# Tag Info

7

As long as you use a secure padding mode (i.e. -pkcs or -oaep, not -raw). The default padding mode for openssl rsautl is -pkcs (i.e. PKCS#1 v1.5), so you should be OK. That said, OAEP is recommended over PKCS#1 v1.5 padding, so you might want to use the -oaep switch.

5

The question is subjective in nature, and this comment is also subjective. It was too long to leave as an actual comment so I'm posting it as an answer, although it isn't really an answer, it's a comment. This is for posterity, I guess -- this thread is already high in Google searches. NaCl is probably the most widely respected library. It's authored by ...

5

There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just: $P = C^d \mod N$ (or a slightly more complex version involving the CRT parameters) So, strictly speaking, OpenSSL doesn't have to insist on it. On the other hand, there are some protections against side channel attacks that involve the public ...

4

Using the -k option, you can specify a password. Passwords are not really encryption keys, so OpenSSL uses a key derivation process to turn the password into an encryption key. It turns out by default OpenSSL uses a salt in that derivation process (which is why you see Salted in the output). If the salt changes, the encryption key changes. If the encryption ...

3

Yes, there are a number of TLS cipher suites that don't include any encryption. These cipher suites are not normally used by OpenSSL, but they can be explicitly requested e.g. using the -cipher option to the OpenSSL tools. Specifically, the suites offering no encryption and/or authetication are found under the NULL and aNULL cipher classes. The openssl ...

3

The documentation says: All the block ciphers normally use PKCS#5 padding also known as standard block padding which is both informative, and slightly misleading. OpenSSL supports, by default, one stream cipher (RC4) and a variety of block ciphers (Blowfish, 3DES, AES...). The enc command (from the command-line tool) encrypts an input file into an ...

2

The smallest safe prime you got from OpenSSL was 3221226167 = 0xC00002B7. The largest was 4294967087 = 0xFFFFFF2F. This makes me hypothesize that OpenSSL is setting the two high bits to one, and choosing the rest of the bits randomly. If that is accurate, that would explain the range of primes you did. As far as why you found many more safe primes in the ...

2

Given a SSL-enabled web site, the Qualys SSL tester will tell what ciphersuite would be negotiated by a bunch of different browsers if they connected to that web site. It will also tell you the list of ciphersuites supported by that server and the list of ciphersuites are supported by each of those major browsers. For example, here is the output for one ...

2

I recommend against using RAND_pseudo_bytes(). OpenSSL's CPRNG does not provide better pseudo-random numbers than /dev/urandom but it is much harder to use right. It has a couple of known flaws, for example it doesn't handle fork() very well. The standard PRNG is not very well designed, too. The FIPS mode PRNG is a bit better, though. /dev/urandom (Linux, ...

2

Here's a NodeJS AES-GCM module. Or alternatively, you can use the OpenSSL library to write your own GCM decryption code, here's a quick tutorial. The OpenSSL utility has historically not supported GCM encryption/decryption via command line parameters, likely due to the auth tag issue. I don't think that anything has changed since then, so you may want to ...

2

Well, I think OpenSSL has documented this pretty well: If an alternative RAND_METHOD implementation is being used (either set directly or as provided by an ENGINE module), then it is entirely responsible for the generation and management of a cryptographically secure PRNG stream. The mechanisms described below relate solely to the software PRNG ...

2

openssl rsautl expects a signature in binary format, not Base64-encoded. You should also check the signature scheme used. PKCS#1 v1.5 and PSS (PKCS#1 v2) are your best bets The -verify switch is a bit misleading, the command only outputs the decrypted hash. You have to compare with the expected hash yourself. Beware of the fact that the output will be the ...

2

The public exponent of a RSA key is, nominally, an odd integer $e \geq 3$. Any such integer can be used with RSA, although not necessarily with any modulus $n$: $n$ and $e$ must be such that $e$ and $\phi(n)$ must be relatively prime to each other. This is why $e$ cannot be even: $\phi(n)$ is even, so it can never be prime to another even number. Apart from ...

1

Yes, P-256 generates 256 bit private keys (give or take a single bit). The confusion here is that this key is 256 bit effective (giving ~128 bit security) even if it starts with zero bits. So the private key is 256 bit even if the representation as a large integer can be smaller than the requested size. This simply means that the full key space is being ...

1

You can make OpenSSL print out the handshake messages with the -msg parameter: openssl s_client -msg -connect myserver.net:443 Then look for the ServerKeyExchange message. Here is an example: <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange 0c 00 01 49 03 00 17 41 04 6b d8 6e 14 1c 9b 12 4d 58 29 20 e8 e2 1a 24 0d da 8f 38 1a 5d 85 ...

1

In my experience bouncycastle is the most stable (java and .net versions). But: Don't use built in libraries like CSP on Windows because you don't know what are doing (so you can't demonstrate anything at 100%) and in many cases they work using O.S. settings and limitations so the results may be unexpected. Use libraries with readable source code On the ...

1

You can decript with -nopad option and check hex. Example piped command : $echo "hi" | openssl enc -aes-128-cbc -e -K 1001001 -iv 0100110 | openssl enc -aes-128-cbc -d -nopad -K 1001001 -iv 0100110 | hd And output : 00000000 68 69 0a 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |hi..............| 00000010 1 No; you can theoretically use (almost) any$e$such that$1 < e < \varphi(n)$. There are some potential attacks on RSA with low exponents — see this question by fgrieu — so we tend to prefer larger exponents. As for why 65537 is an extremely common exponent: it has a lot of benefits while still being large. See this answer by fgrieu for ... 1 You should have specification of the format of the data you process. Else, you have to resort to trial and guessing. Which is easy here. In your test data, the public key$(n,e)$is ... 1 AES is a family of three pairs of functions that use essentially the same mechanisms with different tuning parameters: AES-128 encryption and decryption, AES-192 encryption and decryption, and AES-256 encryption and decryption. Each of these functions takes an$n$-bit key (where$n\$ is 128, 192 or 256 depending on whether the function is AES-128, AES-192 or ...

1

Important note: If you need something that provides some real security, it would be unwise to design it and implement it from basic building blocks like this. Instead, use software that has been built to a specification, thoroughly analyzed by experts, and thoroughly tested. If, on the other hand, you are interested in learning about cryptography, then read ...

1

AES is a block cipher, a cryptographic primitive. It has no involvement with key derivation or anything of that nature. The three standard key sizes are 128 bit, 192 bit, and 256 bit. How you get those keys is beyond the purview of AES, which is concerned only with encryption. As I said, it is a cryptographic primitive, meaning it is meant to be used in a ...

Only top voted, non community-wiki answers of a minimum length are eligible