OPENSSL-ECPARAM(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💅 OPENSSL-ECPARAM (1ossl) — like, the OpenSSL manual, bestie edition ✨

okay so real talk, this is the openssl-ecparam page from the OpenSSL manual. it's giving "niche but iconic" — if you've ever needed to poke at elliptic curve parameters, this is your girl. let's go 🎀

🌸 NAME 🌸

openssl-ecparam — EC parameter manipulation and generation. yes bestie, manipulation. we're out here doing things to elliptic curves 💅

✨ SYNOPSIS ✨

openssl ecparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-noout] [-text] [-check] [-check_named]
[-name arg] [-list_curves] [-conv_form arg] [-param_enc arg] [-no_seed]
[-genkey] [-engine id] [-rand files] [-writerand file] [-provider name]
[-provider-path path] [-provparam [name:]key=value] [-propquery propq]

🦋 DESCRIPTION 🦋

so what does this command do, you ask? it manipulates or generates EC parameter files. that's the whole vibe. 🫶

but here's the tea, and it's important: OpenSSL is currently not able to generate new groups, so this command can only create EC parameters from known (named) curves. no inventing new curves from scratch, bestie — we work with what we've got 😭

💖 OPTIONS 💖

bestie there are a LOT of these and we are NOT skipping any. every single one, periodt. 📋

  • -help — prints out a usage message. the classic "what do i even do here" button 🙈
  • -inform DER|PEM — the EC parameters input format. unspecified by default. see openssl-format-options(1) for the deets 💅
  • -outform DER|PEM — the EC parameters output format, and the default is PEM. also see openssl-format-options(1) for details. parameters get encoded as EcpkParameters as specified in IETF RFC 3279. iykyk ✨
  • -in filename — specifies the input file to read parameters from, or standard input if you don't specify this option. no file? stdin it is 🎀
  • -out filename — specifies the output filename for parameters. standard output is used if this option isn't present. here's the spicy bit: the output filename can be the same as the input filename, which leads to replacing the file contents. ⚠️ oh and heads up — file I/O is not atomic: the output file is truncated and then written. so like, don't come for me if something goes sideways mid-write 💀
  • -noout — inhibits the output of the encoded version of the parameters. so you get to skip the ugly blob 🌸
  • -text — prints out the EC parameters in human readable form. for when you want to actually read them, imagine that 👑
  • -check — validates the elliptic curve parameters. a little vibe check for your curve, lowkey essential ⭐
  • -check_named — validates the elliptic name curve parameters by checking if the curve parameters match any built-in curves. basically "do i know you?" but for curves 🧚
  • -name arg — use the EC parameters with the specified 'short' name. pro tip from me to you: use -list_curves to get a list of all currently implemented EC parameters 🦋
  • -list_curves — prints out a list of all currently implemented EC parameters names and exits. window shopping for curves, we love to see it 💜
  • -conv_form arg — specifies how the points on the elliptic curve get converted into octet strings. possible values are: compressed, uncompressed (that's the default, bb) and hybrid. for more info on point conversion forms, please read the X9.62 standard. 📚
note: due to patent issues the compressed option is disabled by default for binary curves and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time. yes, patents. it's giving old drama 😭
  • -param_enc arg — specifies how the elliptic curve parameters are encoded. possible values are: named_curve (the ec parameters are specified by an OID) or explicit (where the ec parameters are explicitly given — see RFC 3279 for the definition of the EC parameters structures). the default value is named_curve. 🌈
note: the implicitlyCA alternative, as specified in RFC 3279, is currently not implemented in OpenSSL. not us forgetting, it's just not there 🙈
  • -no_seed — inhibits the 'seed' for the parameter generation from being included in the ECParameters structure (see RFC 3279). seed? don't know her 💅
  • -genkey — will generate an EC private key using the specified parameters. two for one, we love efficiency 🔥
  • -engine id — see "Engine Options" in openssl(1). this option is deprecated, bestie. it's giving legacy 💀
  • -rand files, -writerand file — see "Random State Options" in openssl(1) for details. randomness is a whole thing, go read it 🎲
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). provider lore, there's a lot of it 📖
💡 okay so quick PSA: the openssl-genpkey(1) and openssl-pkeyparam(1) commands are capable of performing all the operations this command can, plus they support other public key types. so like... they're kind of the upgraded versions. just saying 👀

🌟 EXAMPLES 🌟

the docs for openssl-genpkey(1) and openssl-pkeyparam(1) contain examples equivalent to the ones listed here. so you're getting the whole set, don't worry 🫶

to create EC parameters with the group 'prime192v1':

openssl ecparam -out ec_param.pem -name prime192v1

to create EC parameters with explicit parameters:

openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit

to validate given EC parameters:

openssl ecparam -in ec_param.pem -check

to create EC parameters and a private key:

openssl ecparam -out ec_key.pem -name prime192v1 -genkey

to change the point encoding to 'compressed':

openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed

to print out the EC parameters to standard output:

openssl ecparam -in ec_param.pem -noout -text

slay, you did it 💅✨

🎀 SEE ALSO 🎀

openssl(1), openssl-pkeyparam(1), openssl-genpkey(1), openssl-ec(1), openssl-dsaparam(1)

go read them, they're all part of the family 🌸

🔥 HISTORY 🔥

  • the -engine option was deprecated in OpenSSL 3.0. rip to a real one 🕯️
  • the -C option was removed in OpenSSL 3.0. literally gone, don't look for it 💀

Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

and that's the whole page bestie!! 💖✨🎀🦋🌸💅🫶

this iconic piece of documentation is from OpenSSL 3.5.6, dated 2026-04-07, and honestly? it ate. no cap. see you in the next manpage, mwah 😘

📦 where this page comes from