Why does OpenSSL provide two utilities with so much overlap
OpenSSL> genpkey - Usage: genpkey [options] where options may be -out file output file -outform X output format (DER or PEM) -pass arg output file pass phrase source -<cipher> use cipher <cipher> to encrypt the key -engine e use engine e, possibly a hardware device. -paramfile file parameters file -algorithm alg the public key algorithm -pkeyopt opt:value set the public key algorithm option <opt> to value <value> -genparam generate parameters, not key -text print the in text NB: options order may be important! See the manual page.
OpenSSL> genrsa - usage: genrsa [args] [numbits] -des encrypt the generated key with DES in cbc mode -des3 encrypt the generated key with DES in ede cbc mode (168 bit key) -seed encrypt PEM output with cbc seed -aes128, -aes192, -aes256 encrypt PEM output with cbc aes -camellia128, -camellia192, -camellia256 encrypt PEM output with cbc camellia -out file output the key to 'file -passout arg output file pass phrase source -f4 use F4 (0x10001) for the E value -3 use 3 for the E value -engine e use engine e, possibly a hardware device. -rand file:file:... load the file (or the files in the directory) into the random number generator
The docs in Debian are also really strange about this,
genpkey Generation of Private Key or Parameters. genrsa Generation of RSA Private Key. Superceded by genpkey.
genpkey a replacement? If so, how come it doesn't have
-des3? And, how do we add a password to it, and specify the key length?
genpkeyare actually different. The ASN.1 structure of keys generated using
genrsais pkcs#1, while keys generated using
genpkeyis pkcs#8. If that's not bad enough, if you use
genpkey -outform derthen it's back to pkcs#1. With EC, it's even worse, somehow
genecis missing, instead there is
ecparam -genkey, and somehow
genpkey -outform pem,
genpkey -outform derall have different ASN.1 structure.