Encrypting messages using CLI Open SSL about ellipticcurvekeypair HOT 5 OPEN

I am not an expert, but thankfully @dschuetz is! Here’s an awesome writeup he did which will give you answers! :) https://darthnull.org/security/2018/05/31/secure-enclave-ecies/ Hopefully we get to merge instructions or point to this article in our library.

First....using OpenSSL is fun, but damn it's a pain in the neck. Which is why I tend to do everything in Python now. The first thing you're missing is the X963KDF function. In my blog post (https://darthnull.org/security/2018/05/31/secure-enclave-ecies/) I describe how that works, which is really simple: sha-256( { shared_key } + counter + { shared_info} The shared_key is the ECDH output, the shared_info is the ephemeral public key (in this case, Alice's public key), and the counter is a four-byte counter beginning at 1. Then we take only the 16 bytes of the output (I guess it's only 128-bit AES? I'm not seeing that well explained in my post...) So: $ echo "bc3e119513a70d348edcba6684493d462eb19240c8eeec2422820b7245829d9e 0000 0001 0413af8baa97bcf167edec2505e182185c2feebf278238fb1cba47a5df48dfc3dd74a9658e53a50531ac238b786ebeb13ef4c36ce6ff3f096b709f098b861f613c" | xxd -r -p| openssl sha256 -hex | cut -c 1-32 41006753ead5ec6e4c9a65675cbcaa95 Okay, now we've got the same key. But what about the encryption? You're probably not going to like this: I think the OpenSSL command line simply doesn't support GCM. I've found a couple pages (and my notes from when I was playing with this last year) that say this outright, and another that says it does but doesn't generate (or validate) the tag, but clearly the output from the command line isn't "correct except for the tag" either. Note that I'm using LibreSSL 2.6.5 (macOS Mojave). I just tried on an ubuntu box, with OPenSSL 1.0.2g, and get the error message "AEAD ciphers not supported by the enc utility." If you try "openssl list-cipher-commands", you’ll see gcm isn't listed as available. I'm not sure why it's a recognized algorithm if it doesn't work with the enc command...maybe there are other commands that can use GCM where it does work. I forget. As I said, I long ago moved to doing it all in python... I hope this helps, and sorry I could only answer half your question! david.