So when genrating a private key / or key pair in OpenSSL ther is the -nodes tag to deactivate the encryption of the private key . i looked it up and It means "no DES" . So no DES is used . Why is DES used for encrypting such secret information even tho it is not considered secure any more and OpenSSL is one of the most widely used tools for generating rsa keys
Mostly because when the command was created DES was the thing, and "no des" meant "don't encrypt". Now the default is different:
$ openssl req -new -newkey rsa:1024 -keyout rsa.enc.p8 -out rsa.enc.p8.csr Generating a 1024 bit RSA private key ...................................++++++ ...........++++++ writing new private key to 'rsa.enc.p8' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: <snip /> $ openssl asn1parse -i -dump < rsa.enc.p8 0:d=0 hl=4 l= 710 cons: SEQUENCE 4:d=1 hl=2 l= 64 cons: SEQUENCE 6:d=2 hl=2 l= 9 prim: OBJECT :PBES2 17:d=2 hl=2 l= 51 cons: SEQUENCE 19:d=3 hl=2 l= 27 cons: SEQUENCE 21:d=4 hl=2 l= 9 prim: OBJECT :PBKDF2 32:d=4 hl=2 l= 14 cons: SEQUENCE 34:d=5 hl=2 l= 8 prim: OCTET STRING 0000 - e9 37 68 99 cb 9c 4f 10- .7h...O. 44:d=5 hl=2 l= 2 prim: INTEGER :0800 48:d=3 hl=2 l= 20 cons: SEQUENCE 50:d=4 hl=2 l= 8 prim: OBJECT :des-ede3-cbc 60:d=4 hl=2 l= 8 prim: OCTET STRING 0000 - 16 ad ce 41 47 e8 ba 85- ...AG... 70:d=1 hl=4 l= 640 prim: OCTET STRING <snip />
The algorithm that it actually used was des-ede3-cbc, aka 3DES-CBC. While AES has almost entirely supplanted 3DES, 3DES isn't considered insecure.
NIST SP 800-57 Revision 4, Table 2, says that 3DES has 112 bits of security, putting it on par with RSA 2048. Table 4 then says that 112 bits of security is good through 2030.