# Tag Info

8

There's no real difference between $p$ and $q$ in RSA. It looks like OpenSSL just has the agreement "$p$ has to be bigger than $q$" for conveniences. One of the numbers has to be bigger than the other (otherwise they would be the same number, and $p = q$ is very bad in RSA). Just use two examples: $p = 13$ and $q = 11$. $p$ is bigger than $q$, all right. ...

6

In a better world, TLS_FALLBACK_SCSV would not be necessary: SSL has been supporting downgrade-proof version negotiation since at least SSL 3.0, so a man in the middle should never be able to limit a connection to a version older than the mutually supported maximum. However, out there are some broken servers that don't really support that kind of version ...

6

AEAD modes like GCM are authenticated encryption with associated data; this setting only affects the associated data half of that. The ciphertext itself is still authenticated. The associated data portion is there to provide contextual information for the authentication of the ciphertext. Usually this data is something that's outside of direct control of the ...

5

In the example you linked, the current time (specifically, a value representing the number of seconds elapsed since Jan 1, 1970 UTC) is used as the seed. If an attacker knows which year you generated your key, then that leaves only about 2^25 possible values for the seed --- and therefore only about 2^25 possible values for your key. At this point, he can ...

5

Before answering your questions: GCM is an authentication encryption mode of operation, it is composed by two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ...

4

Both curves have similar form and primes close to powers of two ($2^{192}-2^{64}-1$ and $2^{224} - 2^{96} + 1$), so you wouldn't expect large differences in performance – all things equal, P-224 might be anywhere from 30% to 60% slower due to the computational scaling of curve operations. However, in practice different implementations will have different ...

4

In 0.9.8 there is only PKCS5_PBKDF2_HMAC_SHA1. Sample C code: #include <openssl/evp.h> #include <openssl/sha.h> void PBKDF2_HMAC_SHA_1nat(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult) { unsigned int i; unsigned char digest[outputBytes]; PKCS5_PBKDF2_HMAC_SHA1(pass, ...

4

Well, it is certainly possible to generate an RSA public/private key pair like what you're asking about -- I don't know what the OpenSSL API allows you can do, but if you don't restrict yourself to that, well, it is certainly possible to craft such a keypair. You'll come up with a public key with an enormous exponent (and I wouldn't be shocked if not ...

4

Actually the authors used both OpenSSL 0.9.7 and 1.0.1; they detail the differences between the versions, what changed in the implementations, and what they can do from other VM. They refer to 0.9.7 because that was the version used by Bernstein in 2003 when he worked on cache-timing attacks on AES. This allows to highlight how much (or how little) the ...

3

No it is not less secure. GCM and a number of other authenticated modes typically let you specify optional data which is authenticated but not encrypted. That is all this is. So the code is making it explicit that there is no data that is only authenticated.

3

rand() is bad because it's not a random function - not even a mediocre one. Every library, operating system, yahoo with a keyboard, can write his own rand and get away with it. The purpose of rand is to give output that looks random enough to be used in non-critical applications, usually with an LCG. Once in a blue moon you might come across some library ...

3

First of all, I suggest you to try use as IV first 16 bytes of encrypted file. Because in general IV is the first block of ciphertext. But if that doesn't work, then – of course – you can decrypt all message except first block. Just use first block as IV, and start to decrypt from second block. That will work because CBC does not provide integrity, and ...

3

Encryption modes have lots of differences. Putting all of them in a table would be tricky. I would recommend you to do some work and read through the NIST documentation on Block cipher modes. If you are unsure and you don't have particular requirements, you could check if GCM mode is available. It is an authenticated mode that also provides the ...

3

Calculate $\phi(n) = (p-1) (q-1) = n - p - q + 1$. Then $d = e^{-1} \mod \phi(n)$. With OpenSSL, the code should look something like this (error checking omitted): BN_CTX *ctx = BN_ctx_new(); BIGNUM *d = BN_dup(n); BN_sub(d, d, p); BN_sub(d, d, q); BN_add_word(d, 1); BN_mod_inverse(d, e, n); BN_ctx_free(ctx); return d; The inverse calculation is less ...

3

PBKDF2 is designed for low-entropy passwords. Assuming your key is generated by a CSPRNG, then running it through PBKDF2 is redundant. I don't, however, believe it could be weaker than the original key.

3

Just compute the multiplicative inverse $k^{-1}$ of $k$ modulo the prime order $n$ of the base point $G$ (I used the typical notation for the domain parameters of the curve). This can efficiently be done using extended Euclid and should be available in any reasonable big integer library (typically something like modinverse). Thats it.

3

It looks like there's an error in the test vector. The text of Appendix B.1 states: P1 = “The quic” = 5468652071756663 ... which is incorrect. The hex encoding of The quic is actually 5468652071756963 (note the transposition of the i/69 to an f/66 in the encoding. e.g. encrypting the test vector as intended: $echo -n 'The quick brown fox jump' | ... 2 DH: OpenSSL commandline has three options for creating certs, but all of them either selfsign the cert or require a selfsigned CSR, and DH can't do either of those. OpenSSL library called from a program you write can construct an X509 object (cert) containing a DH publickey, subject and other attributes as you specify, signed by an RSA key corresponding to a ... 2 Why not using VeraCrypt http://en.wikipedia.org/wiki/VeraCrypt, which is a successor of the famous discontinuited TrueCrypt. VeraCrypt is open source, and was developped by M. Idrassi an crypto-expert, take a look at https://github.com/veracrypt/VeraCrypt . There was controversy about the TrueCrypt, mysterious stoping. VeraCrypt corrected some know flaws and ... 2 The -bf-ecb cipher is expanding the key to 128 bits by zero extending it. The output from -p is the telltale here:$ openssl enc -bf-ecb -e -in plaintext.txt -out ciphertext.txt -nosalt -K FFFFFFFFFFFFFFFF -p key=FFFFFFFFFFFFFFFF0000000000000000 Blowfish is defined for 32-448 bit keys, and it appears the OpenSSL implementation chose 128 bits as the size ...

1

Not a definite answer but too much for comments: That help msg shows that OpenSSL on OSX is an old version (<= 0.9.8) before GCM was added. (Probably =; 0.9.7 end-of-lifed around 2008. -salt has been the default since about 2004 so anyone who claims you need to specify it should be treated very skeptically.) You could add HMAC on top of AES-CBC ...

1

The "normal", unmodified RSA (called textbook RSA) is susceptible to some attacks. We need to change it slightly to avoid this problems. The question Definition of Textbook RSA and the Wikipedia lists some possible attacks. In practice a special padding algorithm is used, like the Optimal asymmetric encryption padding (OAEP). The documentation of the ...

1

the following command do what I want : openssl smime -in msg -pk7out -out msg.pk7 openssl asn1parse -in msg.pk7

1

I think that you're asking how to generate a timestamp response as defined in timestamp-protocol: RFC3161, with openssl to generate and sign the response using a PKCS#11 (HSM in your case) as a TSA signer. I think that there is no native way to use PKCS#11with openssl to do this. (maybe with some plugin like: opensc pkcs11 engine for openssl). If you take ...

1

I do not know why the OpenSSL implementation specifically does this. However, a branch-less (constant time) implementation of the RSA private key operation, might be slightly more efficient if the parameter $c = q^{-1} \bmod p$ is calculated for $p$ being the greatest prime of the two. Otherwise the value of $J_q = I^{d \bmod q-1} \bmod q$ has to be taken ...

1

While no SHA1 collisions have been found, there are some attacks: ~$2^{60}$ collision attack. Estimated to cost around \$1-2 million currently in the cloud. Possibly economical soon, especially with specialized hardware. Intractable preimage attacks like$2^{151}$against reduced round variant,$2^{159}$against full hash. (Cf.$2^{160}\$ brute force on any ...

1

I would use the Interactive Ruby (irb) command. bash> irb irb> require 'securerandom' => true irb> SecureRandom.base64(256/8) => "qOo64focYhXyCPH3z5zpKyhNqQmTgtAVIP4mgJFnjrM=" This will produce a cryptographically secure random bit sequence, encoded in base64. This one is 32 bytes or 256 bits long. If you prefer hex format, try this: ...

1

Yes, both the client and the server must have this mechanism enabled to get full protection from BEAST and similar attacks. In particular, if the client is a browser with scripting capabilities, it is the client side implementation that must send empty packets before each content packet. Enabling this feature server side only, just means that the server ...

Only top voted, non community-wiki answers of a minimum length are eligible