Generating A Key For Signing Tag Data - Balluff BIS U-6127-081-1 4-06-ST36 Betriebsanleitung

BIS U-6127-081-1_4-06-ST36
Processor unit
7
Startup and operation (continued)
7.3.6

Generating a key for signing tag data

In order to sign tag data or verify the signature, a key pair
consisting of a private (priv) and a public (pub) key must be
generated once. The private key is unique and cannot be
recovered if lost. Since anyone who possesses the key can
generate valid tag signatures, the key must be kept secret.
The public key, on the other hand, can be used by third
parties to check a signature for validity.
The private key is imported into all BIS devices involved
and used there for signing and signature verification. All
tags signed with the same private key (even in different
devices) can be exchanged among themselves and always
recognized as valid. Tags signed with a different key are
always considered invalid.
To generate a key pair, the free software openssl is
required, which is available for both Windows and Linux
PCs, or the functions on the device website for generating
a key must be used. In the latter case, we recommend
using it on a secure network and temporarily turning off the
device after saving the key to a PC.
Generate key pair
1. Install the openssl software on a PC.
2. In the command line application of the PC execute the
following command to create a file with the name
nistp224_key.pem. in the current directory:
openssl ecparam -name secp224r1
-genkey -noout -out nistp224_key.pem
Display the private and public key of the file
► Enter the following commands:
openssl ec -in nistp224_key.pem -text
-noout
82 english
For example, the display looks like this:
read EC key
Private-Key: (224 bit)
priv:
1)
d4:79:60:0b:2a:15:02:5c:48:34:d7:a8:7d:
c0:c5:c0:c3:73:8b:f8:33:38:aa:bd:4b:d5:
d7:a2
pub:
04:e6:65:43:e3:1e:9a:3d:fd:0c:98:ee:c4:
60:f4:c8:4e:01:1c:54:28:85:ab:71:a4:02:
01:89:92:90:05:33:2e:d3:04:4f:f0:22:b0:
b1:26:a8:0d:f3:c3:fa:43:e7:93:6c:e9:a2:
4c:e3:44:13:8b
ASN1 OID: secp224r1
NIST CURVE: P-224
The data following priv: (28 bytes) is the private key that must be
1)
loaded on the devices.