Walkthrough: Obfuscation pt 2 - Asymmetric Encryption, Digital Signatures, ECC and Hashing 🔐

[embed]

Picking up from where I left off in part 1 of my obfuscation project (Walkthrough: Obfuscation pt 1 — Steganography and Symmetric Encryption 🔐 | by Daryl Brooks | Feb, 2026 | Medium), I will continue using the OpenSSL tool, but this time I will be demonstrating its usage as it applies to other obfuscation methods such as asymmetric encryption, digital signature generation, elliptic curve encryption, and one-way hashing.

Asymmetric Encryption

So, what differentiates asymmetric encryption algorithms from symmetric encryption algorithms? It’s fairly simple: instead of relying on a single key to both encrypt and decrypt data, asymmetric encryption generates a public and private key pair to do so. In the context of asymmetric encryption, the public key is shareable and used to encrypt data, whereas the private key is secured by the associated user and used to decrypt encrypted data. Public and private key pairs can also be used for something known as “nonrepudiation,” but I’ll touch on that in the Digital Signatures section of this walkthrough. The asymmetric algorithm that I worked with during this project was the widely used RSA (Rivest–Shamir–Adleman), which is named after its founders. Public and private keys generated by the RSA algorithm can range from lengths of 1,024, 2,048, to 4,096 bits. Let’s see how this works:

To start things off, I first need to switch from the “Symmetric” subdirectory that I was in during the previous walkthrough to the “Asymmetric” subdirectory, where I will be storing a variety of related files.

Next, I use OpenSSL to generate a 2,048 bit private key and store it in a PEM file named “private_key.pem” (openssl genrsa -out private_key.pem 2048).

Now that I’ve created a private key, I’m going to use OpenSSL to generate a public key based on it and store it in a PUB file named “key.pub” (openssl rsa -in private_key.pem -out key.pub -pubout).

To verify and display the contents of my private key, I use the “cat” command with the filename (“cat private_key.pem”).

I do the same to view the contents of the associated public key (“cat key.pub”).

Now that I’ve verified the successful creation of a public/private key pair, I want to test their functionality. First, I use my public key to encrypt a simple text file named “rsa.txt” and store the output in a file named “rsa.enc” (openssl rsautl -in rsa.txt -out rsa.enc -pubin -inkey key.pub -encrypt).

With no errors received and “rsa.enc” successfully created, I know that my public key’s ability to encrypt files is fully functional. I now move on to use the associated private key to decrypt “rsa.enc” and store the output in a file named “rsa.dec” (openssl rsautl -in rsa.enc -out rsa.dec -inkey private_key.pem -decrypt).

To verify that my private key has successfully decrypted the contents of “rsa.enc,” I use the “cat” command with the “rsa.dec” file, which displays a cleartext output of “Cryptography.”

Digital Signatures

I mentioned previously that public/private key pairs can be used to prove something called “nonrepudiation.” Nonrepudiation proves the integrity of information by tying it exclusively to its originator. Digital signatures are a commonly implemented mechanism used to enforce nonrepudiation. A public key can be used to verify a digital signature, and a private key can be used to generate a new signature associated with a user. However, this is not the usage of digital signatures that I cover in this project. Instead, I will be demonstrating how we can use OpenSSL to generate a security certificate, which is another implementation of digital signatures. This will show how digital signatures can be used for authentication purposes.

Running the following command tells OpenSSL to create a security certificate based on the X.509 standard with a 4,096‑bit RSA key and for it to expire in one year (openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365). I then have to enter my password twice and fill in the requested information shown in the image above. After this, a new security certificate is successfully generated.

Elliptic Curve

Another form of asymmetric encryption is ECC (elliptic curve cryptography), which is commonly used in mobile device security. Some key advantages it has over other asymmetric algorithms include smaller ciphertext sizes, shorter key lengths, and faster key and signature generation. However, it is highly vulnerable to both side‑channel and twist security attacks (attacks that can expose a private key). Let’s run through a similar key generation and encryption/decryption process that we did with RSA:

I’m going to first tell OpenSSL to produce a list of different ECC‑based algorithms (openssl ecparam -list_curves). As we can see in the image above, there are quite a few.

I decided to use the Secp256k1 ECC algorithm for this project to generate a private key named “private_ecc.pem” (openssl ecparam -name prime256v1 -genkey -noout -out private_ecc.pem).

To verify that all went well during the private key’s creation, I use the “cat” command with “private_ecc.pem” (“cat private_ecc.pem”). We can see an immediate difference in the length of the ciphertext in this ECC‑based private key compared to the previously viewed RSA private key.

Next, I’m going to generate a public key from the already created private key and store the output in a different PEM file named “public_ecc.pem” (openssl ec -in private_ecc.pem -pubout -out public_ecc.pem).

In the same manner as I did with the private key, I display the contents of “public_ecc.pem” using the “cat” command (“cat public_ecc.pem”) to verify its completion. We can see that the ECC public key’s ciphertext is even shorter than the RSA public key’s.

Now, I’m going to use the ECC private key that I just created to generate a security certificate (based on the same X.509 standard and 365‑day expiration time) and store the output in a file named “cert_ecc.pem” (openssl req -new -x509 -key private_ecc.pem -out cert_ecc.pem -days 365).

When I use the “cat” command with the “cert_ecc.pem” file, I can view the ciphertext of the successfully generated ECC security certificate (“cat cert_ecc.pem”).

Hashing

Lastly, I’m going to discuss and demonstrate the practical usage of a hashing algorithm. Similar to digital signatures, hashing is commonly used to ensure the integrity of the data it obfuscates. Unlike symmetric and asymmetric cryptography, hash digests are used for one‑way encryption, meaning that their ciphertext is not meant to be decrypted. Data obfuscated using a hash digest is assigned a very specific set of ciphertext called the hash value. If even a single letter or punctuation mark is altered, the entire hash value changes. This helps in digital forensics with detecting and preventing electronic evidence tampering. Cases where a hash value is reversed are known as collisions, usually due to the usage of a weak legacy hashing algorithm such as MD5. In this project, I used the SHA‑256 hashing algorithm (which is moderately strong) to demonstrate how OpenSSL can generate a one‑way hash of a file:

Starting off, I need to switch from the “Asymmetric” subdirectory to the “Hashing” subdirectory, where files used in this demonstration are stored.

One of the files stored in this subdirectory is a simple text file named “hash1.txt,” and I use the “cat” command to display its contents, which reads “Hash” (cat hash1.txt).

There is also another text file in this subdirectory named “hash2.txt,” and when executing the “cat” command with it, its contents are displayed as “hash” (cat hash2.txt). We can see that while both files contain the same single word, the letter casing is different.

I’m now using OpenSSL to hash the cleartext file hash1.txt with the SHA‑256 hash function and store its output in a new text file named “hash1–256.txt” (openssl dgst -sha256 hash1.txt > hash1–256.txt).

I do the same for hash2.txt, hashing it with the SHA‑256 function and storing the output in a new text file named “hash2–256.txt” (openssl dgst -sha256 hash2.txt > hash2–256.txt).

Now I’m using the “cat” command to display the contents of “hash1–256.txt” (cat hash1–256.txt).

I also use the “cat” command to display the contents of “hash2–256.txt” (cat hash2–256.txt). It shouldn’t take long to see that the hash values are completely different. As mentioned before, a simple difference such as letter casing will generate a completely different set of ciphertext for two otherwise identical documents.

Conclusion

This wraps up yet another project. In this latter portion of this two‑part project walkthrough, I demonstrated how to generate a public/private key pair using asymmetric and ECC encryption and how to use them to encrypt and decrypt files. I also demonstrated how digital security certificates can be generated to prove authenticity and how hashing digests can be used to ensure file integrity. You can watch the video walkthrough of this same project at the top of page. Until next time, take care of yourself and…SHOW YOUR WORK!!! 😉