if "envelope" encryption functions should be used. If so, then we use openssl::encrypt_envelope() and openssl::decrypt_envelope(). If FALSE then we use openssl::rsa_encrypt() and openssl::rsa_decrypt(). See the openssl docs for further details. The main effect of this is that using envelope = TRUE will allow you to encrypt much larger data than envelope = FALSE; this is because openssl asymmetric encryption can only encrypt data up to the size of the key itself.

password

A password for the private key. If NULL then you will be prompted interactively for your password, and if a string then that string will be used as the password (but be careful in scripts!)

authenticated

Logical, indicating if the result should be signed with your public key. If TRUE then your key will be verified on decryption. This provides tampering detection.

See also

keypair_sodium() for a similar function using sodium keypairs

Examples

# Note this uses password = FALSE for use in examples only, but
# this should not be done for any data you actually care about.

# Note that the vignette contains much more information than this
# short example and should be referred to before using these
# functions.

# Generate two keypairs, one for Alice, and one for Bob
path_alice <- tempfile()
path_bob <- tempfile()
cyphr::ssh_keygen(path_alice, password = FALSE)
cyphr::ssh_keygen(path_bob, password = FALSE)

# Alice wants to send Bob a message so she creates a key pair with
# her private key and bob's public key (she does not have bob's
# private key).
pair_alice <- cyphr::keypair_openssl(pub = path_bob, key = path_alice)

# She can then encrypt a secret message:
secret <- cyphr::encrypt_string("hi bob", pair_alice)
secret
#>   [1] 58 0a 00 00 00 03 00 04 04 01 00 03 05 00 00 00 00 05 55 54 46 2d 38 00 00
#>  [26] 02 13 00 00 00 04 00 00 00 18 00 00 00 10 0f 54 bb f1 f9 e2 72 8a 42 66 20
#>  [51] aa e9 ad 8f e4 00 00 00 18 00 00 01 00 5d 68 bd 1d 7f 76 ee dc 4e 45 de b2
#>  [76] 84 76 f3 8f 37 b7 a7 10 f0 be d0 79 bb 44 b2 3f 35 42 0a 6a 3d e9 a9 92 87
#> [101] 7b ab ad 68 8d c1 3e ad a3 00 76 c7 4c 68 c2 d6 97 93 cc e6 4b 6d 81 45 7d
#> [126] 14 de 5f 70 d9 23 5a 38 4b 2d 13 66 8d 90 17 2c 7f 8e 6f ab b1 93 a9 25 f9
#> [151] 30 6d 73 01 a4 e0 a8 1e 93 f9 e0 63 21 1e 6f f6 12 c1 97 a4 b9 21 5c 63 3c
#> [176] 77 16 e1 8f f1 f3 f3 a0 58 07 f8 82 2a e4 1b 2c 7b 36 a5 99 0f 48 9c d1 af
#> [201] bf 1d af cf d2 fe f7 36 4c 59 5b df 85 88 bb 3a b7 e3 13 41 75 f1 3e a3 5b
#> [226] a3 08 5b 0e 35 07 d3 33 74 1c ea 8f a1 4a e0 22 ae 7f 1d eb 7d d3 24 9e 13
#> [251] f1 dc 11 9c be 8c b1 38 57 54 1f 83 d9 9d 52 a1 71 82 b4 35 0b e0 1a 7c 0b
#> [276] 34 e7 da 0d 61 d2 2e 97 dd 44 c6 d8 59 fd 94 ec 90 73 72 61 dd c7 f6 88 ff
#> [301] db ca be 6a 5e 76 97 40 06 85 d5 1e 07 72 6b 31 e6 5d f0 00 00 00 18 00 00
#> [326] 00 10 64 c9 a0 67 35 55 c1 1b 9c 31 2e 30 2f 0b 83 2b 00 00 00 18 00 00 01
#> [351] 00 43 64 07 c5 3f d1 4b 19 3c 25 1e 43 55 94 07 6f d2 3b 08 a8 0a ba f3 85
#> [376] 60 ba 3c 92 79 81 74 a9 ab 0c 64 c0 bc 89 36 d1 3a 7b c9 db 0d 05 84 81 cf
#> [401] 2c 12 8b 74 b9 cc c1 71 39 63 1f 83 ae 88 0f 86 2f b7 75 08 47 88 d6 07 a4
#> [426] b2 85 75 1c c6 31 ab ac fb c7 66 48 5d de db 37 30 38 5b 41 6e 62 77 f6 01
#> [451] ad 9b 61 84 d7 34 28 db be d1 25 ab 2f 1c a3 ff 14 96 29 7a a2 51 d8 c2 0e
#> [476] 21 ca 5b 0c c7 5c 06 32 82 64 38 81 65 53 f7 40 2c b0 fb aa d6 89 a8 8d 5d
#> [501] fc 93 77 3b cc 7f 73 d5 98 1d c9 b3 2a b4 12 40 04 0e a6 45 04 c9 70 d0 cb
#> [526] ed 02 ab 79 61 11 a6 ed 41 49 2b d0 ff 9e e6 41 d5 9f ca 8e c6 cb 3e 69 68
#> [551] cd af 57 18 3e f8 e7 2e 1f 22 2f e0 5b 84 ab ec 5a ff 3c aa a6 b0 53 32 99
#> [576] 5f f8 9c da 95 fd d3 4a 2b 16 b8 c0 98 44 ff 0d c9 9f 80 c2 a6 35 ac 8f 82
#> [601] ca 57 03 90 cb 79 43 00 00 04 02 00 00 00 01 00 04 00 09 00 00 00 05 6e 61
#> [626] 6d 65 73 00 00 00 10 00 00 00 04 00 04 00 09 00 00 00 02 69 76 00 04 00 09
#> [651] 00 00 00 07 73 65 73 73 69 6f 6e 00 04 00 09 00 00 00 04 64 61 74 61 00 04
#> [676] 00 09 00 00 00 09 73 69 67 6e 61 74 75 72 65 00 00 00 fe

# Bob wants to read the message so he creates a key pair using
# Alice's public key and his private key:
pair_bob <- cyphr::keypair_openssl(pub = path_alice, key = path_bob)

cyphr::decrypt_string(secret, pair_bob)
#> [1] "hi bob"

# Clean up
unlink(path_alice, recursive = TRUE)
unlink(path_bob, recursive = TRUE)