Analyze the role of php php_openssl.dll

1. Introduction to openssl
Data encryption is an important part of information transmission. It is indeed a very unsafe practice to transmit any information in clear text. Therefore,
needs to encrypt the data. Convert plain text data into cipher text data and then transmit it.

OpenSSL is a set of encryption tools for SSL/TLS protocol. Its functions are:
1. Generate private key.
2 .Generate a certificate, that is, a digital signature certificate, which contains a public key that can be used to encrypt and decrypt data in one direction. That is, data encrypted using the public key can only be decrypted using the
private key. Use the private key Encrypted data can be decrypted using the public key.
3. Calculate message digest.
4. SSL/TLS client and server side testing.
5. Handle S/MIME tags and encryption of emails.

2. Introduction to encryption technology.
Encryption is the process of converting plaintext data into ciphertext data to protect the confidentiality of the plaintext.
Encryption algorithm: A method used in the data encryption process An operation algorithm. Used to convert plaintext into ciphertext.
Key: The encryption algorithm encrypts the plaintext data by performing a certain operation with the key to generate encrypted data. When decrypting, the encryption algorithm passes the key,
Convert the encrypted data into plaintext data.
Today's encryption technology, the encryption algorithm is public, that is, everyone knows the calculation method used for encryption. But only by using the key can
encrypt the ciphertext Decryption. Therefore, the protection of the key is the core of data security.

3. Introduction to using the openssl tool
1. Private key generation method
To generate a private key, you can use different Digital signature algorithm. Introduced below;

#Adopt DSA algorithm
$ openssl dsaparam -noout -out dsakey0.pem -genkey 1024
#Adopt RSA algorithm
$ openssl genrsa -out rsakey0 .pem 1024
#Uses RSA algorithm and uses password protection. When generating a private key, you need to enter a password to protect the private key.
#When using this private key for encryption/decryption operations, you also need to enter a password to protect the private key. You need to enter this password.
$ openssl genrsa -des3 -out rsakey1.pem 10242. Public key generation method
Generate the public key based on the private key
#Generate the public key of the dsa algorithm
$ openssl dsa -in dsakey0.pem -pubout -out dsakey0-pub.pem
#Generate the public key of rsa algorithm
$ openssl rsa -in rsakey0.pem -pubout -out rsakey0-pub.pem3.Self-signed certificate Generation method
#Generate DSA algorithm certificate
$ openssl req -x509 -key dsakey0.pem -days 365 -out mycert-dsa.pem -new
#Generate RSA algorithm certificate
$ openssl req -x509 -key rsakey0.pem -days 365 -out mycert-rsa.pem -new

4. Use certificate for email encryption
Our plain text message content:

$ cat test.txt
111111
222222
333333
444444
aaaaaa
Use the certificate to encrypt the plain text letter and output it to the etest.txt file:
$ openssl smime -encrypt -in test.txt -out etest.txt mycert-rsa.pem View the encrypted ciphertext content:

$ cat etest.txt
MIME-Version: 1.0
Content-Disposition: attachment ; filename="smime.p7m"
Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64

MIIBYAYJKoZIhvcNAQcDoIIBUTCCAU0CAQAxgewwgekCAQAwUjBFMQswCQYDVQQG
EwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lk
Z2l0cyBQdHkgTHRkAgkAr7 1mh4NRX/UwDQYJKoZIhvcNAQEBBQAEgYCbrA1WBwQK
Zj7TcNtrxiDzqMBc/Lu063SLKvB K6mQMqT+npFOOFtzIKdFVkldH0YyQhMZDSCyq
YUtGwOaDw6Jn0AHRt64UwPOKoaeL9RVqp 9vgtiFC/uXis5UeyZCWS1z7Jsih8Aa+
Da/DQN0sOCX85OdK/TDewNx8mTaYBbVf4jBZBgkqhk iG9w0BBwEwGgYIKoZIhvcN
AwIwDgICAKAAECNxsgiJ2s+1ugDC6JknPL+rDYBCddcyPH+bMYjq rUP0hE/GQ5WSj
sv8CDkOUdvY5XG440yiAL3Z3ysI=Use the private key to decrypt and output to the dtest.txt file:

$ openssl smime -decrypt -in etest.txt -inkey rsakey0.pem -out dtest.txt View the decrypted letter content, It is completely consistent with the content of the original plain text letter.

$ cat dtest.txt
111111
222222
333333
444444
aaaaaa

5. Simple file Encrypted
plain text file content:

$ cat test.txt
1
22
333
4444
55555
Hello encrypted plain text file, the output is test .enc file, enter "123123" as the encryption password:

$ openssl enc -aes-256-cbc -salt -in test.txt -out test.enc
enter aes-256-cbc encryption password :
Verifying - enter aes-256-cbc encryption password: To decrypt the ciphertext, enter "123123" as the decryption password:

$ openssl enc -d -aes-256-cbc -in test. enc
enter aes-256-cbc decryption password:
1
22
333
4444
55555
Hello

6. Simple string encryption
Encrypt using base64:

$ echo "encode me" | openssl enc -base64
ZW5jb2RlIG1lCg==When decrypting, you need to know the encryption algorithm before you can decrypt:

$ echo "ZW5jb2RlIG1lCg==" | openssl enc -base64 -d
encode me

7. Testing of SSL client and server
Start the SSL server using the private key and certificate, "-www" The function is to send a status information web page to the client when the client connects to the server.

openssl s_server -key mykey.pem -cert mycert.pem -www connects to the SSL server, and the client will get the server Certificate:

openssl s_client -connect localhost:4433

For more articles on analyzing the role of php php_openssl.dll, please pay attention to the PHP Chinese website!