µTasker Private Key Generation

This part project involves generating private keys using both OpenSLL and mbed TLS in an attempt to get to know some of the basic components involved and also compare the capabilities of both libraries in small embedded systems.

mbed TLS Private Key Test

For a Windows user the mbed TLS package makes starting easy due to the fact that it includes a number of demonstration projects that can be built and executed with VisualStudio. The library itself can also be simply built in this VisualStudio environment. The project "key_gen" looked suitable and so was used to make first experiences.

The first thing that is noted is that when generating a private key there are a number of options and the following are the options given by the demonstartion project, which will be assumed to represent the breadth of support in this library:
Key Types:

POLARSSL_PK_RSA
POLARSSL_PK_ECKEY
POLARSSL_PK_ECKEY_DH
POLARSSL_PK_ECDSA
POLARSSL_PK_RSA_ALT
POLARSSL_PK_RSASSA_PSS

It is understood that RSA (Rivest-Shamir-Adleman) is used almost exclusively for SSL and so the first was chosen for testing.

Key length: It is understood that a length of 512 is too small and a length of minimum 768 was recommended (in 2002). 1024 bits was therefore chosen to supposedly be adequately secure today and for some time in to the future.

Eliptical curves: These are however not used for RSA key generation.

Key Format: PEM (Privately Enhanced Mail) or DER (Distinguished Encoding Rules) formats. It is known that PEM is used a lot since it is suitable for storage in ASCII files so this one is chosen. Often the key if protected in the file using a pass phrase but this is not offered as an option in this demonstration and so it remains to be seen whether embed TLS natively supports a pass phrase encryptin option.

Executing the demonstration in VisualStudio quickly results in a private key being generated in a file, whose content looks something like this:

OpenSSL 1.0.2 TLS Private Key Test

Building OpenSSL tests with Windows proved to be much more complicated due to the fact that it isn't supplied by VisualStudio projects. However it does have many test programs and a pre-built shell environment can be used by downloading the latest version from pre-built Windows versions. Once extracted, there is an executable called "openssl.exe" and two DLLs that it uses called "libeay32.dll and "ssleay32.dll". Executing the exe in a DOS shells results in a shell interface with many commands, including "genrsa" whose usage is described at genrsa. The complete OpenSSL code contains the shell interface and so it is also possible to review the operation of the interface and identify which OpenSSL library functions are being used.

It is seen from the description that it supports encrypting the key in the file using a pass phrase (with a number of encryption algorithm options). There is an additional option to specify the public exponent (3 or 65537, where the default is 65537, which is not specifically included in the mbed TLS project). Note here that this command is specifically for RSA key generation and there is a further command called genpkey that allows the RSA algorithm or several others to be selected as well as various options. In fact the manual recommends using this general private key generation command over the algorithm specific one since it allows more options to be used (so it will be used).

The following shows a key generated by commanding "genpkey -algorithm RSA -out key.pem" which defaults to the same 1024 bit key length and PEM output format:

Private Key Verification

Although it is expected that the generated keys are valid it is generally necessary to have the capability to verify that this is indeed the case, especially when porting the code to different environments where mistakes could be made that result in the key perhaps looking OK but in reality being corrupted, or indequate, in some way.

TO DO - add verification technique.

Private Key Generation Expense

Since random numbers are involved, as well as time consuming searches for long prime numbers, the actual execution time varies, as do the private keys that are generated. On a PC the generation of a private key of 1024 bits is achieved quickly although it is known to be an "expensive" cryptographic operation; the expense is due to the amount of processing time that it takes to complete.

The question is however what load (code size, RAM requirements and processing time) this task puts on a small embedded processor?

In order to determine this quantitively it is necessary to have a method of measuring these parameters in this standard test case and the code needs to run on the same processor and/or in the same environment (specifcally VisualStudio and the µTasker simulator to make analysis of memory operations as comfortable as possible).

This meant that it was necessary to be able to run the involved parts of the generation code in a Kinetis based project on a device with encryption hardware acceleration (which may aid in performance improvements) with the ability to save the output to a file that can be readily verified for accuracy.

Including mbed TLS code in the Kinetis project

In progress.

Including OpenSSL code in the Kinetis project

In progress.

Comparison of difficulty of port, resource utilisation and performance

To follow.

Return to the Kinetis landing page

µTasker Private Key Generation. Copyright (c) 2004..2018 M.J.Butcher Consulting