Hot answers tagged

14

The subject key identifier (SKID) is an x509 extension and thus actually part of the certificate. The fingerprint instead is not part of the certificate but instead computed from the certificate. A certificate does not need to have an SKID at all and can have at most one SKID. But since the fingerprint is just a computed from the certificate there can be ...


11

Do not use the OpenSSL command line to encrypt or sign anything. The OpenSSL command line is a debugging tool. To encrypt or sign a message, use a tool designed for this purpose, such as GPG. A private key file contains all the information needed to construct the public key. If you have a private key in a format that OpenSSL understands and you want to get ...


10

You can use !SHA1:!SHA256:!SHA384 to disable all CBC mode ciphers. There are some non-CBC false positives that will also be disabled (RC4, NULL), but you probably also want to disable them anyway. Note that while GCM and CHACHA20 ciphers have SHA* in their name, they're not disabled because they use their own MAC algorithm. The SHA* in their name is for the ...


10

The private key is used to decrypt, and to sign things. You don't use it to encrypt. You use the public key for that. But openssl genrsa will not generate the public key, only the private. To encrypt things, you must first generate the public key (so you have a keypair: private and public): openssl rsa -in yourdomain.key -outform PEM -pubout -out public.pem ...


9

Considering openssl processes a majority of the HTTPS traffic on the internet, I simply don't understand your question. Of course openssl is used in production. A lot. By everyone. All the time. The API is not nice, the certificate processing code is not nice, the CLI is not nice, the documentation is often wildly outdated. It is not easy to use, and it is ...


8

Assuming that echo $RANDOM returns good random value… It does not. $RANDOM in bash is implemented using a LCRNG with 32 bits of state and a 15-bit output.


5

The following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net. It is portable in the sense that we don't have to mess around with (or even know about) the location of the openssl.cnf file: openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \ -keyout example.key -out example.crt -subj '/CN=...


5

The openssl command line tools are notoriously bad. They weren't originally intended for use by end users, they're not documented that well, and many of the defaults are insecure. But I digress. Let's take a look at your first command cat Root-R3.pem cert.pem | openssl verify -verbose What verify is doing here is reading Root-R3.pem, noticing that it's ...


4

... md5sum has collision weaknesses, so assume that there is some security problem with that, Collision attacks are irrelevant here. All what matters is that the IV used is in no way predictable (i.e. no bias - all outputs have the same probability) and the same IV is not used with the same input. For more see How do poor-quality initialization vectors ...


4

The computed trust chain depends on the root certificates in the trust store and on the algorithm to compute the trust chain. In this specific case the server sends the following certificates: 0 ... CN=www.comodo.com 1 ... CN=COMODO RSA Extended Validation Secure Server CA 2 ... CN=COMODO RSA Certification Authority The issuer of [0] is [1], of [1] is [...


4

An HMAC is a very simple construction. You could have come up with it yourself, except that HMAC is standardised which means that a lot of people looked at it and found it to be resistant against attacks. Because of the simplicity, we can just dive into the details: hmac = hash( (key xor opad) + hash((key xor ipad) xor message) ) So it's just some ...


4

You might want to take a look at the RFC 2104: 2. Definition of HMAC The definition of HMAC requires a cryptographic hash function, which we denote by H, and a secret key K. We assume H to be a cryptographic hash function where data is hashed by iterating a basic compression function on blocks of data. We denote by B the byte-length of such blocks (...


4

SoftHSM does not do the same functions as OpenSSL. People aren’t “choosing” SoftHSM over OpenSSL, as they do different things. Note that SoftHSM can be linked with the OpenSSL libraries to implement the cryptography internally, meaning that at best its overall security can be no better than that of the OpenSSL libraries themselves. SoftHSM is also not ...


4

Signature Algorithm: ecdsa-with-SHA256 This is irrelevant for the choice of cipher. Public Key Algorithm: id-ecPublicKey Since this is an ECC key you can use all ciphers which use ECDSA for authentication or the TLS 1.3 ciphers which are not specific to the key algorithm. Similar with an RSA key you can use all ciphers which use RSA for authentication ...


4

You almost certainly have incompatible versions of OpenSSL on the two systems. Run openssl version to check. The reason for the failure is usually that the default message digest has changed between the two versions, with the older version using MD5 and the newer using SHA256. OpenSSL doesn't store the hash type in the output message and expects you to ...


4

First, you should know that a part of the answer to your question is an openssl bug report I've just filed. Both openssl cms -sign and openssl cms -verify only handle S/MIME content. They, by coincidence, can also process any text data (though there's no promise that this functionality will be kept in future releases), but they are not designed to sign or ...


4

It is not possible to specify a SAN in OpenSSL solely at the command line*. FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you: one_genkey A script for creating Certificate Signing Requests from the CLI, hiding the OpenSSL config file complexity. *Per dave_thompson_085's ...


3

A certificate has no record of when it was created, just the validity period, represented as a date (and time) for notBefore and notAfter; and either of them can be set to whatever you like (though there's not a well defined behavior of setting notAfter to a value less than notBefore, other than "not working").


3

Using AES and 4096 bit RSA would certainly help. At least openssl uses 3 key triple DES but that means both the triple DES and the RSA private key are stuck at a security strength of 112 bits. See https://keylength.com for information on key strengths. 112 bit is just enough but a bit too close for comfort; I'd sleep better with 128 bit security. openssl ...


3

openssl dhparam has a -check argument you can use. But the current version of openssl is incorrect and is too strict. As evidence, the DHE groups from RFC 7919 which are the only groups you can use for DHE with TLS 1.3 do not pass this check, even though they are safe to use. The "unsafe" group params are those generated by openssl dhparam -dsaparam. They ...


3

They will be requested if the client supports them and if they are enabled. Like you mentioned, for example, OpenSSL does not enable them by default. They don't seem to provide any justificative other than it's "rarely used". But consider that most desktop CPUs support instructions for accelerating GCM, making it probably faster than CCM.


3

Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export LD_PRELOAD=/path/to/libsslkeylog.so and SSLKEYLOGFILE=/tmp/your.keys. How to do so is dependent on the application. For systemd you could try systemctl edit ...


3

Integrity is what you are looking for. With integrity, the receiver can check that the message is valid. One can use Message Authentication Codes like EAX and GCM. Take care of the order of operations if you insist on this. Also, take care of proper padding if you are using RSA. For encryption PKCS#1.5 and RSA-OAEP and for signature RSA-PSS. Normally, we ...


3

This logic is in the configuration (i.e. openssl.cnf) only. There is likely something like countryName = match in it. It makes sense to have such policy for a company CA where the company is only in a single state (and such policy is often together with organizationName = match). But it does not make sense for a some globally acting CA which issues ...


3

First of all, you should not be using the CN attribute of certificates, but the SubjectAlternativeName attribute (also known as SAN). In fact, the fallback to CN if there's no SAN has been deprecated for some time now in browsers. Still, your question stands of which hostname to use in the SAN of your certificates. The main question here is which name will ...


2

I couldn't find a tool for the job, so I got my hands dirty and wrote a few by hand by reading through the OpenSSH source code and some online PEM/DER debuggers. I wrote it to convert between PKCS8, PKCS1 (RSA-only), SEC1 (ECDSA-only) and the "proprietary" OpenSSH format for RSA keys of any size and ECDSA P-256 and P-384. https://git.coolaj86.com/coolaj86/...


2

Firstly, it is possible to hold 192.168.0.0/24 in the SubjectAltName Field. However, this kind of certificate is not being trusted by any browser. I will give you an example: Here's a certificate issued from my own PKI. RSA-2048 Certificate -----BEGIN CERTIFICATE----- MIIFcDCCBFigAwIBAgIQHrEy1YnIzRfZZ/QkuWlcYDANBgkqhkiG9w0BAQsFADCB ...


2

the *25519 algos specify little-endian. I myself was taken aback by that, so I tried to figure out why. My understanding is that the point of Ed25519 and its relatives is to pick out of the wide space of possible curves and implementations a subset both efficient and resistant to a number of attacks. To that end, it specifies both calculation steps, ...


2

From RFC 5116 - An Interface and Algorithms for Authenticated Encryption: Authenticated encryptionBN00 is a form of encryption that, in addition to providing confidentiality for the plaintext that is encrypted, provides a way to check its integrity and authenticity. Authenticated Encryption with Associated Data, or AEADR02, adds the ability to ...


2

It seems (from some experimentation with browsers) that pulling the RootCert is not required The idea is that you ultimately (i.e. root) trust only a CA already known to be good (i.e. in the local trust store) and not just blindly trust any arbitrary CA certificate downloaded from the internet. Thus, pulling the root certificate from the internet is not ...


Only top voted, non community-wiki answers of a minimum length are eligible