5
votes
4answers
1k views

Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable

According to the OpenSSL project the version in use on a server we control is not vulnerable: 0.9.8o. According to OpenVPN v 2.1.3 is also not vulnerable (also in use). These are running on Debian ...
1
vote
2answers
135 views

How secure is my system?

I am creating an application that allows a user to create an account, with a password, and have a set of public and private keys symmetrically encrypted with the password, so that they can be ...
0
votes
0answers
34 views

Storing hashed or encrypted password in session? [duplicate]

I need users to be able to encrypt and decrypt without entering their passwords every time. One way is to store the hashed password in session, and use it for encryption and decryption. Problem with ...
0
votes
2answers
50 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
1
vote
3answers
95 views

How to minimise risk to sensitive data in temp files in shared hosting environment before encryption?

openssl_pkcs7_encrypt() requires the data to be encrypted to be read from a file and so unfortunately it requires sensitive data to be written to temporary file before being encrypted. In a shared ...
11
votes
3answers
648 views

OpenSSL generates 1032bits when I request 1024bits

When I enter the command-line openssl dhparam -text 1024 the resulting safe-prime is 1032 bits instead of 1024 bits. It seems like the 1st byte is always 0. Why is this?
3
votes
1answer
3k views

Getting “SSL: alert [”write“]: fatal : bad record mac” during openssl Handshake

I am getting SSL: alert ["write"]: fatal : bad record mac from the OPENSSL logs during the handshake and Client is not sending the Application data and its creating the handshake again and again. ...
13
votes
2answers
2k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
6
votes
5answers
2k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
2
votes
2answers
1k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
7
votes
2answers
3k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
1
vote
1answer
228 views

How to open a .txt.enc file?

I have a .txt.enc file. It is an output of openssl enc. I need to open it. When I try to open it in Emacs, the first some characters(also known characters) are : 'Salted__C' . how can I understand ...
4
votes
3answers
428 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
3
votes
2answers
2k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
3
votes
2answers
907 views

What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?

I have learned there are 2 methods to make SSH remote login easier and secure , those are; ssh generated keys (using ssh-keygen)OpenSSH Keys PEM (.pem) keys usually generated with OpenSSL (Amazon ...
5
votes
2answers
4k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
1
vote
2answers
237 views

S/MIME verification

I am getting emails with smime.p7s attachments. when I look at my mail on my Linux box, I can see base64 encoded block in mail body. I can extract that block and open it on Windows using certmgr and ...
9
votes
1answer
5k views

Where is the salt on the OpenSSL AES encryption?

I'm interested in knowing how and where OpenSSL inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that I can use OpenSSL to decrypt ...
6
votes
1answer
924 views

OpenSSL fails NIST AES-128-ECB test vectors?

I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors. Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...
3
votes
1answer
309 views

Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?

Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
1
vote
2answers
165 views

Protecting passphrases within an application

First off, I'm not very familiar with encryption best-practices. My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...