OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

0
votes
0answers
24 views

OpenSSL: Display DH Parameters [migrated]

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
0
votes
0answers
14 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
4
votes
1answer
36 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
2
votes
1answer
41 views

Evaluating the Entropy of the PRNG in OpenSSL

I've have a question on the PRNG in OpenSSL. I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library). If this is the wrong ...
1
vote
1answer
29 views

How do I enable support for Cryptographic Message Syntax (CMS) in OpenSSL on OS X?

I want to use the Cryptographic Message Syntax (CMS) of OpenSSL as documented on https://www.openssl.org/docs/apps/cms.html on OS X. When I try to run openssl cms I get the following error: $ ...
0
votes
1answer
20 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
2
votes
0answers
24 views

How to check SSL connectivity between certificates installed on two different server [migrated]

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
2
votes
1answer
48 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
1
vote
0answers
14 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates. [migrated]

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
2
votes
1answer
57 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
15 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
0
votes
0answers
9 views

Could not disable session resumption requested by OpenSSL client [migrated]

I'm developing SSL mutual authentication in android to connect to a https website using OpenSSL library. I want to disable session resumption requested by client in OpenSSL; In other words, it is ...
0
votes
0answers
7 views

openssl error: Error Loading extension section server [migrated]

The system is fc21. The objective is to run the examples: http://linuxconfig.org/apache-web-server-ssl-authentication The openssl.cnf file has been created and the following command run: openssl ...
2
votes
0answers
27 views

What is the Padding used by SSL 3.0 in OpenSSL

Im Currently working to exploit POODLE, However i have encounter a problem. I want to know what is padding in my SSLv3 protocal, is there any method to get padding with a private key?
2
votes
0answers
55 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
35 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
140 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
1answer
52 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
1
vote
1answer
53 views

Simple open-source file encryption tool

I want to securely encrypt files, with an open algorithm. So, i've constructed the simple openSSL shell command. How secure is it? function aes-enc() { openssl enc -aes-256-cbc -e -in $1 -out ...
3
votes
0answers
54 views

How to know if I'm using openSSL properly [closed]

I would like to know how I can be sure that I am using openSSL the right way. You all know how the openSSL documentation is hard to read. I know that everybody has different goals when using this ...
5
votes
2answers
386 views

Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by ...
1
vote
1answer
169 views

Creating a private key with OpenSSL and encrypting it with AES GCM

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority. However, eventhough openssl supports ...
0
votes
0answers
69 views

“gpg” vs “openssl rsautl” (asymmetric keys) for credentials storage

I'm working in a PHP project and need a better solution to store credentials to a client's database, and I'm thinking about encryption, I put to work both gpg and openssl using asymmetric keys, but ...
3
votes
1answer
129 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
2
votes
1answer
164 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
0
votes
0answers
73 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
1
vote
0answers
53 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
0
votes
1answer
2k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
160 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
363 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
4
votes
2answers
180 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
0
votes
1answer
77 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
0answers
28 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
0
votes
2answers
143 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
0
votes
1answer
70 views

How to generate a CSR via command line/openssl

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to ...
2
votes
1answer
149 views

OpenSSL with AES-256-CTR cipher

I have installed OpenSSL on my OS X box and it provides the AES-256-CTR cipher. When I install OpenSSL on Windows, then the AES-256-CTR cipher isn't available. Can anyone explain why there is a ...
2
votes
2answers
84 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
1
vote
2answers
81 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
3
votes
1answer
68 views

Does TLS fallback only keep from downgrades to SSLv3?

I have read the RFC on this and can't seem to find what I am wanting to know. When implemented, if a client and a server support TLS fallback protection, does it only keep them from downgrading to ...
1
vote
1answer
109 views

openSSL selects ECDH-RSA instead of ECDH-ECDSA

I am trying to do a secure connection with openSSL between a client and a server that I wrote. When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ...
1
vote
0answers
37 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
0
votes
1answer
179 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
1
vote
2answers
193 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
6
votes
2answers
315 views

OpenSSL vulnerability CVE-2015-0205

I can't seem to make any sense out of the following vulnerability in OpenSSL: DH client certificates accepted without verification [Server] (CVE-2015-0205) ...
1
vote
1answer
94 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
5
votes
2answers
317 views

openssl enc uses md5 to hash the password and the salt

Wikipedia states that md5's collision resistance is 2^18 (https://en.wikipedia.org/wiki/MD5). I just found out that openssl enc uses md5 to hash the password and the salt. Let's assume that I want ...