So when genrating a private key / or key pair in OpenSSL ther is the -nodes tag to deactivate the encryption of the private key . i looked it up and It means "no DES" . So no DES is used . Why is DES used for encrypting such secret information even tho it is not considered secure any more and OpenSSL is one of the most widely used tools for generating rsa keys


Mostly because when the command was created DES was the thing, and "no des" meant "don't encrypt". Now the default is different:

$ openssl req -new -newkey rsa:1024 -keyout rsa.enc.p8 -out rsa.enc.p8.csr
Generating a 1024 bit RSA private key
writing new private key to 'rsa.enc.p8'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
<snip />

$ openssl asn1parse -i -dump < rsa.enc.p8
    0:d=0  hl=4 l= 710 cons: SEQUENCE
    4:d=1  hl=2 l=  64 cons:  SEQUENCE
    6:d=2  hl=2 l=   9 prim:   OBJECT            :PBES2
   17:d=2  hl=2 l=  51 cons:   SEQUENCE
   19:d=3  hl=2 l=  27 cons:    SEQUENCE
   21:d=4  hl=2 l=   9 prim:     OBJECT            :PBKDF2
   32:d=4  hl=2 l=  14 cons:     SEQUENCE
   34:d=5  hl=2 l=   8 prim:      OCTET STRING
      0000 - e9 37 68 99 cb 9c 4f 10-                          .7h...O.
   44:d=5  hl=2 l=   2 prim:      INTEGER           :0800
   48:d=3  hl=2 l=  20 cons:    SEQUENCE
   50:d=4  hl=2 l=   8 prim:     OBJECT            :des-ede3-cbc
   60:d=4  hl=2 l=   8 prim:     OCTET STRING
      0000 - 16 ad ce 41 47 e8 ba 85-                          ...AG...
   70:d=1  hl=4 l= 640 prim:  OCTET STRING
<snip />

The algorithm that it actually used was des-ede3-cbc, aka 3DES-CBC. While AES has almost entirely supplanted 3DES, 3DES isn't considered insecure.

NIST SP 800-57 Revision 4, Table 2, says that 3DES has 112 bits of security, putting it on par with RSA 2048. Table 4 then says that 112 bits of security is good through 2030.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.