OPENSSL-ECPARAM(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 NAME 💖

bestie, this is openssl-ecparam — the OpenSSL command that does EC parameter manipulation and generation. elliptic curve vibes only ✨

✨ SYNOPSIS ✨

openssl ecparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-noout] [-text] [-check] [-check_named]
[-name arg] [-list_curves] [-conv_form arg] [-param_enc arg] [-no_seed]
[-genkey] [-rand files] [-writerand file] [-provider name]
[-provider-path path] [-provparam [name:]key=value] [-propquery propq]

🎀 DESCRIPTION 🎀

okay so. this command manipulates or generates EC parameter files. that's the whole job. it's giving utility icon 💅

and here's the tea bestie: OpenSSL currently cannot generate new groups. so this command can only make EC parameters from curves it already knows about — the named curves. no custom curve-building from scratch, unfortunately 😭

💜 OPTIONS 💜

  • -help — prints a usage message. little help menu moment 🫶
  • -inform DER|PEM — tells it what input format the EC parameters are in. unspecified by default. see openssl-format-options(1) for the details, bestie.
  • -outform DER|PEM — what output format to use. default is PEM. again, openssl-format-options(1) has the deets. oh and fun fact: the parameters are encoded as EcpkParameters exactly as specified in IETF RFC 3279. very official of them ⭐
  • -in filename — the input file to read parameters from. if you don't pass this, it reads from standard input. no file? no problem, stdin's got you 🦋
  • -out filename — the output file to write parameters to. if you don't include this option, standard output is used. and yes, you can set the output filename to be the same as the input filename, which means it replaces the file contents. heads up though: > file I/O is not atomic. the output file gets truncated and then written. so like, don't yank the cable mid-write, iykyk 💀
  • -noout — this one inhibits the output of the encoded version of the parameters. so it just... doesn't print the encoded blob. slay.
  • -text — prints the EC parameters in human readable form. for when you wanna actually read the thing with your eyeballs 👀
  • -check — validates the elliptic curve parameters. vibe check, but for curves 🌈
  • -check_named — validates the elliptic name curve parameters by checking whether the curve parameters match any of the built-in curves. detective mode 🔍
  • -name arg — use the EC parameters with the specified 'short' name. wanna know your options? run -list_curves and it'll hand you every currently implemented EC parameters name. periodt.
  • -list_curves — prints out a list of all currently implemented EC parameters names, and then exits. that's it, that's the whole job ✨
  • -conv_form arg — how the points on the elliptic curve get converted into octet strings. possible values are: compressed, uncompressed (the default value), and hybrid. if you want the full lore on point conversion forms, go read the X9.62 standard. also, note: due to patent issues, the compressed option is disabled by default for binary curves, and you can only enable it by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time. no cap, that's the rule 🙈
  • -param_enc arg — how the elliptic curve parameters themselves are encoded. possible values: named_curve (the ec parameters are specified by an OID) or explicit (the ec parameters are explicitly given — see RFC 3279 for the definition of the EC parameters structures). default value is named_curve. and btw, the implicitlyCA alternative as specified in RFC 3279? currently not implemented in OpenSSL, bestie. it's just not there 😭
  • -no_seed — this option inhibits the 'seed' for the parameter generation from being included in the ECParameters structure (see RFC 3279). keep your seed to yourself, queen 🌸
  • -genkey — this will generate an EC private key using the specified parameters. main character energy, generating keys and all 👑
  • -rand files, -writerand file — check out "Random State Options" in openssl(1) for all the details.
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — these four are the provider crew. see "Provider Options" in openssl(1), provider(7), and property(7). they're all in the group chat together 💜

also quick shoutout: openssl-genpkey(1) and openssl-pkeyparam(1) can do everything this command can do, AND they support other public key types too. so they're like, the upgraded versions. still, this one ate 💅

🔥 EXAMPLES 🔥

the docs for openssl-genpkey(1) and openssl-pkeyparam(1) contain examples that are equivalent to the ones listed right here, bestie.

to create EC parameters with the group 'prime192v1':

openssl ecparam -out ec_param.pem -name prime192v1

to create EC parameters with explicit parameters:

openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit

to validate given EC parameters:

openssl ecparam -in ec_param.pem -check

to create EC parameters and a private key:

openssl ecparam -out ec_key.pem -name prime192v1 -genkey

to change the point encoding to 'compressed':

openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed

to print out the EC parameters to standard output:

openssl ecparam -in ec_param.pem -noout -text

🌈 SEE ALSO 🌈

openssl(1), openssl-pkeyparam(1), openssl-genpkey(1), openssl-ec(1), openssl-dsaparam(1)

📜 HISTORY 📜

  • the -C option was removed in OpenSSL 3.0. gone, bye, won't be missed 💀
  • the -engine option was removed in OpenSSL 4.0. also gone 🫶

Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaand that's the whole page, bestie 🎀 this was OpenSSL — openssl-ecparam, section 1SSL — version 4.0.3, dated 2026-09-29. go read your curves, mwah 💖✨🦋

📦 where this page comes from