Advanced › Module 5 › Lesson 3
openssl CLI
openssl CLI literacy names genrsa, enc, dgst, and req demos — command vocabulary on YOUR $CRYPTO_LAB generated artifacts only.
Visual · t28_openssl_cli
openssl CLI literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
openssl is the lab workbench — literacy names subcommands before you paste commands against stranger keys.
Common openssl demos on $CRYPTO_LAB: genrsa/ecparam for key generation, enc -aes-256-gcm for symmetric demo, dgst -sha256 for hashes, req -x509 for toy CA certs, pkeyutl for sign/verify on YOUR keys. Read man pages; redact any accidental real secrets from notes. Cyberlium treats openssl as tool literacy on YOUR $CRYPTO_LAB artifacts — never import production private keys or run decrypt against unauthorized ciphertext. Next: Modern Lab.
1. openssl subcommands (named, lab demos)
genrsa 2048: generate RSA keypair file — lab keys only, chmod 600. enc: symmetric encrypt/decrypt with AEAD modes. dgst: hash fingerprints. req/x509: toy certificate for PKI module preview — not production CA replacement.
On $CRYPTO_LAB, list five subcommands you may run on YOUR generated files — no -in pointing to stranger keys.
Command guide
Try these commands — openssl subcommands (named, lab demos)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RSA literacy — https://cryptopals.com/ (Set 1 Set 5 context — TOY primes only) NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final CWE-327 — https://cwe.mitre.org/data/definitions/327.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
# TOY ONLY — p=61, q=53 — NEVER use for real secrets or factor production moduli
p, q = 61, 53
n, phi = p*q, (p-1)*(q-1)
e = 17
d = pow(e, -1, phi)
msg = 42
ct = pow(msg, e, n)
pt = pow(ct, d, n)
print(f'TOY RSA: n={n}, e={e}, encrypt({msg})={ct}, decrypt={pt}')
print('LABEL: TOY ONLY — production RSA uses 2048+ bits, never factor stranger moduli')
PYCommand — copy this
grep NEVER "$CRYPTO_LAB/notes/named-attacks-literacy.txt" | head -2
Primary tools to practice this lesson: python3, grep. Reference sites: RSA literacy (https://cryptopals.com/); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); CWE-327 (https://cwe.mitre.org/data/definitions/327.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Safe lab habits
Prefix notes with $CRYPTO_LAB paths. Never commit key files to git. Use passphrase on genrsa when storing. Verify algorithm in command (-aes-256-gcm not des).
Defenders audit openssl legacy (3DES, SHA1) — students flag deprecated flags in lab logs.
3. CLI literacy boundary
Forbidden: openssl decrypt on scraped ciphertext, importing production PEM from incidents, sharing private keys in chat. Allowed: openssl CLI card — five commands, lab file paths, redaction rule.
Ship: openssl CLI card for $CRYPTO_LAB. Next: Modern Lab.
4. What you ship: openssl CLI card for $CRYPTO_LAB
Five subcommands with lab paths. Redaction rule. $CRYPTO_LAB named. NO stranger keys. chmod 600.
5. What you record before the next lesson
Date. openssl CLI card. $CRYPTO_LAB named. File t28-m05-l03-openssl-cli.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
openssl decrypt production backup without scope. Commit lab PEM to public repo.
Right
Write openssl CLI card for YOUR $CRYPTO_LAB demos. Next: Modern Lab.
Mission: log five openssl demos
1) Run dgst on string YOU wrote. 2) Run enc -aes-256-gcm on YOUR file. 3) List genrsa, req in card. 4) chmod 600 on notes and keys.
Stuck? Ask Cyberlium AI Mentor
openssl version -a once per lab session — note provider and legacy flags.
Knowledge Check
APPLY: openssl CLI literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Lab openssl private keys should be chmod 600.
True or False
Knowledge Check
APPLY: Before openssl decrypt you should:
Multiple choice