Asymmetric Key Encryption and Digital Signature Verification using OpenSSL with Certificate Authority.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Asymmetric Key Encryption and Digital Signature Verification using OpenSSL with Certificate Authority\n",
    "\n",
    "ในการเข้ารหัสข้อมูลด้วยกุญแจเข้ารหัส จะมีวิธีการเข้ารหัสอยู่สองชนิด คือ การเข้ารหัสแบบสมมาตร (symmetric key encryption) และการเข้ารหัสแบบอสมมาตร (asymmetric key encryption) โดยการเข้ารหัสแบบสมมาตรจะใช้กุญแจลับ (secret key) อันเดียวเพื่อเข้ารหัสและถอดรหัส โดยในการรับส่งข้อมูลผ่านตัวกลางนั้น secret key จะต้องถูกส่งไปหาผู้รับด้วยเพื่อใช้ในการถอดรหัส ซึ่งอาจจะถูกดักฟังโดยผู้ไม่ประสงค์ดีได้ ดังนนั้นจึงมีการพัฒนาวิธีการเข้ารหัสแบบอสมมาตรขึ้นมาเพื่อแก้ปัญหานี้ โดยใช้กุญแจสองตัว คือ กุญแจสาธารณะ (public key) และกุญแจส่วนตัว (private key) ในการเข้ารหัสและถอดรหัส ซึ่งจะต่างจากการเข้ารหัสแบบสมมาตรที่ การเข้ารหัสจะใช้กุญแจอันหนึ่ง และต้องใช้กุญแจอีกอันเพื่อถอดรหัสเท่านั้น ในทางปฏิบัติ มักจะใช้ public key เพื่อเข้ารหัสและใช้ private key เพื่อถอดรหัส โดย private key จะถูกสุ่มขึ้นมาที่ผู้รับสารและผู้รับสารจะสร้างคู่ public key ขึ้นมาและกระจาย key สู่สารธารณะเพื่อให้ผู้ส่งสารสามารถนำไปเข้ารหัสได้\n",
    "\n",
    "อย่างไรก็ตาม ในการเข้ารหัสด้วยกุญแจสารธารณะจะไม่สามาตรรู้ได้ว่าข้อมูลที่ถูกส่งมานั้นเป็นข้อมูลที่ผู้ส่งตั้งใจส่งมาจริงๆหรือไม่ หรือจะถูกปลอมแปลงไหม เพราะว่าใครๆ ก็สามารถเข้าถึง public key ได้และสามารถเข้ารหัสข้อมูลใดๆ ก็ได้ จึงต้องทำการตรวจสอบข้อมูลว่าถูกส่งมาจากต้นทางจริงๆ หรือไม่ด้วยการตรวจสอบลายเซ็นดิจิทัล (digital signature verification) โดยผู้ส่งสารจะเซ็นข้อมูลด้วย private key ของตัวเอง และสร้างคู่ public key ขึ้นมาเพื่อให้ผู้รับสารสามารถ verify ได้ว่าข้อมูลถูกส่งออกมาจากผู้รับสารนั้นจริงๆ และไม่ได้ถูกปลอมแปลง และในการรักษาความลับ digital signature จะถูกสร้างจาก hash ของข้อมูลที่ถูกเข้ารหัสแล้วแทน\n",
    "\n",
    "ในตัวอย่งานี้จะแสดงวิธีการเข้ารหัสและถอดรหัสด้วยการเข้ารหัสแบบอสมมาตร การเซ็นด้วย digital signature ด้วยการเข้ารหัสแบบอสมมาตร และแสดงวิธีการสร้างและรับรองกุญแจสาธารณะด้วยผู้ออกใบรับรองอิเล็กทรอนิกส์ (certificate authority: CA) ในตัวอย่างนี้จะมีการจำลองสถานะการณ์รับส่งข้อมูลระหว่าง Mr.A และ Mr.B โดยจะมีเงื่อนไขดังนี้\n",
    "\n",
    "### Scenario:\n",
    "* Mr.A ต้องการส่งข้อความเข้ารหัสไปให้ Mr.B\n",
    "* การสื่อสารระหว่าง Mr.A และ Mr.B ต้องเข้ารหัสและถอดรหัสด้วย Asymmetric Keys\n",
    "* Mr.B ต้องการ verify ผู้ส่งและข้อความว่าถูกต้องหรือไม่ด้วย MD5 Digital Signature\n",
    "* แลกเปลี่ยน Key และ Verify กันโดยมี CA และรับส่งผ่านทาง file\n",
    "* public key และข้อมูลต่างๆ จะถูกเก็บไว้ใน x509 certificate\n",
    "* certificate จะถูกออก และรับรองโดย Root CA (self-signed)\n",
    "* Mr.A และ Mr.B จะสร้าง certificate ได้จากการส่งใบร้องขอใบรับรอง (Certificate Signing Request: CSR) ไปที่ Root CA "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Setup Root Certificate Authority\n",
    "\n",
    "จำลอง root certificate authority ขึ้นมา เพื่อเป็นผู้รับรองกุญแจสาธารณะ\n",
    "\n",
    "โดย CA จะต้องมีกุญแจส่วนตัวของตัวเอง"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Generating RSA private key, 512 bit long modulus (2 primes)\n",
      "..+++++++++++++++++++++++++++\n",
      "...........+++++++++++++++++++++++++++\n",
      "e is 65537 (0x010001)\n",
      "CA key in PEM format\n",
      "-----BEGIN RSA PRIVATE KEY-----\n",
      "MIIBOgIBAAJBALIjitJ/BIKgXlesAZejQ5X/EP6pcHHELUU6gdSWCQz69hTV4/pP\n",
      "QzDy86xAItxMKAuKUY9zKgbqUqiI4/u7RbsCAwEAAQJAAas/k7VI74hdGeksoqUO\n",
      "7wrSt/ASc55o5iskKD+3mf2D59+14kpPl0rwXjFTgGN6JjCEJh/8xmW7W/drmn2W\n",
      "AQIhAOpnVB7Gq8ij6Kyj8GhPCLlZBmxBQBMwPEijdav2+i6BAiEAwo0lT5/2FPu5\n",
      "iG/W8bThpQnLd8zkVGKPSYUqvyTHjjsCIQDjYQprtEKtJbqtxXWOaaRHz4D4gC88\n",
      "rdy8hbu+7ZxwgQIgXhtSQfrZWPsOmt2mdlKNl3xubGuywtLOBr0gmUccNEMCIE3g\n",
      "GH6pJ+frFCc/3qSLrrQHaKqWtMczcQy5t/jsPsDH\n",
      "-----END RSA PRIVATE KEY-----\n"
     ]
    }
   ],
   "source": [
    "openssl genrsa -out ca.key 512\n",
    "\n",
    "echo \"CA key in PEM format\"\n",
    "cat ca.key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CA key info\n",
      "RSA Private-Key: (512 bit, 2 primes)\n",
      "modulus:\n",
      "    00:b2:23:8a:d2:7f:04:82:a0:5e:57:ac:01:97:a3:\n",
      "    43:95:ff:10:fe:a9:70:71:c4:2d:45:3a:81:d4:96:\n",
      "    09:0c:fa:f6:14:d5:e3:fa:4f:43:30:f2:f3:ac:40:\n",
      "    22:dc:4c:28:0b:8a:51:8f:73:2a:06:ea:52:a8:88:\n",
      "    e3:fb:bb:45:bb\n",
      "publicExponent: 65537 (0x10001)\n",
      "privateExponent:\n",
      "    01:ab:3f:93:b5:48:ef:88:5d:19:e9:2c:a2:a5:0e:\n",
      "    ef:0a:d2:b7:f0:12:73:9e:68:e6:2b:24:28:3f:b7:\n",
      "    99:fd:83:e7:df:b5:e2:4a:4f:97:4a:f0:5e:31:53:\n",
      "    80:63:7a:26:30:84:26:1f:fc:c6:65:bb:5b:f7:6b:\n",
      "    9a:7d:96:01\n",
      "prime1:\n",
      "    00:ea:67:54:1e:c6:ab:c8:a3:e8:ac:a3:f0:68:4f:\n",
      "    08:b9:59:06:6c:41:40:13:30:3c:48:a3:75:ab:f6:\n",
      "    fa:2e:81\n",
      "prime2:\n",
      "    00:c2:8d:25:4f:9f:f6:14:fb:b9:88:6f:d6:f1:b4:\n",
      "    e1:a5:09:cb:77:cc:e4:54:62:8f:49:85:2a:bf:24:\n",
      "    c7:8e:3b\n",
      "exponent1:\n",
      "    00:e3:61:0a:6b:b4:42:ad:25:ba:ad:c5:75:8e:69:\n",
      "    a4:47:cf:80:f8:80:2f:3c:ad:dc:bc:85:bb:be:ed:\n",
      "    9c:70:81\n",
      "exponent2:\n",
      "    5e:1b:52:41:fa:d9:58:fb:0e:9a:dd:a6:76:52:8d:\n",
      "    97:7c:6e:6c:6b:b2:c2:d2:ce:06:bd:20:99:47:1c:\n",
      "    34:43\n",
      "coefficient:\n",
      "    4d:e0:18:7e:a9:27:e7:eb:14:27:3f:de:a4:8b:ae:\n",
      "    b4:07:68:aa:96:b4:c7:33:71:0c:b9:b7:f8:ec:3e:\n",
      "    c0:c7\n"
     ]
    }
   ],
   "source": [
    "echo \"CA key info\"\n",
    "openssl rsa -text -in ca.key -noout"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ในการออกใบรับรองเพื่อเป็นกุญแจสาธารณะ จะต้องออกใบรับรองด้วยการขอใบรับบรอง (certificate signing request: CSR) ซึ่งสามารถสร้างได้ที่ผู้ขอใบรับรอง"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CSR info\n",
      "verify OK\n",
      "Certificate Request:\n",
      "    Data:\n",
      "        Version: 1 (0x0)\n",
      "        Subject: C = TH, ST = Bangkok, L = Bangrak, O = CA Organization, OU = CA, CN = ca.domain.com\n",
      "        Subject Public Key Info:\n",
      "            Public Key Algorithm: rsaEncryption\n",
      "                RSA Public-Key: (512 bit)\n",
      "                Modulus:\n",
      "                    00:b2:23:8a:d2:7f:04:82:a0:5e:57:ac:01:97:a3:\n",
      "                    43:95:ff:10:fe:a9:70:71:c4:2d:45:3a:81:d4:96:\n",
      "                    09:0c:fa:f6:14:d5:e3:fa:4f:43:30:f2:f3:ac:40:\n",
      "                    22:dc:4c:28:0b:8a:51:8f:73:2a:06:ea:52:a8:88:\n",
      "                    e3:fb:bb:45:bb\n",
      "                Exponent: 65537 (0x10001)\n",
      "        Attributes:\n",
      "            a0:00\n",
      "    Signature Algorithm: sha256WithRSAEncryption\n",
      "         69:51:46:4e:bf:cf:bf:bc:08:e0:56:3d:7f:5e:f1:2f:6f:46:\n",
      "         f1:9d:f0:87:f8:10:a9:9f:c3:79:12:87:14:9e:84:15:69:9f:\n",
      "         7e:f9:49:22:da:92:6c:fc:36:07:09:ed:cf:06:6e:41:d5:66:\n",
      "         81:19:8e:f2:72:79:13:74:a1:ed\n"
     ]
    }
   ],
   "source": [
    "# parameters for CA\n",
    "CN=ca.domain.com\n",
    "OU=CA\n",
    "O='CA Organization'\n",
    "L=Bangrak\n",
    "ST=Bangkok\n",
    "C=TH\n",
    "\n",
    "\n",
    "openssl req -new -key ca.key \\\n",
    "  -subj \"/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}\" \\\n",
    "  -out ca.req -sha256\n",
    "\n",
    "echo \"CSR info\"\n",
    "openssl req -text -noout -verify -in ca.req"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "และทำการส่งคำขอใบรับรองเพื่อสร้าง certificate ไปที่หน่วยงานออกใบรับรอง (CA) ระดับสูงขึ้น \n",
    "\n",
    "อย่างไรก็ตาม ในตัวอย่างนี้ CA จะถูกจำลองเป็นผู้ออกใบรับรองสูงสุด (Root CA) ดังนั้นจึงสร้าง self sign certificate แทนขั้นตอนปกติ"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Signature ok\n",
      "subject=C = TH, ST = Bangkok, L = Bangrak, O = CA Organization, OU = CA, CN = ca.domain.com\n",
      "Getting Private key\n"
     ]
    }
   ],
   "source": [
    "openssl x509 -req -in ca.req -signkey ca.key \\\n",
    "  -extensions ca -days 3650 -outform PEM -out ca.pem -sha256"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "เราจะได้ certificate `ca.pem` ซึ่งสามารถเอาไปใช้ตรวจสอบกุญแจสาธารณะที่ถูกรับรองด้วย CA นี้ได้ โดยข้อมูลที่อยู่ใน certificate จะประกอบด้วย"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CA certificate info\n",
      "Certificate:\n",
      "    Data:\n",
      "        Version: 1 (0x0)\n",
      "        Serial Number:\n",
      "            3e:0f:fa:0b:b6:61:81:75:3e:03:16:ec:27:1d:86:1f:90:12:69:ee\n",
      "        Signature Algorithm: sha256WithRSAEncryption\n",
      "        Issuer: C = TH, ST = Bangkok, L = Bangrak, O = CA Organization, OU = CA, CN = ca.domain.com\n",
      "        Validity\n",
      "            Not Before: Jul  8 08:27:53 2020 GMT\n",
      "            Not After : Jul  6 08:27:53 2030 GMT\n",
      "        Subject: C = TH, ST = Bangkok, L = Bangrak, O = CA Organization, OU = CA, CN = ca.domain.com\n",
      "        Subject Public Key Info:\n",
      "            Public Key Algorithm: rsaEncryption\n",
      "                RSA Public-Key: (512 bit)\n",
      "                Modulus:\n",
      "                    00:b2:23:8a:d2:7f:04:82:a0:5e:57:ac:01:97:a3:\n",
      "                    43:95:ff:10:fe:a9:70:71:c4:2d:45:3a:81:d4:96:\n",
      "                    09:0c:fa:f6:14:d5:e3:fa:4f:43:30:f2:f3:ac:40:\n",
      "                    22:dc:4c:28:0b:8a:51:8f:73:2a:06:ea:52:a8:88:\n",
      "                    e3:fb:bb:45:bb\n",
      "                Exponent: 65537 (0x10001)\n",
      "    Signature Algorithm: sha256WithRSAEncryption\n",
      "         52:9b:df:90:fa:59:57:71:97:d8:fd:c9:b5:1e:2b:7a:f2:23:\n",
      "         19:12:c6:59:99:c2:48:89:37:20:2f:67:98:9f:77:9d:3a:30:\n",
      "         7d:96:c2:b7:1e:12:02:dd:fd:3c:e1:a2:97:80:45:df:2d:ef:\n",
      "         25:69:14:d4:f4:0d:ae:48:f2:97\n",
      "-----BEGIN CERTIFICATE-----\n",
      "MIIB3TCCAYcCFD4P+gu2YYF1PgMW7Ccdhh+QEmnuMA0GCSqGSIb3DQEBCwUAMHAx\n",
      "CzAJBgNVBAYTAlRIMRAwDgYDVQQIDAdCYW5na29rMRAwDgYDVQQHDAdCYW5ncmFr\n",
      "MRgwFgYDVQQKDA9DQSBPcmdhbml6YXRpb24xCzAJBgNVBAsMAkNBMRYwFAYDVQQD\n",
      "DA1jYS5kb21haW4uY29tMB4XDTIwMDcwODA4Mjc1M1oXDTMwMDcwNjA4Mjc1M1ow\n",
      "cDELMAkGA1UEBhMCVEgxEDAOBgNVBAgMB0Jhbmdrb2sxEDAOBgNVBAcMB0Jhbmdy\n",
      "YWsxGDAWBgNVBAoMD0NBIE9yZ2FuaXphdGlvbjELMAkGA1UECwwCQ0ExFjAUBgNV\n",
      "BAMMDWNhLmRvbWFpbi5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAsiOK0n8E\n",
      "gqBeV6wBl6NDlf8Q/qlwccQtRTqB1JYJDPr2FNXj+k9DMPLzrEAi3EwoC4pRj3Mq\n",
      "BupSqIjj+7tFuwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAUpvfkPpZV3GX2P3JtR4r\n",
      "evIjGRLGWZnCSIk3IC9nmJ93nTowfZbCtx4SAt39POGil4BF3y3vJWkU1PQNrkjy\n",
      "lw==\n",
      "-----END CERTIFICATE-----\n"
     ]
    }
   ],
   "source": [
    "echo \"CA certificate info\"\n",
    "openssl x509 -text -in ca.pem"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "เราสามารถตรวจสอบได้ว่า certificate ที่ได้รับ สามารถใช้งานอะไรได้บ้างด้วย"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Certificate purposes:\n",
      "SSL client : Yes\n",
      "SSL client CA : Yes (WARNING code=3)\n",
      "SSL server : Yes\n",
      "SSL server CA : Yes (WARNING code=3)\n",
      "Netscape SSL server : Yes\n",
      "Netscape SSL server CA : Yes (WARNING code=3)\n",
      "S/MIME signing : Yes\n",
      "S/MIME signing CA : Yes (WARNING code=3)\n",
      "S/MIME encryption : Yes\n",
      "S/MIME encryption CA : Yes (WARNING code=3)\n",
      "CRL signing : Yes\n",
      "CRL signing CA : Yes (WARNING code=3)\n",
      "Any Purpose : Yes\n",
      "Any Purpose CA : Yes\n",
      "OCSP helper : Yes\n",
      "OCSP helper CA : Yes (WARNING code=3)\n",
      "Time Stamp signing : No\n",
      "Time Stamp signing CA : Yes (WARNING code=3)\n",
      "-----BEGIN CERTIFICATE-----\n",
      "MIIB3TCCAYcCFD4P+gu2YYF1PgMW7Ccdhh+QEmnuMA0GCSqGSIb3DQEBCwUAMHAx\n",
      "CzAJBgNVBAYTAlRIMRAwDgYDVQQIDAdCYW5na29rMRAwDgYDVQQHDAdCYW5ncmFr\n",
      "MRgwFgYDVQQKDA9DQSBPcmdhbml6YXRpb24xCzAJBgNVBAsMAkNBMRYwFAYDVQQD\n",
      "DA1jYS5kb21haW4uY29tMB4XDTIwMDcwODA4Mjc1M1oXDTMwMDcwNjA4Mjc1M1ow\n",
      "cDELMAkGA1UEBhMCVEgxEDAOBgNVBAgMB0Jhbmdrb2sxEDAOBgNVBAcMB0Jhbmdy\n",
      "YWsxGDAWBgNVBAoMD0NBIE9yZ2FuaXphdGlvbjELMAkGA1UECwwCQ0ExFjAUBgNV\n",
      "BAMMDWNhLmRvbWFpbi5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAsiOK0n8E\n",
      "gqBeV6wBl6NDlf8Q/qlwccQtRTqB1JYJDPr2FNXj+k9DMPLzrEAi3EwoC4pRj3Mq\n",
      "BupSqIjj+7tFuwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAUpvfkPpZV3GX2P3JtR4r\n",
      "evIjGRLGWZnCSIk3IC9nmJ93nTowfZbCtx4SAt39POGil4BF3y3vJWkU1PQNrkjy\n",
      "lw==\n",
      "-----END CERTIFICATE-----\n"
     ]
    }
   ],
   "source": [
    "openssl x509 -purpose -in ca.pem"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Mr.B\n",
    "\n",
    "Mr.B สร้าง private key สำหรับการสร้าง public-private key pair"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Generating RSA private key, 512 bit long modulus (2 primes)\n",
      "..+++++++++++++++++++++++++++\n",
      "...............+++++++++++++++++++++++++++\n",
      "e is 65537 (0x010001)\n"
     ]
    }
   ],
   "source": [
    "openssl genrsa -out mr_b.key 512"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Mr.B key in PEM format\n",
      "-----BEGIN RSA PRIVATE KEY-----\n",
      "MIIBOgIBAAJBAL5fbmO1ZfkOHQKznia8D8QHhN6GWhAhAUs02nPAaVqm9hG7ABhZ\n",
      "6Y60J0gRkU3L4KMTuoawUaxEREV9uFvloPkCAwEAAQJAXBOoPs2z/pwW6AGcUrvP\n",
      "HE9Osppk4Tw1dfygVDASROd6Dql75WlLL39O2B6G6kVHbgUcouLQd4kJB6UsrywS\n",
      "AQIhAO8G6x5TotvnoJMTAsUJHRClIHyfbj6wtOMnQ6mYlf9hAiEAy+QQ6DjfsCPJ\n",
      "FMTmfT5+sl/D1EARktewhQT6l5JAAJkCIGw2b59tMd/ov1OWWbymYZg1ib2h2CFd\n",
      "kqb8Ea/oOpBBAiEAvJcw2Eu7BAaluPNDqvdCY6VW0p2MY8HkAbYQQGDDmIkCIEYk\n",
      "Jj/2CP0CAFaI8Ly6RTC9H12VkGKpZItC4Y0z4rPS\n",
      "-----END RSA PRIVATE KEY-----\n"
     ]
    }
   ],
   "source": [
    "echo \"Mr.B key in PEM format\"\n",
    "cat mr_b.key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Mr.B key info\n",
      "RSA Private-Key: (512 bit, 2 primes)\n",
      "modulus:\n",
      "    00:be:5f:6e:63:b5:65:f9:0e:1d:02:b3:9e:26:bc:\n",
      "    0f:c4:07:84:de:86:5a:10:21:01:4b:34:da:73:c0:\n",
      "    69:5a:a6:f6:11:bb:00:18:59:e9:8e:b4:27:48:11:\n",
      "    91:4d:cb:e0:a3:13:ba:86:b0:51:ac:44:44:45:7d:\n",
      "    b8:5b:e5:a0:f9\n",
      "publicExponent: 65537 (0x10001)\n",
      "privateExponent:\n",
      "    5c:13:a8:3e:cd:b3:fe:9c:16:e8:01:9c:52:bb:cf:\n",
      "    1c:4f:4e:b2:9a:64:e1:3c:35:75:fc:a0:54:30:12:\n",
      "    44:e7:7a:0e:a9:7b:e5:69:4b:2f:7f:4e:d8:1e:86:\n",
      "    ea:45:47:6e:05:1c:a2:e2:d0:77:89:09:07:a5:2c:\n",
      "    af:2c:12:01\n",
      "prime1:\n",
      "    00:ef:06:eb:1e:53:a2:db:e7:a0:93:13:02:c5:09:\n",
      "    1d:10:a5:20:7c:9f:6e:3e:b0:b4:e3:27:43:a9:98:\n",
      "    95:ff:61\n",
      "prime2:\n",
      "    00:cb:e4:10:e8:38:df:b0:23:c9:14:c4:e6:7d:3e:\n",
      "    7e:b2:5f:c3:d4:40:11:92:d7:b0:85:04:fa:97:92:\n",
      "    40:00:99\n",
      "exponent1:\n",
      "    6c:36:6f:9f:6d:31:df:e8:bf:53:96:59:bc:a6:61:\n",
      "    98:35:89:bd:a1:d8:21:5d:92:a6:fc:11:af:e8:3a:\n",
      "    90:41\n",
      "exponent2:\n",
      "    00:bc:97:30:d8:4b:bb:04:06:a5:b8:f3:43:aa:f7:\n",
      "    42:63:a5:56:d2:9d:8c:63:c1:e4:01:b6:10:40:60:\n",
      "    c3:98:89\n",
      "coefficient:\n",
      "    46:24:26:3f:f6:08:fd:02:00:56:88:f0:bc:ba:45:\n",
      "    30:bd:1f:5d:95:90:62:a9:64:8b:42:e1:8d:33:e2:\n",
      "    b3:d2\n"
     ]
    }
   ],
   "source": [
    "echo \"Mr.B key info\"\n",
    "openssl rsa -text -in mr_b.key -noout"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.B สร้าง public key เพื่อส่งให้ Mr.A ใช้ encrypt message\n",
    "\n",
    "โดยในตัวอย่างนี้จะสร้าง CSR แล้วส่งไปให้ root CA รับรองและส่ง certificate ที่รับรองมาแล้ว (signed cert)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CSR info\n",
      "verify OK\n",
      "Certificate Request:\n",
      "    Data:\n",
      "        Version: 1 (0x0)\n",
      "        Subject: C = TH, ST = Bangkok, L = Bangrak, O = Receiver Organization, OU = Receiver, CN = b.domain.com\n",
      "        Subject Public Key Info:\n",
      "            Public Key Algorithm: rsaEncryption\n",
      "                RSA Public-Key: (512 bit)\n",
      "                Modulus:\n",
      "                    00:be:5f:6e:63:b5:65:f9:0e:1d:02:b3:9e:26:bc:\n",
      "                    0f:c4:07:84:de:86:5a:10:21:01:4b:34:da:73:c0:\n",
      "                    69:5a:a6:f6:11:bb:00:18:59:e9:8e:b4:27:48:11:\n",
      "                    91:4d:cb:e0:a3:13:ba:86:b0:51:ac:44:44:45:7d:\n",
      "                    b8:5b:e5:a0:f9\n",
      "                Exponent: 65537 (0x10001)\n",
      "        Attributes:\n",
      "            a0:00\n",
      "    Signature Algorithm: sha256WithRSAEncryption\n",
      "         09:7e:a9:0a:5f:bf:30:f5:45:a9:f4:c1:0b:cf:53:3f:9a:3d:\n",
      "         01:c0:cc:c1:cd:80:60:e3:0a:b3:76:ff:54:3c:16:5f:d2:45:\n",
      "         ca:46:8c:8f:cd:b1:9b:6b:c8:b5:eb:50:4e:49:cb:2c:37:4e:\n",
      "         c2:60:61:3c:d7:7e:13:25:ce:15\n"
     ]
    }
   ],
   "source": [
    "# parameters for Mr.B\n",
    "CN=b.domain.com\n",
    "OU=Receiver\n",
    "O='Receiver Organization'\n",
    "L=Bangrak\n",
    "ST=Bangkok\n",
    "C=TH\n",
    "\n",
    "\n",
    "openssl req -new -key mr_b.key \\\n",
    "  -subj \"/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}\" \\\n",
    "  -out mr_b.req -sha256\n",
    "\n",
    "echo \"CSR info\"\n",
    "openssl req -text -noout -verify -in mr_b.req"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ส่งคำขอใบรับรองเพื่อสร้าง certificate ไปที่หน่วยงานออกใบรับรอง (CA)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Root CA\n",
    "\n",
    "รับคำขอใบรับรอง และทำการรับรองด้วยการ sign ด้วย certificate และ private key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Signature ok\n",
      "subject=C = TH, ST = Bangkok, L = Bangrak, O = Receiver Organization, OU = Receiver, CN = b.domain.com\n",
      "Getting CA Private Key\n"
     ]
    }
   ],
   "source": [
    "openssl x509 -req -in mr_b.req \\\n",
    "  -CA ca.pem \\\n",
    "  -CAkey ca.key \\\n",
    "  -set_serial 101 -days 3650 -outform PEM -out mr_b.pem -sha256"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.B จะได้รับ certificate ไว้ส่งให้ Mr.A และใช้งานอื่น"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Mr.B certificate info\n",
      "Certificate:\n",
      "    Data:\n",
      "        Version: 1 (0x0)\n",
      "        Serial Number: 101 (0x65)\n",
      "        Signature Algorithm: sha256WithRSAEncryption\n",
      "        Issuer: C = TH, ST = Bangkok, L = Bangrak, O = CA Organization, OU = CA, CN = ca.domain.com\n",
      "        Validity\n",
      "            Not Before: Jul  8 08:27:55 2020 GMT\n",
      "            Not After : Jul  6 08:27:55 2030 GMT\n",
      "        Subject: C = TH, ST = Bangkok, L = Bangrak, O = Receiver Organization, OU = Receiver, CN = b.domain.com\n",
      "        Subject Public Key Info:\n",
      "            Public Key Algorithm: rsaEncryption\n",
      "                RSA Public-Key: (512 bit)\n",
      "                Modulus:\n",
      "                    00:be:5f:6e:63:b5:65:f9:0e:1d:02:b3:9e:26:bc:\n",
      "                    0f:c4:07:84:de:86:5a:10:21:01:4b:34:da:73:c0:\n",
      "                    69:5a:a6:f6:11:bb:00:18:59:e9:8e:b4:27:48:11:\n",
      "                    91:4d:cb:e0:a3:13:ba:86:b0:51:ac:44:44:45:7d:\n",
      "                    b8:5b:e5:a0:f9\n",
      "                Exponent: 65537 (0x10001)\n",
      "    Signature Algorithm: sha256WithRSAEncryption\n",
      "         00:ef:47:ff:62:10:8f:24:b3:ce:90:68:2a:68:5e:b7:5a:24:\n",
      "         c1:25:e3:22:5c:f5:23:09:6b:1c:99:9b:19:5d:be:0d:e2:64:\n",
      "         a6:95:01:a2:ec:3d:e9:84:42:c4:b9:fa:64:32:0d:17:e1:cc:\n",
      "         73:0d:04:4f:26:9a:14:44:73:27\n",
      "-----BEGIN CERTIFICATE-----\n",
      "MIIB1TCCAX8CAWUwDQYJKoZIhvcNAQELBQAwcDELMAkGA1UEBhMCVEgxEDAOBgNV\n",
      "BAgMB0Jhbmdrb2sxEDAOBgNVBAcMB0JhbmdyYWsxGDAWBgNVBAoMD0NBIE9yZ2Fu\n",
      "aXphdGlvbjELMAkGA1UECwwCQ0ExFjAUBgNVBAMMDWNhLmRvbWFpbi5jb20wHhcN\n",
      "MjAwNzA4MDgyNzU1WhcNMzAwNzA2MDgyNzU1WjB7MQswCQYDVQQGEwJUSDEQMA4G\n",
      "A1UECAwHQmFuZ2tvazEQMA4GA1UEBwwHQmFuZ3JhazEeMBwGA1UECgwVUmVjZWl2\n",
      "ZXIgT3JnYW5pemF0aW9uMREwDwYDVQQLDAhSZWNlaXZlcjEVMBMGA1UEAwwMYi5k\n",
      "b21haW4uY29tMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL5fbmO1ZfkOHQKznia8\n",
      "D8QHhN6GWhAhAUs02nPAaVqm9hG7ABhZ6Y60J0gRkU3L4KMTuoawUaxEREV9uFvl\n",
      "oPkCAwEAATANBgkqhkiG9w0BAQsFAANBAADvR/9iEI8ks86QaCpoXrdaJMEl4yJc\n",
      "9SMJaxyZmxldvg3iZKaVAaLsPemEQsS5+mQyDRfhzHMNBE8mmhREcyc=\n",
      "-----END CERTIFICATE-----\n"
     ]
    }
   ],
   "source": [
    "echo \"Mr.B certificate info\"\n",
    "openssl x509 -text -in mr_b.pem "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Mr.A\n",
    "\n",
    "Mr.A ต้องการส่ง message\n",
    "```\n",
    "\"Hello B, I'am A.\"\n",
    "```\n",
    "ไปหา Mr.B"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "echo \"Hello B, I'am A.\" > a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.A ตรวจสอบความน่าเชื่อถือของ certificate ของ Mr.B ด้วยการเชื่อถือ Root CA และ เชื่อว่า certificate ออกโดย Root CA จริงๆ"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "mr_b.pem: OK\n"
     ]
    }
   ],
   "source": [
    "openssl verify -CAfile ca.pem mr_b.pem"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.A encrypt message เพื่อทำการส่งให้ Mr.B"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "openssl rsautl -encrypt -certin -inkey mr_b.pem -in a2b_message.txt -out encrypted_a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ข้อมูลที่ถูก encrypted message"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "HԼ\u00018(=}��И\u0000q16D\u0013�8eo{>�ʹ�>�Vo?_��??������\u0019�E��\u001ai@�D�V<�#�\u0000�w"
     ]
    }
   ],
   "source": [
    "cat encrypted_a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.A สร้าง private key สำหรับการสร้าง public-private key pair"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Generating RSA private key, 512 bit long modulus (2 primes)\n",
      ".........+++++++++++++++++++++++++++\n",
      "..............+++++++++++++++++++++++++++\n",
      "e is 65537 (0x010001)\n"
     ]
    }
   ],
   "source": [
    "openssl genrsa -out mr_a.key 512"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Mr.A key in PEM format\n",
      "-----BEGIN RSA PRIVATE KEY-----\n",
      "MIIBOgIBAAJBAL5fbmO1ZfkOHQKznia8D8QHhN6GWhAhAUs02nPAaVqm9hG7ABhZ\n",
      "6Y60J0gRkU3L4KMTuoawUaxEREV9uFvloPkCAwEAAQJAXBOoPs2z/pwW6AGcUrvP\n",
      "HE9Osppk4Tw1dfygVDASROd6Dql75WlLL39O2B6G6kVHbgUcouLQd4kJB6UsrywS\n",
      "AQIhAO8G6x5TotvnoJMTAsUJHRClIHyfbj6wtOMnQ6mYlf9hAiEAy+QQ6DjfsCPJ\n",
      "FMTmfT5+sl/D1EARktewhQT6l5JAAJkCIGw2b59tMd/ov1OWWbymYZg1ib2h2CFd\n",
      "kqb8Ea/oOpBBAiEAvJcw2Eu7BAaluPNDqvdCY6VW0p2MY8HkAbYQQGDDmIkCIEYk\n",
      "Jj/2CP0CAFaI8Ly6RTC9H12VkGKpZItC4Y0z4rPS\n",
      "-----END RSA PRIVATE KEY-----\n"
     ]
    }
   ],
   "source": [
    "echo \"Mr.A key in PEM format\"\n",
    "cat mr_b.key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Mr.A key info\n",
      "RSA Private-Key: (512 bit, 2 primes)\n",
      "modulus:\n",
      "    00:be:5f:6e:63:b5:65:f9:0e:1d:02:b3:9e:26:bc:\n",
      "    0f:c4:07:84:de:86:5a:10:21:01:4b:34:da:73:c0:\n",
      "    69:5a:a6:f6:11:bb:00:18:59:e9:8e:b4:27:48:11:\n",
      "    91:4d:cb:e0:a3:13:ba:86:b0:51:ac:44:44:45:7d:\n",
      "    b8:5b:e5:a0:f9\n",
      "publicExponent: 65537 (0x10001)\n",
      "privateExponent:\n",
      "    5c:13:a8:3e:cd:b3:fe:9c:16:e8:01:9c:52:bb:cf:\n",
      "    1c:4f:4e:b2:9a:64:e1:3c:35:75:fc:a0:54:30:12:\n",
      "    44:e7:7a:0e:a9:7b:e5:69:4b:2f:7f:4e:d8:1e:86:\n",
      "    ea:45:47:6e:05:1c:a2:e2:d0:77:89:09:07:a5:2c:\n",
      "    af:2c:12:01\n",
      "prime1:\n",
      "    00:ef:06:eb:1e:53:a2:db:e7:a0:93:13:02:c5:09:\n",
      "    1d:10:a5:20:7c:9f:6e:3e:b0:b4:e3:27:43:a9:98:\n",
      "    95:ff:61\n",
      "prime2:\n",
      "    00:cb:e4:10:e8:38:df:b0:23:c9:14:c4:e6:7d:3e:\n",
      "    7e:b2:5f:c3:d4:40:11:92:d7:b0:85:04:fa:97:92:\n",
      "    40:00:99\n",
      "exponent1:\n",
      "    6c:36:6f:9f:6d:31:df:e8:bf:53:96:59:bc:a6:61:\n",
      "    98:35:89:bd:a1:d8:21:5d:92:a6:fc:11:af:e8:3a:\n",
      "    90:41\n",
      "exponent2:\n",
      "    00:bc:97:30:d8:4b:bb:04:06:a5:b8:f3:43:aa:f7:\n",
      "    42:63:a5:56:d2:9d:8c:63:c1:e4:01:b6:10:40:60:\n",
      "    c3:98:89\n",
      "coefficient:\n",
      "    46:24:26:3f:f6:08:fd:02:00:56:88:f0:bc:ba:45:\n",
      "    30:bd:1f:5d:95:90:62:a9:64:8b:42:e1:8d:33:e2:\n",
      "    b3:d2\n"
     ]
    }
   ],
   "source": [
    "echo \"Mr.A key info\"\n",
    "openssl rsa -text -in mr_b.key -noout"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.A สร้าง public key เพื่อส่งให้ Mr.B validate signature ได้\n",
    "\n",
    "สร้าง CSR แล้วส่งไปให้ root CA รับรองและส่ง signed cert กลับมาใช้ เช่นเดียวกับ Mr.B"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CSR info\n",
      "verify OK\n",
      "Certificate Request:\n",
      "    Data:\n",
      "        Version: 1 (0x0)\n",
      "        Subject: C = TH, ST = Bangkok, L = Bangrak, O = Sender Organization, OU = Sender, CN = a.domain.com\n",
      "        Subject Public Key Info:\n",
      "            Public Key Algorithm: rsaEncryption\n",
      "                RSA Public-Key: (512 bit)\n",
      "                Modulus:\n",
      "                    00:d8:36:68:3f:4a:31:43:ab:30:cd:d7:e9:ac:19:\n",
      "                    73:91:7f:ff:d1:d6:0c:21:07:d3:85:91:36:28:9e:\n",
      "                    41:97:de:53:6a:70:71:75:b8:dd:3a:bf:31:d4:ed:\n",
      "                    de:91:38:22:fb:b6:e8:28:d1:50:1b:f2:4d:d0:ef:\n",
      "                    b0:57:35:71:17\n",
      "                Exponent: 65537 (0x10001)\n",
      "        Attributes:\n",
      "            a0:00\n",
      "    Signature Algorithm: sha256WithRSAEncryption\n",
      "         15:85:1a:48:06:65:7c:36:33:ab:a7:e4:ba:bd:09:c9:04:ff:\n",
      "         4f:c4:d6:85:91:41:37:7d:fc:3b:8b:f0:52:d2:b6:95:91:63:\n",
      "         da:3e:6c:cb:ea:58:f2:d9:5b:33:8a:e8:59:03:85:df:51:98:\n",
      "         cc:24:ac:49:6e:99:8d:eb:e1:56\n"
     ]
    }
   ],
   "source": [
    "# parameters for Mr.A\n",
    "CN=a.domain.com\n",
    "OU=Sender\n",
    "O='Sender Organization'\n",
    "L=Bangrak\n",
    "ST=Bangkok\n",
    "C=TH\n",
    "\n",
    "openssl req -new -key mr_a.key \\\n",
    "  -subj \"/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}\" \\\n",
    "  -out mr_a.req -sha256\n",
    "\n",
    "echo \"CSR info\"\n",
    "openssl req -text -noout -verify -in mr_a.req"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ส่งคำขอใบรับรองเพื่อสร้าง certificate ไปที่หน่วยงานออกใบรับรอง (CA)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Root CA\n",
    "รับคำขอใบรับรอง และทำการรับรองด้วยการ sign ด้วย certificate และ private key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Signature ok\n",
      "subject=C = TH, ST = Bangkok, L = Bangrak, O = Sender Organization, OU = Sender, CN = a.domain.com\n",
      "Getting CA Private Key\n"
     ]
    }
   ],
   "source": [
    "openssl x509 -req -in mr_a.req \\\n",
    "  -CA ca.pem \\\n",
    "  -CAkey ca.key \\\n",
    "  -set_serial 102 -days 3650 -outform PEM -out mr_a.pem -sha256"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Sign document เพื่อสร้าง digital signature"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [],
   "source": [
    "openssl dgst -md5 -sign mr_a.key -out digital_signature.md5 encrypted_a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "digital signature"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "fp\n",
      "(,�N\"�P�t6���\u001f�ȅ�:\u0006��`~H���\u0013U��ƚ1�_�e��G�?�j\n",
      ";\u0003�����\u001f��kU�q"
     ]
    }
   ],
   "source": [
    "cat digital_signature.md5"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mr.A ส่ง public key, digital signature และ encrypted message ให้ Mr.B\n",
    "\n",
    "### Mr.B\n",
    "\n",
    "รับ public key, digital signature และ encrypted message\n",
    "\n",
    "Mr.B ตรวจสอบความน่าเชื่อถือของ certificate ของ Mr.A ด้วยการเชื่อถือ Root CA และ เชื่อว่า certificate ออกโดย Root CA จริงๆ"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "mr_a.pem: OK\n"
     ]
    }
   ],
   "source": [
    "openssl verify -CAfile ca.pem mr_a.pem"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Verify document ด้วย digital signature และ public key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Verified OK\n"
     ]
    }
   ],
   "source": [
    "openssl x509 -pubkey -noout -in mr_a.pem > pubkey.pem\n",
    "openssl dgst -md5 -verify pubkey.pem -signature digital_signature.md5 encrypted_a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Trying to decrypt message"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "A private key is needed for this operation\n",
      "Hello B, I'am A.\n"
     ]
    }
   ],
   "source": [
    "openssl rsautl -decrypt -certin -inkey mr_b.key -in encrypted_a2b_message.txt -out decrypted_a2b_message.txt\n",
    "cat decrypted_a2b_message.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Conclusion\n",
    "\n",
    "- ใช้ Public-Private Key 2 คู่ คู่หนึ่งใช้เพื่อ encrypt-decrypt message และอีกคู่หนึ่งใช้เพื่อ sign-verify message\n",
    "- public key จะถูกใช้เพื่อ encrypt เสมอ เนื่อจาก แม้ว่า public key จะหลุดสู่สาธารณะ ก็สามารถใช้ทำได้เพียงเข้ารหัสเท่านั้น เนื่องจากคู่ private key จะอยู่ที่ receiver เสมอ\n",
    "- private key ที่ถูกใช้ sign message ก็เช่นกัน โดย private key จะอยู่ที่ sender เสมอ และ public key ที่ถูกส่งให้ก็ทำได้เพียงใช้ verify ท่านั้น\n",
    "- public key และ private key สามารถใช้ได้ทั้งเข้ารหัสและถอดรหัสได้ แต่ปกติ private key จะต้องไม่ถูกส่งผ่านตัวกลาง จะมีเฉพาะ public key เท่านั้นี่ถูกส่งผ่านตัวกลาง\n",
    "- digital signature ก็ใช้ asymmetric key encryption เช่นเดียวกัน แต่ใช้เพื่อ verify เพื่อป้องกันการโจมตีแบบ man-in-the-middle attack โดยจะใช้เพื่อ validate message ว่าถูกส่งมาจาก sender จริงหรือไม่ (ใครก็สามารถใช้ public key ของ receiver เพื่อ encrypt ข้อมูลใดๆ ได้เช่นเดียวกัน)\n",
    "- public key จะถูกเก็บไว้ใน certificate ใน format มาตรฐาน x509 .PEM\n",
    "- certificate จะมีข้อมูล public key, issuer identity, subject info และ digital signature รวมไปถึงข้อมูลต่างๆ ตามมาตรฐาน x509\n",
    "- Public-Private Key ทั้ง 2 คู่มีความน่าเชื่อถือ เนื่องจากถูก generate และรับรองโดย Root CA และสามารถ verify certificate ได้โดยใช้ CA certificate ทดสอบ\n",
    "- certificate ถูกออกโดยใช้ openssl ในทางปฏิบัติควรจะใช้ CA server"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## References\n",
    "\n",
    "* [Public-Private-Key Encryption and Digital Signature](https://www.researchgate.net/figure/Public-Private-Key-Encryption-and-Digital-Signatures_fig31_277736892)\n",
    "* [SSL Client Authentication step-by-step](https://www.makethenmakeinstall.com/2014/05/ssl-client-authentication-step-by-step/)\n",
    "* [x509](https://en.wikipedia.org/wiki/X.509)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}