OpenSSL is an open-source implementation of the SSL and TLS protocols.
0
votes
0answers
18 views
Openssl Encrypting, Decrypting doesn't work with DES [migrated]
I'm developing a simple application where there are a Client (C) and a Server (S).
Client gets text from std input, encrypts it, and sends it to the Server.
Since, I don't know if the text from user ...
4
votes
2answers
96 views
FIPS Compliance for my Android project
I am working on a security-related project and have to make sure it is FIPS 140-2 compliant.
According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
0
votes
2answers
52 views
Generating session CSRF token based on SSL session ID
Following situation:
Application is only accessible via HTTPS/SPDY
nginx is sending the SSL session ID to the upstream server
Upon session start I'd like to use the first 128 characters of that ...
0
votes
1answer
30 views
What is the difference between SSL and X.509 Certificates?
I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
5
votes
0answers
36 views
Force a subordinate CA cert to be signed to include a CRL so clients can more easily check for revocation of the subordinate CA cert?
How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows:
openssl req -new -key /root/ca/private/private.key -out /root/public.csr
I usually sign with:
...
8
votes
1answer
2k views
Wheres the salt on the openssl aes encryption?
Im interested in knowing how and where openssl inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that i can use openssl to decrypt them
...
-2
votes
1answer
59 views
How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL
I want to do an asymmetrical file encryption:
openssl genrsa -des3 -out private.key 4096
openssl rsa -in private.key -pubout -out public.key
openssl rsautl -encrypt -pubin -inkey public.key -in a ...
0
votes
0answers
41 views
how do I use a passphrase file with openssl pkeyutl -decrypt? [closed]
This is a question about pkeyutl, but I don't have enough reputation to make a new tag for it.
I want to encrypt and decrypt small files (specifically: passwords for AES256) using openssl's pkeyutl ...
-1
votes
0answers
70 views
AES 256 decryption where passphrase is a file [closed]
I got an assignment to decrypt a binary file which is encrypted using aes. I have 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using
...
2
votes
2answers
152 views
Decrypt from cipher text encrypted using RSA
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
4
votes
1answer
205 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
2
votes
1answer
198 views
Different performance of openssl speed on the same hardware with AES 256 (EVP and non EVP API)
If I run openssl 1.0.1e like this :
$ ./openssl speed aes-256-cbc (i.e without EVP API)
Doing aes-256 cbc for 3s on 16 size blocks: 14388425 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 64 size ...
3
votes
1answer
69 views
OpenSSL vs FIPS enabled OpenSSL
A deceptively simple question.
How does OpenSSL compare to FIPS enabled OpenSSL?
Is it any less secure? How do I tell?
If I were concerned about security, not the NIST standard, is there any real ...
1
vote
1answer
104 views
Is OpenSSL AES GCM standardized?
I have been reading about the perils of not going the pages of my own encrypt-then-mac implementation, because there so many things can go awry. So decided to use EVP_aes_256_gcm.
But some questions ...
0
votes
2answers
43 views
openssl EVP_aes_256_gcm - what's inside?
I have been reading about encrypting and authentication. Traveled the path from home made authentication to encrypt-then-mac approach and finally settled on GCM mode.
I am curious what resided inside ...
2
votes
3answers
308 views
openssl blowfish key limited to 256 bits?
I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits).
According to this official document, blowfish is able to support key from 32 to 448 bits.
...
4
votes
1answer
215 views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
1
vote
0answers
33 views
Using SSL on my sites for everything or just some things? [duplicate]
I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
1
vote
1answer
119 views
How to open a .txt.enc file?
I have a .txt.enc file. It is an output of openssl enc. I need to open it.
When I try to open it in Emacs, the first some characters(also known characters) are : 'Salted__C' .
how can I understand ...
2
votes
3answers
141 views
Could I delete .csr files when the key is signed by CA
I'm creating my own openvpn server.
The Certificat authority is located on a separated host.
There is two kind of clients: which that just send a .csr and to which i send the .crt as an answer and ...
2
votes
2answers
460 views
Converting keys between openssl and openssh
If I use the following
openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes
I get private.pem and public.pem
If I use
ssh-keygen -t rsa -f rsa
I get rsa and ...
2
votes
1answer
93 views
how to specify only the named curve in CSR request?
I am trying to send a CSR to a server and it is successfully signed when generated from the command line but fails with a (0 length ASN.1) error when generated programatically. I suspect, perhaps, its ...
2
votes
3answers
76 views
Are private keys generated by different software packages compatible?
I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
2
votes
1answer
184 views
How to set “Not Before” value to past when creating certificate request
We have lots of embedded TLS clients on the field. TLS Servers must be authenticated.
Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
3
votes
2answers
267 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
1
vote
1answer
146 views
What is the difference between `extendedKeyUsage` and an application policy?
In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like
Application policies are sometimes called extended key ...
0
votes
1answer
162 views
How configure tomcat 7 SSL to use AES-NI?
My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
0
votes
2answers
665 views
Why does OpenSSL not include AES-256-GCM? [closed]
I'm trying to implement AES-256-GCM in Ruby.
Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this.
However, neither 0.9.8r (which I had ...
2
votes
1answer
200 views
Which extensions to use for a S/MIME certificate?
Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well?
(I'm using openssl, which at the moment creates CA and ...
3
votes
2answers
173 views
What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?
I have learned there are 2 methods to make SSH remote login easier and secure , those are;
ssh generated keys (using ssh-keygen)OpenSSH Keys
PEM (.pem) keys usually generated with OpenSSL (Amazon ...
1
vote
2answers
476 views
Generating private key from hex string with openssl
Is there a quick way to take a set of numbers and encode it as a private key with openssl command line? Inventing the CLI interface
openssl genpkey -fromhex 'FFFFFFFFF' -algorithm RSA
edit: of ...
2
votes
1answer
200 views
Why does openssl writes EC parameters when generating private key?
When I'm generating a private key with openssl, it writes the curve's parameters, and the actual private key:
❯ openssl ecparam -name secp256k1 -genkey
-----BEGIN EC PARAMETERS-----
BgUrgQQACg==
...
4
votes
2answers
1k views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
3
votes
1answer
359 views
How to create an Apple Installer Package Signing Certificate
How can we create a certificate with the following Extended Key Usage extension using OpenSSL?
Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
4
votes
2answers
276 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
2
votes
3answers
337 views
Is OpenSSL secure enough?
We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.
It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
2
votes
4answers
327 views
Clients trust my custom CA
I'm sorry if this is a dumb question. I'm new to all this.
I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
2
votes
1answer
3k views
How do I create a valid email certificate for Outlook S/MIME with openssl?
I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
3
votes
1answer
52 views
Signing CertificateRequest with special privileges
Well, I am not sure if I specified the question correctly.
While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
0
votes
2answers
517 views
openssl, create RC4-SHA certificate
gmail.com Google, fb,... use RC4-SHA.
How does one create RC4-SHA self signed cert ?
Or even with aes128 key ?
I tried using using "genrsa -aes128", resulting cert was DHE-RSA-AES256-SHA
openssl ...
2
votes
1answer
205 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
0
votes
2answers
1k views
How to get private key from certificate and base 64 encoded key?
Sorry for the poor question. Suppose I have a certificate of the following lines:
-----BEGIN CERTIFICATE-----
//22 Lines of encoded junk
-----END CERTIFICATE-----
And then this base64 encoded ...
2
votes
0answers
278 views
Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2?
I have a private key in PEM format that was generated by OpenSSL FIPS Object Module v1.2 using a proprietary third party tool (that I cannot avoid using). This third party tool encrypted the private ...
1
vote
1answer
450 views
Parsing a PKCS7 detached signature hash
I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file.
Which means there's a file ...
5
votes
3answers
353 views
I don't see how “-salt” in the openssl command line tool enhances security at all
I do this to encrypt a single file:
openssl aes-256-cbc -a -salt -in file.txt -out file.enc
and then type in some regular plaintext password.
I do not understand how -salt enhances the security of ...
1
vote
0answers
132 views
Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]
I have installed openssl and now the rsa_test.c is running fine. What I want to do is:
Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey.
The public key contains the ...
1
vote
1answer
455 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
3
votes
1answer
446 views
openssl equivalent to des command line
I have a simple des command line:
des -D -k "whatever" file.enc file.dec
des is version des(1) built with libdes v 4.01 - 13-Jan-1997 - eay
I would like to use openssl (version OpenSSL 0.9.8a 11 ...
3
votes
1answer
155 views
Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?
Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
6
votes
1answer
515 views
OpenSSL fails NIST AES-128-ECB test vectors?
I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors.
Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...
