如何使用公钥在openssl中加密大文件
如何使用公钥加密一个大文件，以便除了拥有私钥的人之外没有人能够解密它？
我可以制作 RSA 公钥和私钥，但是当涉及到使用此命令加密大文件时：
openssl rsautl -encrypt -pubin -inkey public.pem -in myLargeFile.xml -out myLargeFile_encrypted.xml
以及我如何执行解密......
我通过以下命令创建我的私钥和公钥，
openssl genrsa -out private.pem 1024
openssl rsa -in private.pem -out public.pem -outform PEM -pubout
我收到此错误：
RSA operation error
3020:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:.\crypto\rsa\rsa_pk1.c:151:
I尝试制作大小从 1024 到 1200 位的密钥，没有运气，同样的错误
How can I encrypt a large file with a public key so that no one other than who has the private key be able to decrypt it?
I can make RSA public and private keys but when it comes to encrypting a large file using this command:
openssl rsautl -encrypt -pubin -inkey public.pem -in myLargeFile.xml -out myLargeFile_encrypted.xml
and how can i perform the decryption also....
i create my private and public key by the following commands
openssl genrsa -out private.pem 1024
openssl rsa -in private.pem -out public.pem -outform PEM -pubout
I get this error:
RSA operation error
3020:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:.\crypto\rsa\rsa_pk1.c:151:
I tried to make keys with sizes from 1024 to 1200 bits, no luck, same error
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
公钥加密不适用于加密任意长的文件。使用对称密码（例如 AES）进行正常加密。每次生成、使用新的随机对称密钥，然后使用 RSA 密码（公钥）进行加密。密文与加密的对称密钥一起传输给接收者。接收者使用他的私钥解密对称密钥，然后使用对称密钥解密消息。
私钥永远不会共享，只有公钥用于加密随机对称密码。
Public-key crypto is not for encrypting arbitrarily long files. One uses a symmetric cipher (say AES) to do the normal encryption. Each time a new random symmetric key is generated, used, and then encrypted with the RSA cipher (public key). The ciphertext together with the encrypted symmetric key is transferred to the recipient. The recipient decrypts the symmetric key using his private key, and then uses the symmetric key to decrypt the message.
The private key is never shared, only the public key is used to encrypt the random symmetric cipher.
在 OpenSSL 和命令行中安全且高度安全地编码任何文件的解决方案：
您应该准备一些 X.509 证书来加密 PEM 格式的文件。
加密文件：
什么是：
该命令可以非常有效地对大文件进行强加密，无论其格式如何。
已知问题：
当您尝试加密大文件（> 600MB）时，会发生错误。不会引发错误，但加密文件将被损坏。始终验证每个文件！ （或使用 PGP - 对使用公钥进行文件加密有更大的支持）
解密文件：
什么是：
Solution for safe and high secured encode anyone file in OpenSSL and command-line:
You should have ready some X.509 certificate for encrypt files in PEM format.
Encrypt file:
What is what:
That command can very effectively a strongly encrypt big files regardless of its format.
Known issue:
Something wrong happens when you try encrypt huge file (>600MB). No error thrown, but encrypted file will be corrupted. Always verify each file! (or use PGP - that has bigger support for files encryption with public key)
Decrypt file:
What is what:
我在 http://www.czeskis.com/random/openssl- 找到了说明encrypt-file.html 很有用。
用示例中的文件名解释链接的站点：
，就完成了。对方拥有解密的文件并且已安全发送。
I found the instructions at http://www.czeskis.com/random/openssl-encrypt-file.html useful.
To paraphrase the linked site with filenames from your example:
And you're done. The other person has the decrypted file and it was safely sent.
您无法使用 rsautl 直接加密大文件。相反，执行如下操作：
openssl rand生成密钥，例如。openssl rand 32 -out keyfileopenssl rsautl加密密钥文件openssl enc加密数据，使用步骤 1 中生成的密钥。You can't directly encrypt a large file using
rsautl. instead, do something like the following:openssl rand, eg.openssl rand 32 -out keyfileopenssl rsautlopenssl enc, using the generated key from step 1.不建议使用 smime 加密非常大的文件，因为您可能能够使用 -stream 选项加密大文件，但由于硬件限制而无法解密结果文件请参阅：解密大文件时出现问题
如上所述公钥加密不适用于加密任意长的文件。因此，以下命令将生成密码短语，使用对称加密对文件进行加密，然后使用非对称（公钥）加密密码短语。注意：smime 包括使用主公钥和备份密钥来加密密码短语。备份公钥/私钥对是谨慎的做法。
随机密码生成
将 RANDFILE 值设置为当前用户可访问的文件，生成 passwd.txt 文件并清理设置
加密
使用以下命令对文件进行加密，使用 passwd.txt 内容作为密码并使用 AES256 加密文件base64（-a 选项）文件。使用主公钥和备份密钥，使用非对称加密将 passwd.txt 加密到文件 XXLarge.crypt.pass 中。
解密
解密只是将 XXLarge.crypt.pass 解密为 passwd.tmp，将 XXLarge.crypt 解密为 XXLarge2.data，并删除 passwd.tmp 文件。
这已经针对 > 5GB 文件进行了测试。
Encrypting a very large file using smime is not advised since you might be able to encrypt large files using the -stream option, but not decrypt the resulting file due to hardware limitations see: problem decrypting big files
As mentioned above Public-key crypto is not for encrypting arbitrarily long files. Therefore the following commands will generate a pass phrase, encrypt the file using symmetric encryption and then encrypt the pass phrase using the asymmetric (public key). Note: the smime includes the use of a primary public key and a backup key to encrypt the pass phrase. A backup public/private key pair would be prudent.
Random Password Generation
Set up the RANDFILE value to a file accessible by the current user, generate the passwd.txt file and clean up the settings
Encryption
Use the commands below to encrypt the file using the passwd.txt contents as the password and AES256 to a base64 (-a option) file. Encrypt the passwd.txt using asymetric encryption into the file XXLarge.crypt.pass using a primary public key and a backup key.
Decryption
Decryption simply decrypts the XXLarge.crypt.pass to passwd.tmp, decrypts the XXLarge.crypt to XXLarge2.data, and deletes the passwd.tmp file.
This has been tested against >5GB files..
在
n的更多解释中。 '代词' m.的回答，有加密流程：
和解密流程：
此外，您可以使用以下命令：
In more explanation for
n. 'pronouns' m.'s answer,There is the flow of Encryption:
And the flow of Decryption:
Besides, you can use this commands:
要使用
openssl smime安全地加密大文件（>600MB），您必须将每个文件分成小块：为了提供信息，以下是如何解密并将所有部分放在一起的方法：
To safely encrypt large files (>600MB) with
openssl smimeyou'll have to split each file into small chunks:For the sake of information, here is how to decrypt and put all pieces together:
也许您应该查看已接受的答案（如何使用公钥/私钥加密 php 中的数据？）问题。
它展示了如何使用 OpenSSL 的 S/mime 功能来完成相同的操作，而不需要手动处理对称密钥，而不是手动解决 RSA 的消息大小限制（或者可能是一个特征）。
Maybe you should check out the accepted answer to this (How to encrypt data in php using Public/Private keys?) question.
Instead of manually working around the message size limitation (or perhaps a trait) of RSA, it shows how to use the S/mime feature of OpenSSL to do the same thing and not needing to juggle with the symmetric key manually.