3
votes
1answer
277 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
1
vote
3answers
104 views

What part of the CSR is hashed in order to create its signature?

I'd like to change the CSR before it is transferred to the CA without going through the CSR creation process again. To do that I need to know how to calculate the signature of the CSR after I modified ...
0
votes
1answer
58 views

Storing third party auth info; Is this secure?

I have a feature request to connect my PHP web-app to the users mail server. I have usually strayed away from this type of work as it will mean storing the users email passwords. My question: is it ...
3
votes
2answers
2k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
5
votes
2answers
6k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
1
vote
1answer
1k views

Parsing a PKCS7 detached signature hash

I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file. Which means there's a file ...