#!/bin/bash

# generate key pair
openssl genrsa -out keypair.pem 2048

# write public key to its own file
openssl rsa -in keypair.pem -pubout -out public.pem

# write private key as PKCS-8
openssl pkcs8 -topk8 -nocrypt -in keypair.pem -out private.pem

# write private key as password-protected PKCS-8
openssl pkcs8 -topk8 -v2 des3 -passout pass:'correct-battery-horse-what???' -in keypair.pem -out private-enc.pem

# example of hard-coded value
PUBLIC_KEY=$( cat <<EOF
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxE5SgmjoILdahqK4sPXL
qE+wIFOMZd54vrIKFsiGk9b9mno1C0zsKAwBPDIf4T6rkSlYdVtDYl7pfLtqWMyu
rhhI0cSehO2BEqETOk997ZueJVSxr43wsGIubdgm9BEYODHTOWFZihCkmrx4xj7g
puFLwj9DdY28UX++OXAZlJrb2mp3rgsbremOGOPxaqpZeF6F/S5VQgOSx2nSNua3
/E6WR9NSICQDFQE6bldtagSezD3ICIccX+WtPpJfjUdsEp+J0C5Oa47g1EqdhR7D
ptxRV6/+6WHgerfb9TO0TXK9qXm5GeOftg79xDPUrNNJAGhbZjiWUQTgJBiWlIUT
BwIDAQAB
-----END PUBLIC KEY-----
EOF
)

# or read the public key from a file into the variable
PUBLIC_KEY=$( cat public.pem )

echo "Public key is:n$PUBLIC_KEY"

# the <(..) is Bash specific
echo "Hello world." | openssl rsautl -encrypt -oaep -pubin -inkey <(echo "$PUBLIC_KEY") -out encrypted.bin

echo "Encrypted data:n"
od -t x1 encrypted.bin

echo "Decrypt with unprotected private key file:"
openssl rsautl -decrypt -oaep -inkey private.pem -in encrypted.bin

echo "Decrypt with password-protected private key file:"
openssl rsautl -decrypt -oaep -inkey private-enc.pem -passin pass:'correct-battery-horse-what???' -in encrypted.bin