Local Setup

Every exercise in this foundation runs from a terminal, so a few minutes of setup now saves confusion later. The primary tool is OpenSSL 3.x, which ships or installs cleanly on every major platform and exposes the primitives we care about through simple subcommands. A handful of supporting tools round out the workflows you will meet in the applied sections.

OpenSSL 3.x per platform

OpenSSL 3.x is important specifically because macOS historically ships LibreSSL under the openssl name, and some subcommands and flags differ. Install a real OpenSSL 3.x build and put it ahead on your PATH.

Platform	Command	Notes
macOS (Homebrew)	brew install openssl@3	Homebrew does not symlink it by default; add it to PATH (below)
Debian / Ubuntu	sudo apt install openssl	22.04 and later ship 3.x
Fedora / RHEL	sudo dnf install openssl	3.x on current releases
Windows	winget install ShiningLight.OpenSSL.Light or use WSL	WSL with Ubuntu is the smoothest path

On macOS, make the Homebrew build the one your shell finds:

echo 'export PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc
openssl version

Expected output:

OpenSSL 3.3.2 24 Sep 2024 (Library: OpenSSL 3.3.2 24 Sep 2024)

If you see LibreSSL 3.x, your shell is still finding the system binary. Fix the PATH order before continuing; the page on Verify The Environment covers this quirk in detail.

Supporting tools: age, gpg, step-cli

Three optional tools appear in later exercises. They are worth installing now.

Tool	Purpose	Install (macOS / Debian)
age	Modern, hard-to-misuse file encryption	brew install age / apt install age
gpg	OpenPGP: encryption, signing, key management	brew install gnupg / apt install gnupg
step-cli	Certificates and PKI without OpenSSL’s rough edges	brew install step / see smallstep docs

Confirm they are present:

age --version && gpg --version | head -1 && step version | head -1

Expected output:

v1.2.1
gpg (GnuPG) 2.4.5
Smallstep CLI/0.27.4 (darwin/arm64)

You do not need every tool for every page, so a missing one is not fatal; each exercise names what it requires.

A scratch directory convention

To keep generated keys and ciphertext out of your real projects, every exercise in this foundation uses a single throwaway directory: ~/crypto-lab. Create it once.

mkdir -p ~/crypto-lab
cd ~/crypto-lab
echo "lab created at $(pwd)"

Expected output:

lab created at /Users/you/crypto-lab

Treat this directory as disposable. It will accumulate private keys, so do not commit it to version control and do not reuse its keys for anything real. When a page finishes, you can safely rm -rf ~/crypto-lab and recreate it.

Practical Guidance

1. Verify openssl version reports OpenSSL 3.x, not LibreSSL, before starting any exercise.
2. On macOS, fix your PATH order once in your shell profile so every new terminal finds the right binary.
3. Install age, gpg, and step-cli now; installing mid-exercise breaks your flow.
4. Do all hands-on work inside ~/crypto-lab and never commit that directory.
5. Regenerate the lab from scratch if it gets cluttered; nothing in it is meant to be permanent.