OpenSSL Studio

Interactive OpenSSL v3.6.3 environment running entirely in your browser via WebAssembly. Educational use only — not a FIPS-validated module; the pending FIPS 140-3 validation submission covers the OpenSSL 3.5.4 provider (Oct 2025), not the 3.6.x line.

Best experienced on desktop — scroll down for terminal and file manager.
Core

Your first keypair — classical, then post-quantum

genpkey generates both eras of key with the same command shape — only the -algorithm value changes. Watch what changes (and what stays the same) between an RSA-2048 key and an ML-DSA-65 key.

ML-DSA (FIPS 204) and ML-KEM (FIPS 203) have been native in OpenSSL's default provider since 3.5 (this Studio runs 3.6.3) — no external provider needed. The PQC variant name (e.g. ml-dsa-65) IS the -algorithm value; it is not a -pkeyopt. That trips up first-time users coming from RSA, where key size is a separate -pkeyopt.

Waiting for the OpenSSL WASM engine to initialize — steps enable once it's ready.

Steps

  1. genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out learn-l1-rsa.key

    1. Generate a classical RSA-2048 private key

  2. genpkey -algorithm ML-DSA-65 -out learn-l1-mldsa.key

    2. Generate a post-quantum ML-DSA-65 private key