Analyze the role of php php_openssl.dll

1. Introduction to openssl
Data encryption is an important part of information transmission. It is indeed a very unsafe practice to transmit any information in plain text. Therefore,
It is necessary to encrypt the data. Convert the plain text data into encrypted The text data is then transmitted.

OpenSSL is a set of encryption tools for the SSL/TLS protocol. Its functions are:
1. Generate a private key.
2. Generate a certificate, that is, a digital signature certificate, which contains a public key The key can be used to encrypt and decrypt data in one direction. That is, data encrypted using the public key can only be decrypted using the private key. Data encrypted using the private key can be decrypted using the public key.
3. Calculate information Summary.
4. SSL/TLS client and server-side testing.
5. Processing S/MIME tags and encryption of emails.

2. Introduction to encryption technology.

Encryption, that is, the process of converting plaintext data into ciphertext data. To keep the plaintext confidential.
Encryption algorithm: An algorithm used in the data encryption process. It is used to convert plaintext into ciphertext.
Key: The encryption algorithm performs some operation with the key to convert the plaintext into ciphertext. The data is encrypted to generate encrypted data. When decrypting, the encryption algorithm converts the encrypted data into plaintext data through the key.
In today's encryption technology, the encryption algorithm is public, that is, everyone knows the calculation method used for encryption. .But only the key can be used to decrypt the ciphertext. Therefore, the protection of the key is the core of data security.

3. Introduction to using the openssl tool
1. Private key generation method

Generate a private key, Different digital signature algorithms can be used. They are introduced below;

#Adopt DSA algorithm
$ openssl dsaparam -noout -out dsakey0.pem -genkey 1024

#Adopt RSA algorithm

$ openssl genrsa -out rsakey0.pem 1024
#Adopt RSA algorithm, and use password protection. When generating a private key, you need to enter a password to protect the private key.
#When using this private key for encryption/decryption operations, you also need to enter this password.
$ openssl genrsa - des3 -out rsakey1.pem 10242. Public key generation method
Generate public key based on private key
#Generate public key of dsa algorithm
$ openssl dsa -in dsakey0.pem -pubout -out dsakey0-pub.pem
# Generate the public key of the rsa algorithm
$ openssl rsa -in rsakey0.pem -pubout -out rsakey0-pub.pem3. How to generate a self-signed certificate
#Generate the certificate of the DSA algorithm
$ openssl req -x509 -key dsakey0.pem - days 365 -out mycert-dsa.pem -new
#Generate RSA algorithm certificate
$ openssl req -x509 -key rsakey0.pem -days 365 -out mycert-rsa.pem -new

4. Use certificates for email encryption
Our plaintext letter content:

$ cat test.txt
111111

222222

333333
444444
aaaaaa
Use the certificate to encrypt the plaintext letter and output it to etest.txt file:
$ openssl smime -encrypt -in test. txt -out etest.txt mycert-rsa.pem View the encrypted ciphertext content:

$ cat etest.txt
MIME-Version: 1.0

Content-Disposition: attachment; filename="smime.p7m"

Content-Type smime-type=enveloped-data; name="smime.p7m" 1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lk
Z2l0cyBQdHkgTHRkAgkAr 71mh4NRX/UwDQYJKoZIhvcNAQEBBQAEgYCbrA1WBwQK
Zj7TcNtrxiDzqMBc/Lu063SLKvBK6 mQMqT+npFOOFtzIKdFVkldH0YyQhMZDSCyq
YUtGwOaDw6Jn0AHRt64UwPOKoaeL9RVqp9vgtiFC/ uXis5UeyZCWS1z7Jsih8Aa+
Da/DQN0sOCX85OdK/TDewNx8mTaYBbVf4jBZBgkqhkiG9w0BBwEwGgYIKoZIhvcN

AwIwDgICAKAAECNxsgiJ2s+1ugDC6JknPL+rDYBCddcyPH+bMYjqrUP0 hE/GQ5WSj

sv8CDkOUdvY5XG440yiAL3Z3ysI=Use private key to decrypt and output to dtest.txt file:

$ openssl smime -decrypt -in etest.txt -inkey rsakey0.pem -out dtest.txt View the decrypted letter content, which is exactly the same as the original plain text letter content.

$ cat dtest.txt
111111
222222
333333

444444

aaaaaa

5. Simple file encryption
Clear text file content:

$ cat test.txt
1
22
333
4444
55555

Hello encrypted plain text file, the output is test.enc file, enter "123123" as the encryption password:

$ openssl enc -aes-256-cbc - salt -in test.txt -out test.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password: Decrypt the ciphertext, enter "123123" as the decryption password:

$ openssl enc -d -aes-256-cbc -in test.enc
enter aes-256-cbc decryption password:

1

22
333
4444

55555

Hello

6. Simple string encryption
using base64 method Encrypt:

$ echo "encode me" | openssl enc -base64
ZW5jb2RlIG1lCg== When decrypting, you need to know the encryption algorithm before you can decrypt:

$ echo "ZW5jb2RlIG1lCg==" | openssl enc -base64 -d
encode me

7. Testing of SSL client and server

Use the private key and certificate to start the SSL server. The function of "-www" is to send a status information web page to the client when the client connects to the server.

openssl s_server -key mykey.pem -cert mycert.pem -www connects to the SSL server, and the client will obtain the server’s certificate:

openssl s_client -connect localhost:4433

For more articles on analyzing the role of php php_openssl.dll, please pay attention to the PHP Chinese website!