OpenSSL generate Bitcoin address

4

I am building a script to generate secp256k1 using OpenSSL in MacOS. Seems to work fine. My question: is this SECURE enough?

#!/bin/bash

if [ $# -eq 0 ]; then
  echo "Missing name, for example generate_key.sh bob"
  exit 1
fi

FILE_NAME=$1
PRIVATE_KEY=${FILE_NAME}_private.pem
PUBLIC_KEY=${FILE_NAME}_public.pem
BITCOIN_PRIVATE_KEY=bitcoin_${FILE_NAME}_private.key
BITCOIN_PUBLIC_KEY=bitcoin_${FILE_NAME}_public.key

echo "Generating private key"
openssl ecparam -genkey -name secp256k1 -rand /dev/urandom -out $PRIVATE_KEY

echo "Generating public key"
openssl ec -in $PRIVATE_KEY -pubout -out $PUBLIC_KEY

echo "Generating BitCoin private key"
openssl ec -in $PRIVATE_KEY -outform DER|tail -c +8|head -c 32|xxd -p -c 32 > $BITCOIN_PRIVATE_KEY

echo "Generating BitCoin public key"
openssl ec -in $PRIVATE_KEY -pubout -outform DER|tail -c 65|xxd -p -c 65 > $BITCOIN_PUBLIC_KEY

echo "Files created!"

Mircea Stanciu

Posted 2017-07-15T00:23:06.723

Reputation: 151

1Could you may explain what's the background of converting the private/public keys to Bitcoin private/public keys?soupdiver 2017-09-14T17:37:20.943

Answers

2

OpenSSL's RNG is considered secure, so there should be no problem with this method. I don't think you need to use -rand /dev/urandom since OpenSSL already uses /dev/urandom for seeding the RNG.

Andrew Chow

Posted 2017-07-15T00:23:06.723

Reputation: 40 910

Makes sense, tnxMircea Stanciu 2017-07-15T00:54:59.570

If you're on macOS, which uses LibreSSL 2.2.7, then there is no option -randonmyway133 2017-12-18T23:31:01.840