# Tag Info

9

First, your use of 'echo' gets you: ~ % echo 'Attack at dawn!!' | hexdump -C 00000000 41 74 74 61 63 6b 20 61 74 20 64 61 77 6e 21 21 |Attack at dawn!!| 00000010 0a |.| 00000011 Note that there are 17 bytes there, not 16. echo adds a newline character. To stop that, use the -n flag: ~ % echo -n 'Attack ...

8

There's no real difference between $p$ and $q$ in RSA. It looks like OpenSSL just has the agreement "$p$ has to be bigger than $q$" for conveniences. One of the numbers has to be bigger than the other (otherwise they would be the same number, and $p = q$ is very bad in RSA). Just use two examples: $p = 13$ and $q = 11$. $p$ is bigger than $q$, all right. ...

7

As long as you use a secure padding mode (i.e. -pkcs or -oaep, not -raw). The default padding mode for openssl rsautl is -pkcs (i.e. PKCS#1 v1.5), so you should be OK. That said, OAEP is recommended over PKCS#1 v1.5 padding, so you might want to use the -oaep switch.

6

For what it's worth, the OpenSSL developers have committed changes that improve this. I assume they will be in OpenSSL 1.0.2, but I don't know for sure. In any case, if you clone the git repo and compile the OpenSSL_1_0_2-stable branch (or master, I suppose), s_client will display the curve name: $OPENSSL_CONF=apps/openssl.cnf apps/openssl s_client -CApath ... 6 AEAD modes like GCM are authenticated encryption with associated data; this setting only affects the associated data half of that. The ciphertext itself is still authenticated. The associated data portion is there to provide contextual information for the authentication of the ciphertext. Usually this data is something that's outside of direct control of the ... 5 In the example you linked, the current time (specifically, a value representing the number of seconds elapsed since Jan 1, 1970 UTC) is used as the seed. If an attacker knows which year you generated your key, then that leaves only about 2^25 possible values for the seed --- and therefore only about 2^25 possible values for your key. At this point, he can ... 5 We need clear goals. The question asks for "plausible deniability" or "deniable encryption", and these terms needs a precise definition in a public-key context (implied by RSA). I assume that in addition to the IND-CPA and IND-CCA1 properties of a cipher, including hybrid (as implied by AES), it is desired that: One without the private key can't ... 5 Be aware that your solution will touch much more than cryptography. Your command shell, the account it runs on, the swap file, the whole machine falls under the purview of PCI DSS regulation and auditing. If you can avoid storing or even handling the number, so much the better. 5 The question is subjective in nature, and this comment is also subjective. It was too long to leave as an actual comment so I'm posting it as an answer, although it isn't really an answer, it's a comment. This is for posterity, I guess -- this thread is already high in Google searches. NaCl is probably the most widely respected library. It's authored by ... 5 You can make OpenSSL print out the handshake messages with the -msg parameter: openssl s_client -msg -connect myserver.net:443 Then look for the ServerKeyExchange message. Here is an example: <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange 0c 00 01 49 03 00 17 41 04 6b d8 6e 14 1c 9b 12 4d 58 29 20 e8 e2 1a 24 0d da 8f 38 1a 5d 85 ... 5 There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:$P = C^d \mod N$(or a slightly more complex version involving the CRT parameters) So, strictly speaking, OpenSSL doesn't have to insist on it. On the other hand, there are some protections against side channel attacks that involve the public ... 5 Before answering your questions: GCM is an authentication encryption mode of operation, it is composed by two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ... 4 The documentation says: All the block ciphers normally use PKCS#5 padding also known as standard block padding which is both informative, and slightly misleading. OpenSSL supports, by default, one stream cipher (RC4) and a variety of block ciphers (Blowfish, 3DES, AES...). The enc command (from the command-line tool) encrypts an input file into an ... 4 Actually the authors used both OpenSSL 0.9.7 and 1.0.1; they detail the differences between the versions, what changed in the implementations, and what they can do from other VM. They refer to 0.9.7 because that was the version used by Bernstein in 2003 when he worked on cache-timing attacks on AES. This allows to highlight how much (or how little) the ... 4 Well, it is certainly possible to generate an RSA public/private key pair like what you're asking about -- I don't know what the OpenSSL API allows you can do, but if you don't restrict yourself to that, well, it is certainly possible to craft such a keypair. You'll come up with a public key with an enormous exponent (and I wouldn't be shocked if not ... 3 No it is not less secure. GCM and a number of other authenticated modes typically let you specify optional data which is authenticated but not encrypted. That is all this is. So the code is making it explicit that there is no data that is only authenticated. 3 First off, using '-rand' is only seeding the OpenSSL RNG. It can be 1 byte or 1 TB. It's only used as a seed to get things started internally. Then, OpenSSL will use the systems entropy to actually generate the primes needed by RSA. Further, entropy is just a measure of unpredictability in a sequence, not an actual pool of stored bits. The larger the ... 3 PBKDF2 is designed for low-entropy passwords. Assuming your key is generated by a CSPRNG, then running it through PBKDF2 is redundant. I don't, however, believe it could be weaker than the original key. 3 In 0.9.8 there is only PKCS5_PBKDF2_HMAC_SHA1. Sample C code: #include <openssl/evp.h> #include <openssl/sha.h> void PBKDF2_HMAC_SHA_1nat(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult) { unsigned int i; unsigned char digest[outputBytes]; PKCS5_PBKDF2_HMAC_SHA1(pass, ... 3 rand() is bad because it's not a random function - not even a mediocre one. Every library, operating system, yahoo with a keyboard, can write his own rand and get away with it. The purpose of rand is to give output that looks random enough to be used in non-critical applications, usually with an LCG. Once in a blue moon you might come across some library ... 3 First of all, I suggest you to try use as IV first 16 bytes of encrypted file. Because in general IV is the first block of ciphertext. But if that doesn't work, then – of course – you can decrypt all message except first block. Just use first block as IV, and start to decrypt from second block. That will work because CBC does not provide integrity, and ... 3 The smallest safe prime you got from OpenSSL was 3221226167 = 0xC00002B7. The largest was 4294967087 = 0xFFFFFF2F. This makes me hypothesize that OpenSSL is setting the two high bits to one, and choosing the rest of the bits randomly. If that is accurate, that would explain the range of primes you did. As far as why you found many more safe primes in the ... 3 Given a SSL-enabled web site, the Qualys SSL tester will tell what ciphersuite would be negotiated by a bunch of different browsers if they connected to that web site. It will also tell you the list of ciphersuites supported by that server and the list of ciphersuites are supported by each of those major browsers. For example, here is the output for one ... 3 You can decrypt with the -nopad option and check the HEX output. Example piped command :$ echo "hi" | openssl enc -aes-128-cbc -e -K 1001001 -iv 0100110 | openssl enc -aes-128-cbc -d -nopad -K 1001001 -iv 0100110 | hd And output : 00000000 68 69 0a 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |hi..............| 00000010

3

Encryption modes have lots of differences. Putting all of them in a table would be tricky. I would recommend you to do some work and read through the NIST documentation on Block cipher modes. If you are unsure and you don't have particular requirements, you could check if GCM mode is available. It is an authenticated mode that also provides the ...

2

The public exponent of a RSA key is, nominally, an odd integer $e \geq 3$. Any such integer can be used with RSA, although not necessarily with any modulus $n$: $n$ and $e$ must be such that $e$ and $\phi(n)$ must be relatively prime to each other. This is why $e$ cannot be even: $\phi(n)$ is even, so it can never be prime to another even number. Apart from ...

2

Well, I think OpenSSL has documented this pretty well: If an alternative RAND_METHOD implementation is being used (either set directly or as provided by an ENGINE module), then it is entirely responsible for the generation and management of a cryptographically secure PRNG stream. The mechanisms described below relate solely to the software PRNG ...

2

Yes, P-256 generates 256 bit private keys (give or take a single bit). The confusion here is that this key is 256 bit effective (giving ~128 bit security) even if it starts with zero bits. So the private key is 256 bit even if the representation as a large integer can be smaller than the requested size. This simply means that the full key space is being ...

2

There is only one, it's declared in <openssl/evp.h>. This post from 2009 names it as yet to be documented, and this seems to be still true. It does have a man page on my Linux systems. BTW recent Mac OS X deprecates all of openssl for crypto use (use CommonCrypto instead).

1

I would use the Interactive Ruby (irb) command. bash> irb irb> require 'securerandom' => true irb> SecureRandom.base64(256/8) => "qOo64focYhXyCPH3z5zpKyhNqQmTgtAVIP4mgJFnjrM=" This will produce a cryptographically secure random bit sequence, encoded in base64. This one is 32 bytes or 256 bits long. If you prefer hex format, try this: ...

Only top voted, non community-wiki answers of a minimum length are eligible