OPENSSL-EC(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💜 NAME 💜

openssl-ec — literally the EC key processing era, bestie. Elliptic curve keys, handled. That's the vibe.

(If you're the type who reads the header of a manpage: this is from the OpenSSL manual set, part 1ossl. All the deets, none of the boredom. 🫶)

✨ SYNOPSIS ✨

openssl ec [-help] [-inform DER|PEM|P12|ENGINE] [-outform DER|PEM] [-in
filename|uri] [-passin arg] [-out filename] [-passout arg] [-des]
[-des3] [-idea] [-text] [-noout] [-param_out] [-pubin] [-pubout]
[-conv_form arg] [-param_enc arg] [-no_public] [-check] [-engine id]
[-provider name] [-provider-path path] [-provparam [name:]key=value]
[-propquery propq]

🦋 DESCRIPTION 🦋

okay so openssl-ec(1) processes EC keys. Like, EC keys are the main character here and this command is their stylist — it converts them between various forms and prints out their components. 💅

Heads up, bestie: OpenSSL uses the private key format specified in 'SEC 1: Elliptic Curve Cryptography' (<https://www.secg.org/> — well, the doc says http://www.secg.org/). So if you've got an OpenSSL EC private key and you need it in PKCS#8 private key format, you go use the openssl-pkcs8(1) command. Different command, different slay. 🔥

🎀 OPTIONS 🎀

  • -help — prints out a usage message. Your little map. 🗺️
  • -inform DER|PEM|P12|ENGINE — the key input format, and it's unspecified by default (mystery!! 🙈). Peep openssl-format-options(1) for the details.
  • -outform DER|PEM — the key output format, and the default is PEM. Again, openssl-format-options(1) has the lore.
    • Private keys are an SEC1 private key or PKCS#8 format.
    • Public keys are a SubjectPublicKeyInfo as specified in IETF RFC 3280.
  • -in filename|uri — tells it where to read a key from. No -in? It reads standard input, no big deal. And if the key is encrypted, it'll prompt you for a pass phrase. 🔑
  • -out filename — where to write the key to. Skip it and it writes to standard output. If any encryption options are set, you'll get a pass phrase prompt. 💖
Warning, bestie: the output filename should not be the same as the input filename. Just. Don't. 😭
  • -passin arg, -passout arg — the password source for the input file and the output file respectively. For more info on the format of arg, see openssl-passphrase-options(1).
  • -des|-des3|-idea — these bad boys encrypt the private key before outputting it, using DES, triple DES, IDEA, or literally any other cipher supported by OpenSSL. A pass phrase gets prompted for. If none of these options is specified, the key is written in plain text. 👀
    • Which means: using this command to read in an encrypted key with no encryption option can be used to remove the pass phrase from a key.
    • Or, by setting the encryption options, it can be used to add or change the pass phrase.
Note: these options can only be used with PEM format output files. PEM only, no exceptions, iykyk.
  • -text — prints out the public key components, private key components and parameters. The full tour. ✨
  • -noout — prevents output of the encoded version of the key. Like, we don't need that part.
  • -param_out — prints the elliptic curve parameters.
  • -pubin — by default a private key is read from the input; with this option, a public key is read instead. And if the input contains no public key but a private key, its public part is used. Resourceful of it. 💅
  • -pubout — by default a private key is output; with this option a public key gets output instead. This option is automatically set if the input is a public key. Automatic queen behavior. 👑
  • -conv_form arg — specifies how the points on the elliptic curve are converted into octet strings. Possible values are:
    • compressed
    • uncompressed — the default value
    • hybrid

For more info on point conversion forms, go read the X9.62 standard.

Patent drama alert: due to patent issues, the compressed option is disabled by default for binary curves, and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time. Yes, really. 🫠
  • -param_enc arg — specifies how the elliptic curve parameters are encoded. Possible values:
    • named_curve — i.e. the ec parameters are specified by an OID. This is the default!
    • explicit — where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures)
Note: the implicitlyCA alternative, as specified in RFC 3279, is currently not implemented in OpenSSL. F in the chat. 💀
  • -no_public — omits the public key components from the private key output. Bye bestie. 👋
  • -check — checks the consistency of an EC private or public key. A lil wellness check. 🩺
  • -engine id — see "Engine Options" in openssl(1).
This option is deprecated. Just so you know. 🙈
  • -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). The whole provider cinematic universe. 🌈

Also, on the lowkey important tip side: the openssl-pkey(1) command is capable of performing all the operations this command can, plus it supports other public key types. So like. pkey is that girl. But ec still ate. ✨

🍓 EXAMPLES 🍓

The documentation for the openssl-pkey(1) command contains examples equivalent to the ones listed here. But here they are anyway, because we love a demo:

To encrypt a private key using triple DES:

openssl ec -in key.pem -des3 -out keyout.pem

To convert a private key from PEM to DER format:

openssl ec -in key.pem -outform DER -out keyout.der

To print out the components of a private key to standard output:

openssl ec -in key.pem -text -noout

To just output the public part of a private key:

openssl ec -in key.pem -pubout -out pubkey.pem

To change the parameters encoding to explicit:

openssl ec -in key.pem -param_enc explicit -out keyout.pem

To change the point conversion form to compressed:

openssl ec -in key.pem -conv_form compressed -out keyout.pem

🌸 SEE ALSO 🌸

openssl(1), openssl-pkey(1), openssl-ecparam(1), openssl-dsa(1), openssl-rsa(1)

The whole friend group. 🫶

💫 HISTORY 💫

  • The -engine option was deprecated in OpenSSL 3.0.
  • The -conv_form and -no_public options are no longer supported with keys loaded from an engine in OpenSSL 3.0.

Not the glow-down, but okay. 😭

Copyright 2003-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

✨ that's the whole page, bestie ✨ — this one's from version 3.5.6, dated 2026-04-07, and it lives in the OPENSSL-EC(1ossl) manual. mwah 💋💖

📦 where this page comes from