View source for SSH encrypt and decrypt

__TOC__

Tutorial on how to encrypt and decrypt small messages using Secure Shell keys

== Why? ==
For example,<br>
when You have to send someone a password and sending it over internet in plaintext is out of the question.

== Tutorial on how to send Yourself a secret message ==

=== The keys ===

Everyone who uses Secure Shell (SSH) has an easy access to accompanying Secure Shell keys. When You do not have them, then You generate them.

All it takes is Linux, MacOS command line or Cygwin shell in Windows. A minute or two of Your time and few sips of tea. Done.


One can make simple passwordless RSA key-pair with <code>ssh-keygen</code> utility like this:
<pre>
linux:/home/user> ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:seDs6vDo55WegAZnG/mr8S+sgz2kvJFCc1wAGsHyB2c user@linux
The key's randomart image is:
+---[RSA 4096]----+
|+o..             |
|oo. E            |
|o. + .. .        |
|  o.oo . o       |
|.o=+  o S        |
|.+== . .         |
|oB*.o +          |
|+o=*+* .         |
| o*OBo+          |
+----[SHA256]-----+
</pre>

The process above creates 2 files <code>id_rsa</code> <code>id_rsa.pub</code> and places them into subfolder <code>.ssh</code> relative to Your home directory.

The contents of the public key <code>id_rsa.pub</code> should be like this:
<pre>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0slKFeI2QKDbele2YNbbsQnIuIr070sAAcK3lazDRNEfSAVqcevAoUoTFRe7BRKjeTzj74q8XGfH6/OciiVGpvF9La/a8apXB0x4qYdCA+S/pZJGbl8MLRMMuaU+7sUSd0wEhru5H8LXilpRjNBht+In4+CJKEOWb3TJ2gAPHp8hACdCpyKUNz6g+hcE8Vkx/JoMXDqhyGGr2qVcVTDxZ/Y506LyOMwarnzdz7JYLBq8LPOiHI6BNIUSnC8HixQ9DnJev44ZVJcoKLLM/kn7GNVczZ+L8xKC5i5GB+rAWPy4unQqqB9pAwKUjZ3WRRPFH8TcRprjiHlsZjeW27nAPeIu+jE0fQWKSWMdGt1CTYJuOGf7zOFCHupHC6S6EKqVUtni3GuiM+NQHukGAk95DWGydVY6OSTJP0a5/4akS/KmpOZ20WTer1BV171DZI3X8P35vwJIaP9Aamg4pDhQUSXSn1f9YD5lgXmhhgFVcyjo+ox6Q2VuVNX/eLW7WxtfmDBYCHbJEzIb3nHH2CWb47YyA+pYbku4WjFDTRc7blgsnCjCMGHPHXyP8TLLWB6ZiLYwAvucK78rljkTXwPALllktMG9YN215CRJGqZcWaCiVspWJvSwpMF8nJR842IpgkGFtlcMoPFoPwuv8yMUa+3bu2T3nwULOmZCsEBJiXQ== user@linux
</pre>

=== To encrypt ===

Now You have Your pair of keys, the public one <code>id_rsa.pub</code> to encrypt and the private one <code>id_rsa</code> to decrypt.

==== Create the message ====

Take Your favorite text editor and create short text file <code>message.txt</code> with some content like:
<pre>
This is very serious short message.
That will be encrypted.
And decrypted.
</pre>

==== Prepare Your public key for encryption ====

One drawback or discouraging step for encryption is that Your public key is not usable '''''as is'''''.

To be usable with <code>openssl</code> utility it has to be in PKCS8 format.

Public key can be converted to PKCS8 format with <code>ssh-keygen</code> utility like this:
<pre>
linux:/home/user> ssh-keygen -f ~/.ssh/id_rsa.pub -e -m pkcs8 > id_rsa_pub.pkcs8
</pre>

The contents of such converted key should be like this:
<pre>
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtLJShXiNkCg23pXtmDW2
7EJyLiK9O9LAAHCt5Wsw0TRH0gFanHrwKFKExUXuwUSo3k84++KvFxnx+vznIolR
qbxfS2v2vGqVwdMeKmHQgPkv6WSRm5fDC0TDLmlPu7FEndMBIa7uR/C14paUYzQY
bfiJ+PgiShDlm90ydoADx6fIQAnQqcilDc+oPoXBPFZMfyaDFw6ochhq9qlXFUw8
Wf2OdOi8jjMGq583c+yWCwavCzzohyOgTSFEpwvB4sUPQ5yXr+OGVSXKCiyzP5J+
xjVXM2fi/MSguYuRgfqwFj8uLp0KqgfaQMClI2d1kUTxR/E3Eaa44h5bGY3ltu5w
D3iLvoxNH0FikljHRrdQk2Cbjhn+8zhQh7qRwukuhCqlVLZ4txrojPjUB7pBgJPe
Q1hsnVWOjkkyT9Guf+GpEvypqTmdtFk3q9QVde9Q2SN1/D9+b8CSGj/QGpoOKQ4U
FEl0p9X/WA+ZYF5oYYBVXMo6PqMekNlblTV/3i1u1sbX5gwWAh2yRMyG95xx9glm
+O2MgPqWG5LuFoxQ00XO25YLJwowjBhzx18j/Eyy1gemYi2MAL7nCu/K5Y5E18Dw
C5ZZLTBvWDdteQkSRqmXFmgolbKVib0sKTBfJyUfONiKYJBhbZXDKDxaD8Lr/MjF
Gvt27tk958FCzpmQrBASYl0CAwEAAQ==
-----END PUBLIC KEY-----
</pre>

==== Encrypt the message ====

Now You can encrypt Your super secret message with converted public key like this:
<pre>
linux:/home/user> cat message.txt | openssl rsautl -encrypt -pubin -inkey id_rsa_pub.pkcs8 > message.enc
</pre>
In above example we send the contents of <code>message.txt</code> file to <code>openssl</code> utility that uses converted public key <code>id_rsa_pub.pkcs8</code> and then we store the output in file <code>message.enc</code>

=== To decrypt ===

To decrypt the encrypted message file <code>message.enc</code> we use <code>openssl</code> utility like this:
<pre>
linux:/home/user> cat message.enc | openssl rsautl -decrypt -inkey ~/.ssh/id_rsa
This is very serious short message.
That will be encrypted.
And decrypted.
</pre>
In above example the contents of decrypted message are show in startard output.

To save decrypted contents one can modify the command like this:
<pre>
linux:/home/user> cat message.enc | openssl rsautl -decrypt -inkey ~/.ssh/id_rsa > message.txt
</pre>

== Real world ==

In real world, when You have to pass someone sensitive small message, like a password
# You ask that someone to send You their public key
#* If that public key is not already in PKCS8 format then You convert it
# You encrypt Your message with that someone's public key
# You send the encrypted message to that someone
# That someone decrypts Your message with their private key
Contrary to tutorial above Your SSH keys are not needed when You are sending an encrypted message. You only need the other persons public key.


<hr>
Someone sends You their public key, save it to file <code>someone.pub</code>. Create secret message <code>message.txt</code>. Then do following:
<pre>
linux:/home/user> ssh-keygen -f someone.pub -e -m pkcs8 > someone_pub.pkcs8
linux:/home/user> cat message.txt | openssl rsautl -encrypt -pubin -inkey someone_pub.pkcs8 > message.enc
</pre>
And send the output <code>message.enc</code> to that someone. That person then does following and reads the message content from standard output:
<pre>
linux:/home/someone> cat message.enc | openssl rsautl -decrypt -inkey ~/.ssh/id_rsa
This is very serious short message.
That will be encrypted.
And decrypted.
</pre>

== Notes ==

=== Message size ===

This encryption / decryption method is suitable for small messages, messages whose bitlength is smaller than used RSA key length.

If You want to encrypt longer messages or some big file(s) then the above method can be used for passing on encrypted passwords that are used for file encryption/decryption.

One should use CBC (Cipher Block Chaining) continuous block cipher like AES256 for big file encryption / decryption. <code>openssl</code> utility is able to do that too.

=== What the path? ===

<code>~</code> denotes users home directory, in essence its a shortcut for <code>/home/user</code>

Then <code>~/.ssh</code> means subfolder <code>.ssh</code> that resides in users home directory <code>/home/user</code>

When using full path the above would be <code>/home/user/.ssh</code>

=== Private stuff ===

Your key pair that You generated is Your sensitive security information.

Your public key can be passed on to persons/organizations You know, to authenticate You as sign-on method (go see Gitlab), or it can be used as in above tutorial to encrypt messages. Being "public" does not mean You should openly advertise the contents of that key. It is theoretically possible to re-create private key based on public key, that process takes massive amounts of supercomputer time and is exponentially difficult based on key length. The longer the key the better. There is a tradeoff - longer keys work slower. In above tutorial we used 4096 bit keys that are quite okay by todays (2019) standards.

Your private key should never be shown or given out to anyone. The best practice is to encrypt Your private key with a password.
<code>ssh-keygen</code> utility is able to do that like this:
<pre>
linux:/home/user> ssh-keygen -p -f ~/.ssh/id_rsa
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.
</pre>