Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Hot answers tagged

3

This is implementation-dependent. The RFC says clearly that messages with the same content type MAY be put together into the same record but also that a single message might spread over multiple records. From RFC 5246 (TLS 1.2) section 6.2.1 Fragmentation: Client message boundaries are not preserved in the record layer (i.e., multiple client ...


1

The format of an encrypted record in TLS can depend on the protocol version and (part of) the ciphersuite selected. Even a null-encryption suite (which only exists through 1.2) still does MAC for message integrity (aka data authentication); for your example this is HMAC-SHA1. See rfc5246 6.2.3.1 (this one is the same in earlier versions); the record ...


1

You are using openssl primitives to put together an encrypt/sign chain. Doing so is only a tiny step above implementing your own cryptography. Instead of using openssl to sign and encrypt, consider using a well-established tool that is actually designed to do so securely. Here's an example of how you can use GnuPG (with symmetric encryption, but can be ...


1

I think I misunderstood the signature concept when trying to sign the aes key itself. I changed the script so as to sign the whole file to be encrypted before with the dgst tool: #!/bin/bash zip update.zip update/* #Hash and sign with the private key echo 'Signing...' openssl dgst -sha256 -sign private.pem -out update.zip.sha update.zip #Generate a random ...


1

Based on this comment you can encrypt at most 214 bytes using 2048 bits RSA key. When i run the same operation you did, i get the following: $ ls -lah total 44K drwxr-xr-x 3 my_user my_user 4.0K Sep 27 10:50 . drwxrwxrwt 20 root root 4.0K Sep 27 10:49 .. -rw-r--r-- 1 my_user my_user 658 Sep 27 10:49 pouet.sh -rw------- 1 my_user my_user 1....


Only top voted, non community-wiki answers of a minimum length are eligible