Sitara Linux Training: Cryptography

Introduction

This lab will introduce cryptographic functions that are available on the Sitara platform through the open-source application OpenSSL.  The original intent of OpenSSL has always been to be a pure software implementation of cryptographic functions. All Sitara products will execute OpenSSL in software only mode. Certain Sitara devices also include cryptographic accelerators that can be accessed by OpenSSL through a special Linux hardware driver.

Each of the following sections below will detail different aspects of the OpenSSL application and walk through the steps leading to the development of a secure web page. If you have questions or feedback please e-mail the sdk_feedback@list.ti.com mailing list.

Lab Configuration

The following are the hardware and software configurations for this lab. The steps in this lab are written against this configuration. The concepts of the lab will apply to other configurations but will need to be adapted accordingly.

Hardware

• AM335x EVM-SK (TMDSSK3358) - Order Now
• Router connecting AM335x EVM-SK and Linux Host
• USB cable connection between AM335x EVM-SK and Linux Host using the micro-USB connector (J3/USB0)

  NOTE
  
  Other target boards can be used but the steps below related to serial and ethernet connections may differ.

• 5V power supply (typically provided with the AM335x EVM-SK)

  NOTE
  
  The AM335x EVM uses a standard DB9 connector and serial cable. New Win7 based Host PCs may require a USB-to-Serial cable since newer laptops do not have serial ports.

Software

• A Linux host PC configured as per the Linux Host Configuration page
• Sitara Linux SDK installed. This lab assumes the latest Sitara Linux SDK is installed in /home/sitara. If you use a different location please modify the below steps accordingly.
• SD card with Sitara Linux SDK installed.
  • For help creating a 2 partition SD card with the SDK conent see the create_sdcard.sh script page

OpenSSL Command Line Basics

Description

The OpenSSL command line application is lacking in formal documentation.  This section will describe a few handy commands to know that will get you started.

Key Points

OpenSSL is designed with a full API that can be called from higher level user applications.  The OpenSSL command-line binary (used in this lab) is also included and comes in handy for use in scripts and one-time command line operations.

Lab Steps

Typing just "openssl" at the command line with no other parameters will start the app in an interactive mode.  The terminal prompt will change and is ready for any valid openssl command.  Type "q" to exit the interactive mode.

root@am335x-evm:~# openssl
OpenSSL>
OpenSSL>
OpenSSL> version
OpenSSL 1.0.0d 8 Feb 2011
OpenSSL>
OpenSSL>
OpenSSL> q
root@am335x-evm:~#

Valid commands can be added as parameters to perform complete actions.

The command "version" will display basic information about the openssl binary and adding "-a" will provide more verbose information.

root@am335x-evm:~#
root@am335x-evm:~# openssl version -a
OpenSSL 1.0.0d 8 Feb 2011
built on: Sun Apr 8 14:59:48 CDT 2012
platform: linux-elf-arm
options: bn(64,32) rc4(ptr,int) des(idx,risc1,2,long) idea(int) blowfish(idx)
compiler: arm-arago-linux-gnueabi-gcc -march=armv7-a -mtune=cortex-a8 -mfpu=neon -mfloat-abi=softfp -mthumb-interwork -mno-thumb 
--sysroot=/home/hudson/amsdk-nightly-build/cortex-A8/arago-tmp/sysroots/armv7a-arago-linux-gnueabi -fPIC -DOPENSSL_PIC 
-DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -fexpensive-optimizations -frename-registers 
-fomit-frame-pointer -O2 -ggdb2 -Wall -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
OPENSSLDIR: "/usr/lib/ssl"
root@am335x-evm:~#
root@am335x-evm:~#

Although there is not an explicit "help" command, entering any invalid command ("help" does just fine) will provide a useful list of valid commands and list of algorithms.

root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# openssl help
openssl:Error: 'help' is an invalid command.
Standard commands
asn1parse  ca         ciphers     cms
crl        crl2pkcs7  dgst        dh
dhparam    dsa        dsaparam    ec
ecparam    enc        engine      errstr
gendh      gendsa     genpkey     genrsa
nseq       ocsp       passwd      pkcs12
pkcs7      pkcs8      pkey        pkeyparam
pkeyutl    prime      rand        req
rsa        rsautl     s_client    s_server
s_time     sess_id    smime       speed
spkac      ts verify  version
x509

Message Digest commands (see the `dgst' command for more details)
md4 md5 mdc2 rmd160
sha sha1

Cipher commands (see the `enc' command for more details)
aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb
aes-256-cbc aes-256-ecb base64 bf
bf-cbc bf-cfb bf-ecb bf-ofb
camellia-128-cbc camellia-128-ecb camellia-192-cbc camellia-192-ecb
camellia-256-cbc camellia-256-ecb cast cast-cbc
cast5-cbc cast5-cfb cast5-ecb cast5-ofb
des des-cbc des-cfb des-ecb
des-ede des-ede-cbc des-ede-cfb des-ede-ofb
des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb
des-ofb des3 desx idea
idea-cbc idea-cfb idea-ecb idea-ofb
rc2 rc2-40-cbc rc2-64-cbc rc2-cbc
rc2-cfb rc2-ecb rc2-ofb rc4
rc4-40 seed seed-cbc seed-cfb
seed-ecb seed-ofb
root@am335x-evm:~#
root@am335x-evm:~#

The list of algorithms that result from the invalid command will probably not be complete.  The best list of commands and algorithms is on the openssl.org website.  Please go to: http://www.openssl.org/docs/apps/openssl.html

for that list.

OpenSSL Performance

Description

The OpenSSL application contains a "speed" test that allows the user to baseline the perfomance of all of the cryptographic functions in OpenSSL

Lab Steps

Type the "speed" command along with any of the available ciphers in the list from the usage menu.  The example below shows the test for 128bit AES CBC (cipher-block chaining) mode.

root@am335x-evm:~# openssl speed aes-128-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 2642952 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 725084 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 256 size blocks: 187699 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 1024 size blocks: 47298 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 5922 aes-128 cbc's in 3.00s
OpenSSL 1.0.0d 8 Feb 2011
built on: Sun Apr 8 14:59:48 CDT 2012
options:bn(64,32) rc4(ptr,int) des(idx,risc1,2,long) aes(partial) idea(int) blowfish(idx)
compiler: arm-arago-linux-gnueabi-gcc -march=armv7-a -mtune=cortex-a8 -mfpu=neon -mfloat-abi=softfp 
-mthumb-interwork -mno-thumb --sysroot=/home/hudson/amsdk-nightly-build/cortex-A8/arago-tmp/sysroots
/armv7a-arago-linux-gnueabi -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H 
-DL_ENDIAN -DTERMIO -fexpensive-optimizations -frename-registers -fomit-frame-pointer -O2 -ggdb2 -Wall 
-DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
The 'numbers' are in 1000s of bytes per second processed.
type          16 bytes    64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc   14142.89k   15520.19k   16070.55k   16144.38k    16171.01k
root@am335x-evm:~#
root@am335x-evm:~#

The test runs for 3 full seconds on a variety of block sizes.  At the end of the test a summary is given in kbytes/second for each block size .

As noted in the previous section the output from an invalid command that lists algorithms may not be complete.  To get the true list that will work with the speed command.  Type "openssl speed" with an invalid algorithm to list all the valid input.

root@am335x-evm:~# openssl speed askdjh
Error: bad option or value
Available values:
mdc2 md4 md5 hmac sha1 sha256 sha512 whirlpoolrmd160
idea-cbc seed-cbc rc2-cbc bf-cbc
des-cbc des-ede3 aes-128-cbc aes-192-cbc aes-256-cbc aes-128-ige aes-192-ige aes-256-ige
camellia-128-cbc camellia-192-cbc camellia-256-cbc rc4
rsa512 rsa1024 rsa2048 rsa4096
dsa512 dsa1024 dsa2048
ecdsap160 ecdsap192 ecdsap224 ecdsap256 ecdsap384 ecdsap521
ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571
ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571
ecdsa
ecdhp160 ecdhp192 ecdhp224 ecdhp256 ecdhp384 ecdhp521
ecdhk163 ecdhk233 ecdhk283 ecdhk409 ecdhk571
ecdhb163 ecdhb233 ecdhb283 ecdhb409 ecdhb571
ecdh
idea seed rc2 des aes camellia rsa blowfish

Available options:
-engine e use engine e, possibly a hardware device.
-evp e use EVP e.
-decrypt time decryption instead of encryption (only EVP).
-mr produce machine readable output.
-multi n run n benchmarks in parallel.
root@am335x-evm root@am335x-evm:~#

Using an invalid algorithms for the speed test reveals the true list of algorithms that includes SHA256 and SHA512.

root@am335x-evm:~# openssl speed sha256
Doing sha256 for 3s on 16 size blocks: 544439 sha256's in 3.00s
Doing sha256 for 3s on 64 size blocks: 329221 sha256's in 3.00s
Doing sha256 for 3s on 256 size blocks: 149819 sha256's in 2.99s
Doing sha256 for 3s on 1024 size blocks: 47326 sha256's in 3.00s
Doing sha256 for 3s on 8192 size blocks: 6407 sha256's in 2.99s
OpenSSL 1.0.0d 8 Feb 2011
built on: Sun Apr 8 14:59:48 CDT 2012
options:bn(64,32) rc4(ptr,int) des(idx,risc1,2,long) aes(partial) idea(int) blowfish(idx)
compiler: arm-arago-linux-gnueabi-gcc -march=armv7-a -mtune=cortex-a8 -mfpu=neon -mfloat-abi=softfp 
-mthumb-interwork -mno-thumb --sysroot=/home/hudson/amsdk-nightly-build/cortex-A8/arago-tmp/sysroots
/armv7a-arago-linux-gnueabi -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H 
-DL_ENDIAN -DTERMIO -fexpensive-optimizations -frename-registers -fomit-frame-pointer -O2 -ggdb2 -Wall 
-DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
sha256 2903.67k 7023.38k 12827.31k 16153.94k 17553.89k
root@am335x-evm root@am335x-evm:~#

Basic Encrypt/Decrypt

Description

Simple encryption and decryption of a data file with a simple password.

Key Points

The OpenSSL application allows a user to perform simple encryption functions without the use of a formal key structure that would be used in a higher level application such as a web browser.

The steps in this lab can be used to encrypt any file with any available encryption cipher.  The file used here is an html file from the Matrix application.  Since html files are simple text files, it is easy to analyze the file before and after the cryptographic operations and see that things happend as expected.

Lab Steps

The file used in this lab is an html file that is the main page of the Matrix application.  This file is an ordinary text file which makes the process easy to analyze.  First run " ls -l" and "more" on this file to observe the size and contents of the file.

 

root@am335x-evm:~# ls -l /usr/share/matrix-gui-2.0/index.php
-rwxr-xr-x 1 1000 1000 5953 Apr 8 23:58 /usr/share/matrix-gui-2.0/index.php

 

The listing shows that this file is 5953 bytes in size.

 root@am335x-evm:~# more /usr/share/matrix-gui-2.0/index.php
<?php
/*
* Copyright (C) 2011 Texas Instruments Incorporated - http://www.ti.com/
*
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the
* distribution.
*
* Neither the name of Texas Instruments Incorporated nor the names of
* its contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

root@am335x-evm:~#
 

 

And the more command shows that it is an ordinary text file with html content.

Use the following command to encrypt the file using AES 256 and save the result to a file in the current directory.  The command will prompt for a password and then again to verify the password. The "-p" option will print out information about the key that is used in the encryption.

 root@am335x-evm:~# openssl enc -p -aes-256-cbc -salt -in /usr/share/matrix-gui-2.0/index.php -out index_php.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
salt=EAAA895FE864A590
key=2A8EA5E01DFD2F5AD65636C2344A75471FAF6B3D4719D80D38C57C3C0691ADDD
iv =129E7D05B86BA68362038FAA3A400F27
root@am335x-evm:~# 

Note the key length here of 256 bits.  A listing of this new file shows that it is slightly bigger than the original file.  There is some additional information at the beginning of the file due to the use of a "salted" CBC mode encryption algorithm.  

 

 root@am335x-evm:~# ls -l
-rw-r--r-- 1 root root 5984 Apr 13 12:12 index_php.enc
root@am335x-evm:~# 

 

Using "more" to show the contents of the encrypted file shows that the contents appear as garbage.  Use "q" to quit the more command and return to the terminal prompt.  It is possible that the garbage that hits the screen as a result of using more on this file may affect the UART terminal being used here.  If the prompt does not come back to the terminal, close and restart the UART application.  It is possible to pipe the more command to a formatting command that will prevent this.  Use " | od -x" to pipe results of the more command to the command that will format the data file to proper hex values for the screen.

root@am335x-evm:~# more index_php.enc
Salted__?d!?±Â:Ø
g¾8IÛjÏI(1%)
x¡NQÎYõm²K:?Wj?&?u0¨z¯R?kM÷
Fã7añ×óKî9éhúâ¤;?¥ÚÞ5ìk?iöU

zFµ£QxACgvFh×ïW^óÃBÕpz

1&

 

The command to decrypt the file must use the same algorithm and password.  The result is written to another file in the current directory

root@am335x-evm:~# openssl enc -d -p -aes-256-cbc -in index_php.enc -out index_php.dec
enter aes-256-cbc decryption password:
salt=EAAA895FE864A590
key=2A8EA5E01DFD2F5AD65636C2344A75471FAF6B3D4719D80D38C57C3C0691ADDD
iv =129E7D05B86BA68362038FAA3A400F27
root@am335x-evm:~# 

 

  A listing of this new file shows that it is the exact size of the original file.

root@am335x-evm:~# ls -l
-rw-r--r-- 1 root root 5953 Apr 13 12:14 index_php.dec
-rw-r--r-- 1 root root 5984 Apr 13 12:12 index_php.enc
root@am335x-evm:~#

And a "diff" of the decrypted file against the original file shows that they are the same.

root@am335x-evm:~# diff /usr/share/matrix-gui-2.0/index.php index_php.dec
root@am335x-evm:~#

Basic Hash

Description

Simple hash generation 

Key Points

Even trivial edits to a file, produce tremendous differences in the hash result for that file.

Lab Steps

Use the command "dgst" along with a parameter for an available hash cipher to produce the hash for any file.  The file used here is the html file from the main Matrix page.  The examples below show the hash result for SHA1 and MD5.

root@am335x-evm:~# openssl dgst -sha1 /usr/share/matrix-gui-2.0/index.php
SHA1(/usr/share/matrix-gui-2.0/index.php)= 2a3e662f0462afc5bc1d62704bd7901303b25fbf
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -md5 /usr/share/matrix-gui-2.0/index.php
MD5(/usr/share/matrix-gui-2.0/index.php)= 997c7e10d595395ee8f3c446fd9ceb89
root@am335x-evm:~#

 Now make a trivial edit to the file using vi (or any other text editor).  In the example below, an extra asterisk is added to fourth line of the file. 

root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# vi /usr/share/matrix-gui-2.0/index.php
<?php
/*
* Copyright (C) 2011 Texas Instruments Incorporated - http://www.ti.com/
*
**
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the
* distribution.
*
* Neither the name of Texas Instruments Incorporated nor the names of
* its contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
root@am335x-evm:~#

 Running the hash functions again on this "new" file show how different the hash result becomes.

 

root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -sha1 /usr/share/matrix-gui-2.0/index.php
SHA1(/usr/share/matrix-gui-2.0/index.php)= f9ae341c4d753090a985bb082e53d716ccaf7c9b
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -md5 /usr/share/matrix-gui-2.0/index.php
MD5(/usr/share/matrix-gui-2.0/index.php)= e78f5b4bd5201f3339800491a6d6cdab
root@am335x-evm:~#
root@am335x-evm:~#

Generate Keys

Description

This section will show how to generate a private/public key pair and use the private key.

Key Points

The generation of keys is the first step in the creation of a secure web server application.

Lab Steps

The first step is to generate a private key.  The following command creates an RSA key with length 1024.  The key is written to a file in the local directory.

root@am335x-evm:~# openssl genrsa -out privatekey.pem 1024
Generating RSA private key, 1024 bit long modulus
...............++++++
..............++++++
e is 65537 (0x10001)
root@am335x-evm:~# ls -l
-rw-r--r--    1 1000     1000            0 Apr 13  2012 AM335x541SDGT
-rw-r--r--    1 root     root          887 Apr 13 11:25 privatekey.pem
root@am335x-evm:~# more privatekey.pem
-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQC4w2Evmi5tsOo9MORWo0i2FFtmpWIpLbthE/jXTKIkYFTeulDP
ap0H4jeTTu4WYhXBtq6QsdFygE71G9x0rnQz+QEGIUlRtAfBseHqB6Kg+vsnD4L9
H/Gk9hptKpxuyWNIJH3icIR3lzHWce9qb7z48dXMN2iRGZ76K6HNfh734wIDAQAB
AoGBAKCyDc0BJHBy9sfRxkc0LQFwIy7bmMyH4flFDaD0HfHVdvtgwPglmf5JWlzc
wWbmWFXrNVjTz37u6b11RgCV2qn+UOcwa5umWQxfOly7nWD7HWDHFqyXm0r2tCae
bMVr12p9PNd1Wqt6+zbj+Sy7b1wZb/wwS2vX84T8/5NqEl9BAkEA55PMddGyTgNE
w6TMxrQrOFwvm04cNgUSaLW2JKz+AnaJeCdAJAYuurTNk+ooX+pq5JcVzCDn/s7i
sNI4byKvXQJBAMw/rW4DxEDz6YJiEXpNS0n52gHhXHK+0n+ZsAFbZHNLWwTWKeyN
FX3/s/f/XMXcS0EuYArhx+rZcnzWn2YgED8CQQC5V004rtAqJ+uNOgS6s9Azl3Ry
tB1YDs8hBu30hI/3oK99fsyTCG+19qbiT3Jo8dEDivhjG6MSCLreEiIgsH3xAkAj
1kxs0DZgGyvul5xvdB5wtWkeCVe6PmcawnGSW2HNpPwsZhNnEP4jZHlEW0cA5H1D
y4pIfoMgXtTquJGxTpDrAkBMZi+K6Nl/LDL+IUS8DDvGLkdRjfI7M0IS/Gdf0rCL
qIHMx+mThpIEbtvpuJOUO4GdRcU73NBBfm5M2udb028V
-----END RSA PRIVATE KEY-----
root@am335x-evm:~#

Using this private key, a matching public key can be generated with the following command.  The result is saved to a different file in the currnet directory.

root@am335x-evm:~# openssl rsa -in privatekey.pem -pubout > publickey.pem
writing RSA key
root@am335x-evm:~# ls -l
-rw-r--r--    1 root     root         1082 Apr 13 11:26 cert.pem
-rw-r--r--    1 root     root          887 Apr 13 11:25 privatekey.pem
-rw-r--r--    1 root     root          272 Apr 13 11:27 publickey.pem
root@am335x-evm:~# more publickey.pem
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4w2Evmi5tsOo9MORWo0i2FFtm
pWIpLbthE/jXTKIkYFTeulDPap0H4jeTTu4WYhXBtq6QsdFygE71G9x0rnQz+QEG
IUlRtAfBseHqB6Kg+vsnD4L9H/Gk9hptKpxuyWNIJH3icIR3lzHWce9qb7z48dXM
N2iRGZ76K6HNfh734wIDAQAB
-----END PUBLIC KEY-----
root@am335x-evm:~#

Generate a Digital Signature (Sign a Hash)

Description

This section describes how to create a digital signature for a data file.

Keypoints

Using the keys generated in the previous section, the hash of the data file is generated and then encrypted with the private key.  The hash is verified with the public key.

Lab Steps

Execute the "dgst" as in the previous section for the basic hash, except add the parameter "-sign" with the name of the private key.  Also include a name for an output file for the digital signature.  This can be done with any hash algorithm.  In the example below, SHA256 and MD5 are used on the same file to produce two different signatures

root@am335x-evm:~# openssl dgst -sha256 -sign privatekey.pem \
			-out index_php.sha256 /usr/share/matrix-gui-2.0/index.php
root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -md5 -sign privatekey.pem \
			-out index_php.md5 /usr/share/matrix-gui-2.0/index.php
root@am335x-evm:~#
root@am335x-evm:~# ls -l
-rw-r--r-- 1 1000 1000 0 Apr 13 2012 AM335x541NFSGT
-rw-r--r-- 1 root root 1094 Apr 18 2012 cert.pem
-rw-r--r-- 1 root root 128 Apr 19 2012 index_php.md5
-rw-r--r-- 1 root root 128 Apr 19 2012 index_php.sha256
-rw-r--r-- 1 root root 887 Apr 18 2012 privatekey.pem
-rw-r--r-- 1 root root 272 Apr 18 2012 publickey.pem
root@am335x-evm:~#

The files would appear as garbage with the more command.  Piping the result to a formatting command ensures that the garbage data does not mess up the UART terminal window.

root@am335x-evm:~# more index_php.sha256 | od -x
0000000 	d484 2f35 0310 75bd 56a6 9047 cc4b ce3d
0000020 	9457 f863 cea2 fdcc 591b fde5 3e9a 87f0
0000040 	1b24 7128 4f06 1368 ecf9 058e 90c3 e40c
0000060 	f4c4 9b31 9882 0542 1395 68a5 aaa4 e6e3
0000100 	22d3 b058 130d 2457 6f59 15d3 ed5c c718
0000120 	66eb aafd cf8a c1b4 ccf1 049b d7f4 c4fe
0000140 	4c1c 53e2 712c 72dd 7bc6 8afe 67f0 edfe
0000160 	fe31 be32 8f1e 20ee 5aa5 7809 650b 5120
0000200
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# more index_php.md5 | od -x
0000000 	f630 2214 82eb 4a4d 2be5 b653 378f a18d
0000020 	b181 e616 207b bc45 3fed 6995 c974 3b69
0000040 	de94 4687 d556 0c69 2aa8 a4a3 851f 9c38
0000060 	4613 48af 0f84 c036 a7a0 6f33 fdfc 09d3
0000100 	e562 9834 5d98 d08f 8091 8a77 d21f 5985
0000120 	8849 ba66 f5a7 aa2d 9d53 5e59 4833 3717
0000140 	d6ee e4dd e590 0104 433b 7110 1711 85b6
0000160 	01d8 70d5 8090 16a9 0f69 75fe 820e a2b5
0000200
root@am335x-evm:~#

Now the signature can be verified by providing OpenSSL with the public key, signature and the original file from which the hash was derived.  The result is a basic pass/fail indication.

root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -sha256 -verify publickey.pem \
			-signature index_php.sha256 /usr/share/matrix-gui-2.0/index.php
Verified OK
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# openssl dgst -md5 -verify publickey.pem \
			-signature index_php.md5 /usr/share/matrix-gui-2.0/index.php
Verified OK
root@am335x-evm:~#
root@am335x-evm:~#

Web Certificate Generation

Description

Generate a web certificate for a secure web server.

Key Points

This example produces a minimal and trivial self-signed web certificate, but still demonstrates the first step necessary to produce a certificate that would be used with an application to a real trusted third party to create a commercial secure web site.  When used with a real web server, client browsers will produce warnings about going to this site.  Different browsers will produce different warnings, but all should allow the certificate to be viewed.

Lab Steps

The following command uses the previously generated private key (located in the current directory) and writes the certificate to a separate file in the current directory.  The command is interactive and will ask the user for the minimal information needed for a basic web certificate.

root@am335x-evm:~# openssl req -x509 -nodes -days 365 -new -key privatekey.pem -out cert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:TX
Locality Name (eg, city) []:Dallas
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Texas Instruments
Organizational Unit Name (eg, section) []:ARM MPU
Common Name (eg, YOUR name) []:Greg Turner
Email Address []:gregturner@ti.com
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~#
root@am335x-evm:~# ls -l
-rw-r--r--    1 root     root         1082 Apr 13 11:26 cert.pem
-rw-r--r--    1 root     root          887 Apr 13 11:25 privatekey.pem
root@am335x-evm:~# more cert.pem
-----BEGIN CERTIFICATE-----
MIIC8jCCAlugAwIBAgIJAJJkRppXQxo9MA0GCSqGSIb3DQEBBQUAMIGRMQswCQYD
VQQGEwJVUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEaMBgGA1UECgwR
VGV4YXMgSW5zdHJ1bWVudHMxEDAOBgNVBAsMB0FSTSBNUFUxFDASBgNVBAMMC0dy
ZWcgVHVybmVyMSAwHgYJKoZIhvcNAQkBFhFncmVndHVybmVyQHRpLmNvbTAeFw0x
MjA0MTMxMTI2NTJaFw0xMzA0MTMxMTI2NTJaMIGRMQswCQYDVQQGEwJVUzELMAkG
A1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEaMBgGA1UECgwRVGV4YXMgSW5zdHJ1
bWVudHMxEDAOBgNVBAsMB0FSTSBNUFUxFDASBgNVBAMMC0dyZWcgVHVybmVyMSAw
HgYJKoZIhvcNAQkBFhFncmVndHVybmVyQHRpLmNvbTCBnzANBgkqhkiG9w0BAQEF
AAOBjQAwgYkCgYEAuMNhL5oubbDqPTDkVqNIthRbZqViKS27YRP410yiJGBU3rpQ
z2qdB+I3k07uFmIVwbaukLHRcoBO9RvcdK50M/kBBiFJUbQHwbHh6geioPr7Jw+C
/R/xpPYabSqcbsljSCR94nCEd5cx1nHvam+8+PHVzDdokRme+iuhzX4e9+MCAwEA
AaNQME4wHQYDVR0OBBYEFGidlAE3HTGPmVaAHI1UpRpJHas0MB8GA1UdIwQYMBaA
FGidlAE3HTGPmVaAHI1UpRpJHas0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
BQADgYEAaUJ2s47f0d4wPHHSJL789rb7Jd2t25zKa6VIZ2OSQ3yJ2q4NW5S9fvzj
xvM3ApesFICrA16gpJtQhxpGGRTJrQ3kejn8OMummwNWr91G0efSVFPpt9tSkN6m
cShJMWSyMdO/c8eIvGp55/iUVRm2LnmBbfnXl3rl40V4G46B4I0=
-----END CERTIFICATE-----
root@am335x-evm:~#
root@am335x-evm:~#

The following command extracts the details of the certificate for viewing.

root@am335x-evm:~# openssl x509 -text -in cert.pem
Certificate:
   Data:
       Version: 3 (0x2)
       Serial Number:
           92:64:46:9a:57:43:1a:3d
       Signature Algorithm: sha1WithRSAEncryption
       Issuer: C=US, ST=TX, L=Dallas, O=Texas Instruments, OU=ARM MPU, CN=Greg Turner/emailAddress=gregturner@ti.com
       Validity
           Not Before: Apr 13 11:26:52 2012 GMT
           Not After : Apr 13 11:26:52 2013 GMT
       Subject: C=US, ST=TX, L=Dallas, O=Texas Instruments, OU=ARM MPU, CN=Greg Turner/emailAddress=gregturner@ti.com
       Subject Public Key Info:
           Public Key Algorithm: rsaEncryption
               Public-Key: (1024 bit)
               Modulus:
                   00:b8:c3:61:2f:9a:2e:6d:b0:ea:3d:30:e4:56:a3:
                   48:b6:14:5b:66:a5:62:29:2d:bb:61:13:f8:d7:4c:
                   a2:24:60:54:de:ba:50:cf:6a:9d:07:e2:37:93:4e:
                   ee:16:62:15:c1:b6:ae:90:b1:d1:72:80:4e:f5:1b:
                   dc:74:ae:74:33:f9:01:06:21:49:51:b4:07:c1:b1:
                   e1:ea:07:a2:a0:fa:fb:27:0f:82:fd:1f:f1:a4:f6:
                   1a:6d:2a:9c:6e:c9:63:48:24:7d:e2:70:84:77:97:
                   31:d6:71:ef:6a:6f:bc:f8:f1:d5:cc:37:68:91:19:
                   9e:fa:2b:a1:cd:7e:1e:f7:e3
               Exponent: 65537 (0x10001)
       X509v3 extensions:
           X509v3 Subject Key Identifier:
               68:9D:94:01:37:1D:31:8F:99:56:80:1C:8D:54:A5:1A:49:1D:AB:34
           X509v3 Authority Key Identifier:
               keyid:68:9D:94:01:37:1D:31:8F:99:56:80:1C:8D:54:A5:1A:49:1D:AB:34
           X509v3 Basic Constraints:
               CA:TRUE
   Signature Algorithm: sha1WithRSAEncryption
       69:42:76:b3:8e:df:d1:de:30:3c:71:d2:24:be:fc:f6:b6:fb:
       25:dd:ad:db:9c:ca:6b:a5:48:67:63:92:43:7c:89:da:ae:0d:
       5b:94:bd:7e:fc:e3:c6:f3:37:02:97:ac:14:80:ab:03:5e:a0:
       a4:9b:50:87:1a:46:19:14:c9:ad:0d:e4:7a:39:fc:38:cb:a6:
       9b:03:56:af:dd:46:d1:e7:d2:54:53:e9:b7:db:52:90:de:a6:
       71:28:49:31:64:b2:31:d3:bf:73:c7:88:bc:6a:79:e7:f8:94:
       55:19:b6:2e:79:81:6d:f9:d7:97:7a:e5:e3:45:78:1b:8e:81:
       e0:8d

-----BEGIN CERTIFICATE-----
MIIC8jCCAlugAwIBAgIJAJJkRppXQxo9MA0GCSqGSIb3DQEBBQUAMIGRMQswCQYD
VQQGEwJVUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEaMBgGA1UECgwR
VGV4YXMgSW5zdHJ1bWVudHMxEDAOBgNVBAsMB0FSTSBNUFUxFDASBgNVBAMMC0dy
ZWcgVHVybmVyMSAwHgYJKoZIhvcNAQkBFhFncmVndHVybmVyQHRpLmNvbTAeFw0x
MjA0MTMxMTI2NTJaFw0xMzA0MTMxMTI2NTJaMIGRMQswCQYDVQQGEwJVUzELMAkG
A1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEaMBgGA1UECgwRVGV4YXMgSW5zdHJ1
bWVudHMxEDAOBgNVBAsMB0FSTSBNUFUxFDASBgNVBAMMC0dyZWcgVHVybmVyMSAw
HgYJKoZIhvcNAQkBFhFncmVndHVybmVyQHRpLmNvbTCBnzANBgkqhkiG9w0BAQEF
AAOBjQAwgYkCgYEAuMNhL5oubbDqPTDkVqNIthRbZqViKS27YRP410yiJGBU3rpQ
z2qdB+I3k07uFmIVwbaukLHRcoBO9RvcdK50M/kBBiFJUbQHwbHh6geioPr7Jw+C
/R/xpPYabSqcbsljSCR94nCEd5cx1nHvam+8+PHVzDdokRme+iuhzX4e9+MCAwEA
AaNQME4wHQYDVR0OBBYEFGidlAE3HTGPmVaAHI1UpRpJHas0MB8GA1UdIwQYMBaA
FGidlAE3HTGPmVaAHI1UpRpJHas0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
BQADgYEAaUJ2s47f0d4wPHHSJL789rb7Jd2t25zKa6VIZ2OSQ3yJ2q4NW5S9fvzj
xvM3ApesFICrA16gpJtQhxpGGRTJrQ3kejn8OMummwNWr91G0efSVFPpt9tSkN6m
cShJMWSyMdO/c8eIvGp55/iUVRm2LnmBbfnXl3rl40V4G46B4I0=
-----END CERTIFICATE-----
root@am335x-evm:~#

And a quick verification of the certificate can be done with the verify command

root@am335x-evm:~# openssl verify cert.pem
cert.pem: C = US, ST = TX, L = Dallas, O = Texas Instruments, OU = RM\08\08ARM MPU, CN = Greg Turner, emailAddress = gregturner@ti.com
error 18 at 0 depth lookup:self signed certificate
OK
root@am335x-evm:~#

Secure Web Server

This lab is currently not available in Sitara Linux SDK 05.05.00.00. Please view the SDK Known Issues for more details.

Description

This lab will start a secure web server that is built into the OpenSSL application.

Prerequisites

To run this demo the Sitara EVM must have an internet connection to another machine that can point a web browser to the EVM.  Ideally the EVM is connected to a router and another computer with a web browser is also connected to this router.

Type "ifconfig" at the terminal of the EVM to find out its IP Address.

Key Points

The web server provided with OpenSSL is not intended to be fully featured like Apache or other web server applications.  However, it is useful to demonstrate the use of the previously generated web certificate.

Lab Steps

Start the web server on the Sitara EVM, using the certificate generated in the previous section of this lab.  The server is run in the background of the Linux OS.  Some messages will be produced as the client browser accesses the server.

root@am335x-evm:~# openssl s_server -key privatekey.pem -cert cert.pem -www &
root@am335x-evm:~# Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT
root@am335x-evm:~#
root@am335x-evm:~# bad gethostbyaddr
ACCEPT
bad gethostbyaddr
ACCEPT
bad gethostbyaddr
ACCEPT

Now point a browser from another computer on the network to the secure server port on the EVM.  The URL for this must be https:// followed by the IP address of the EVM and then :4433.  It is important to include the "s" in https and use the port :4433 to access the OpenSSL secure server.  The browser should provide a warning that you are asking to visit a secure site that contains a self-signed (and therefore intrusted) web certificate.  In the sections below the browser used is Firefox running on a Ubuntu 10.04 computer system.  Others browsers on other operating systems may behave somewhat differently, but they should all warn about the untrusted certificate and allow the user to view the certificate before actually going to the site.

In the example above, Firefox will allow the user to add an exception for this website if you are sure that you want to visit the site.  Also on the "Add Exception..." screen is an opportunity to view the certificate.  Click the "Add Exception..." button.

Now click the "View..." button to get the details of the web certificate.  This should reveal the details that were provided when the certificate was generated.

Final Word

So now let's summarize the process used to make and use a secure web connection.

• The client browser requests an https:// page.
• The web server delivers its certificate with the public key to the client browser.
• The browser verifies that the certificate was issued by a trusted third party (in the real world someone like VeriSign), is still valid and is related to the site contacted.  In the lab here of course the certificate is "self-signed" and therefore untrusted by the browser.
• Some negotiation is done between the client and server to agree on the types and level of encryption capable on each end of the connection.
• The browser then uses the public key, to encrypt a random symmetric encryption key and sends it to the server.
• The web server decrypts the symmetric encryption key using its private key.
• This symmetric key is now used to encrypt and decrypt all communications for the rest of the session.
• Since the symmetric key is randomly created on each session it is useless if ever discovered.