Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Hot answers tagged

342

How about this one from XKCD? The most "non-technical" explanation I found.


266

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every implementation of SSL 3.0 suffers from it. Please note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is ...


248

This is not a flaw in TLS; it is a simple memory safety bug in OpenSSL. The best explanations I've run across so far are the blog posts Diagnosis of the OpenSSL Heartbleed Bug by Sean Cassidy and Attack of the week: OpenSSL Heartbleed by Matthew Green. In short, Heartbeat allows one endpoint to go "I'm sending you some data, echo it back to me". You send ...


239

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's public key, using PKCS#1 v1.5 padding (called "type 2"). ...


208

@paj28's comment covers the main point. OpenSSL is a shared library, so it executes in the same user-mode address space as the process using it. It can't see other process' memory at all; anything that suggested otherwise was wrong. However, the memory being used by OpenSSL - the stuff probably near the buffer that Heartbleed over-reads from - is full of ...


163

The analogy of the bank and bank employee You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. The roles in this ...


161

I'm going to have to use a few technical terms, but will try to keep them to a minimum and describe them. Basic Intro to TLS & Encryption You (a client) go to a website (known as a server) that uses encryption (the address starts with https://) to make it so no one but you and the website at the other end can know the content of the messages you are ...


155

OpenSSL s_client To check if you have disabled the SSLv3 support, then run the following openssl s_client -connect example.com:443 -ssl3 which should produce something like 3073927320:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1258:SSL alert number 40 3073927320:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl ...


118

Based on link from DarkLighting, here's the command I came up with using nested subshells. openssl req -new -sha256 \ -key domain.key \ -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \ -reqexts SAN \ -config <(cat /etc/ssl/openssl.cnf \ <(printf "\n[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) \ -out domain....


97

ssh-keygen -lf /etc/ssh/rsa_key.pub 2048 d1:cb:15:df:5d:44:... 2048 is the keylength


93

With openssl, if your private key is in file id_rsa, then: openssl rsa -text -noout -in id_rsa will print the private key contents, and the first line of output contains the modulus size in bits. If the key is protected by a passphrase you will have to type that passphrase, of course. If you only have the public key, then OpenSSL won't help directly. @...


88

You are misreading Bernstein and Lange's advice (admittedly, their presentation is a bit misleading, with the scary red "False" tags). What they mean is not that some curves are inherently unsafe, but that safe implementation of some curves is easier than for others (e.g. with regards to library behaviour when it encounters something which purports to be the ...


84

Usage of the openssl enc command-line option is described there. Below, I will answer your question, but don't forget to have a look at the last part of my text, where I take a look at what happens under the hood. It is instructive. OpenSSL uses a salted key derivation algorithm. The salt is a piece of random bytes generated when encrypting, stored in the ...


71

When computing DHPARAM you will get these as the output while computing Diffie Hellman parameters: . : A potential prime number was generated. + : Number is being tested for primality. * : A prime number was found. References: source code: dh_cb function in dhparam.c man page: dhparam


64

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


61

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just superseded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that could ...


55

Some background: Wireshark supports decryption of SSL sessions when the master secret can be calculated (which can be derived from a pre-master secret). For cipher suites using the RSA key exchange, the private RSA key can be used to decrypt the encrypted pre-master secret. For ephemeral Diffie-Hellman (DHE) cipher suites, the RSA private key is only used ...


50

Yes, clients are vulnerable to attack. The initial security notices indicated that a malicious server can use the Heartbleed vulnerability to compromise an affected client. Sources below (all emphasis is mine). Since then, proof of concept attacks have validated this position - it is utterly certain that clients running apps that use OpenSSL for TLS ...


49

I'm going to assume you have ssl.crt and ssl.key in your current directory. If you want to see what's in your certificate it's # openssl x509 -in ssl.crt -text -noout Two of the things in here will be the RSA public Key's Modulus and Exponent (in hex). If you want to see what's in your private key it's # openssl rsa -in ssl.key -text -noout Note the ...


48

Your admin got it real wrong (or there was some translation mishap). TLS 1.1 and 1.2 fix some issues in TLS 1.0 (namely, predictability of IV for CBC encryption of records). It is possible to work around this issue in TLS 1.0, but it depends on how hard the implementations work at it. So, in that sense, TLS 1.1 and 1.2 are more secure than TLS 1.0, since ...


47

SSL is by far the largest use of X.509 certificates, many people use the terms interchangeably. They're not the same however; a "SSL Certificate" is a X.509 Certificate with Extended Key Usage: Server Authentication (1.3.6.1.5.5.7.3.1). Other "common" types of X.509 certs are Client Authentication (1.3.6.1.5.5.7.3.2), Code Signing (1.3.6.1.5.5.7.3.3), and a ...


47

What happens for private key storage is a bit intricate because it involves several layers of underspecified crud accumulated over years and kept for backward compatibility. Let's unravel the mystery. For its cryptographic operations, including private key storage (that which we are presently interested in), OpenSSH relies on the OpenSSL library. So OpenSSH ...


44

The answer by Thomas is wonderful. There is just one thing that seems understated: e-mail servers are broken security-wise... by default and by design. default: just look at the default postfix configuration for instance (hint: SSLv2 and 40-56bit ciphers are still a thing, and "no encryption" too). by design: have you ever heard of the StartSSL wonder? Well,...


43

In really plain English: the attacker says they're sending a packet of size "x" and asks the server to send it back, but actually sends a much smaller packet. The OpenSSL library trusts the attacker, sends back the small real packet as the start of the reply, and then grabs data from memory to fill out the reply to the expected size. This could be any data ...


43

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit). The commit adds an example to the openssl req man page: Example of giving the most common attributes (subject and extensions) on the command line: openssl req -new -subj "/C=GB/CN=foo" \ ...


43

No, SSL uses a symmetric key so an attacker is unable to decrypt the message he has just captured. However, SSL is vulnerable to a traffic analysis attack. E.g. If you have 2 messages of very different lengths like "Execute order 66" "This is a very very very very very very very very very very very very very very very very very very very very long ...


42

Yes, your hosting provider is necessarily able to see your SSL private key, if the fancy takes him to do so. Because that SSL keys is used by his software running on his machines. (This still holds in the case of a hosted virtual machine -- in practice, a malicious host could simply take a snapshot of your running VM and analyse it at his leisure, and you ...


41

"SHA-2" is the traditional codename for a family of six functions that includes SHA-256 and SHA-512. These functions are considered completely fine and current and non-obsolete. There is a newer family of functions called SHA-3, but it has been formally defined only very recently, and nobody really supports them yet. Moreover, SHA-3 is not formally defined ...


41

The whole point of having a passphrase is to lock out anyone who does not know it. Allowing it to be recovered would defy the principle and allow hackers who get access to your certificate to recover your keys. So no, there is no such thing. What you should do is declare the keys as lost to the issuer so that they revoke your certificate. Then, you have to ...


40

Testing for primality is much easier than performing integer factorization. There are several ways to test for primality, such as the deterministic Sieve of Eratosthenes and the probabilistic Miller–Rabin primality tests. OpenSSL uses several tests to check for primality. First they subject the number to the deterministic checks, attempting division of the ...


Only top voted, non community-wiki answers of a minimum length are eligible