0

I used openssl recently and noticed that in the cipher list there is AES (what else ) and then I saw many rarely used ciphers like camellia and seed, then I saw stuff like rc4, rc2 ...

Why are insecure outdated ciphers so widely supported by openssl? Would it not be better to support libraries for stronger ciphers like twofish or the new GOST cipher?

In "ecparam" I even saw that many modern curves were missing.

Improve this question
5
  • What version of OpenSSL are you using?
    – Xiong Chiamiov
    Mar 26, 2017 at 16:46
  • 3
    Well, what's wrong with supporting old and broken ciphers as long as you don't recommend them? They might be useful for experiments, debugging, proof of concepts, etc. OpenSSL tools are multi-purpose.
    – Arminius
    Mar 26, 2017 at 16:49
  • I am using 1.0.1t
    – Richard R. Matthews
    Mar 26, 2017 at 18:20
  • 1.0.1 is no longer supported upstream, and upstream default configs haven't included any export (which includes RC2) for years. Upgrade your system.
    – dave_thompson_085
    Mar 27, 2017 at 4:45
  • ok thank you , I will update my system . I didn´t know that there is a newer version . I picked up cryptography as a hobby and just used the one which came with my distro .
    – Richard R. Matthews
    Mar 29, 2017 at 14:24

1 Answer 1

Reset to default
2

OpenSSL is an extremely widely used library. There are many legacy systems that only support old ciphers, and so the OpenSSL project is conservative in removing support for them, preferring to allow the user to configure allowed algorithms. This is in contrast to a library like NaCl, which is highly opinionated about algorithms.

As a side note, just because you have not heard of camellia does not make "no-name".

Improve this answer
1
  • well not no name , but It is a japanese cipher which still has a patent right ? Not many services use it
    – Richard R. Matthews
    Mar 26, 2017 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .