Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssl]

OpenSSL is an open source implementation of the SSL and TLS protocols. Questions about how to use the OpenSSL tools and libraries are usually better asked at Stack Overflow or Super User.

0
votes
0answers
36 views

Reward for anyone helping me with PHP / OpenPGP RSA implementation [on hold]

I am a coder and I am currently coding my own website for practice purpose. I've learnt PHP, css, html, sql and xml... but now I'm seriously bugging on the implementation of a basic thing. I want to ...
-3
votes
0answers
21 views

How to Accelerate Openssl Library using CUDA C [on hold]

How to accelerate openssl library on GPU for performing faster cryptography
1
vote
1answer
41 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
0
votes
0answers
6 views

Generating JWT RS256 signature with openssl [migrated]

I'm trying to sign a JWT token with the RS256 algorithm using openssl. Take the following example token: ...
0
votes
0answers
5 views

Load key “ec256.pem”: invalid format is thrown on trying to generate public key from private key [migrated]

I am trying to generate public/private key pair using ECDSA curve secp256k1 On generating public key from ec256.pem (private key) the following error is thrown "Load key "ec256.pem": invalid format" ...
2
votes
1answer
33 views

Length of password requirement using openssl aes-256-cbc

I am using the following OpenSSL command to AES 256 encrypt a file: ...
0
votes
0answers
7 views

getting decrypted message from RSA_public_decrypt? [migrated]

I signed/encrypted a message in buffer with RSA_sign(). When I decrypt the buffer with RSA_public_decrypt(), the returned value is a digest (X509_SIG) and is not the decrypted message. I want to ...
1
vote
2answers
79 views

Using Diffie-Hellman secret key to encrypt/decrypt data?

My end goal is to encrypt data with AES-128, send it to other process and decrypt it there. While using DH key exchange protocol. I have used DH to generate a 256 bytes shared secret, but I can't use ...
0
votes
2answers
115 views

Why does Laravel only support AES-256-CBC?

Modern Laravel uses OpenSSL to provide AES-256-CBC encryption along with a MAC. However, I was under the impression that this is not a particularly secure approach. Why does Laravel only support AES-...
1
vote
1answer
66 views

How to determine the fastest OpenSSL cryptographic algorithm

This question does have to do with cryptography, but not necessarily with encrypting meaningful data. This is my first post here, so if I'm going about this question incorrectly please let me know. ...
2
votes
1answer
273 views

How does openssl signature verification work?

I would like to know how openssl verifies a digital signature? I know that it uses this command to verify a signature: ...
0
votes
1answer
108 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
1
vote
1answer
60 views

openSSL and ECDSA key format inspection

If I run openssl ec on a key that I have generated with openssl ecparam -genkey I get one extra prefixing 0x00 in the private ...
3
votes
1answer
332 views

SSL - encrypt with private key and then with public key?

Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side ...
0
votes
1answer
33 views

How to check a signed CSR with openssl?

I just learned that a CSR can be signed. See this Why is a CSR signed and which key is used for signing? I tried to check the csr with below openssl command, but failed with errors "139942025398160:...
1
vote
1answer
56 views

Unable to reproduce correct signature data

"Skatteetaten" is the Norwegian tax authority. We're currently trying to implement signing of messages for digital cash registry systems and i'm not able to reproduce the desired signed data. Went ...
0
votes
1answer
36 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
2
votes
1answer
30 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
1
vote
1answer
128 views

Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL

I would like to simulate the CBC IV attack where the IV is predictable. It's described in the answer to this question: chosen plaintext attack on CBC, predictable iv (Only "Yes" and "No" are valid ...
2
votes
2answers
447 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
1
vote
0answers
223 views

Encrypt multiple files with OpenSSL securely [closed]

I wish to encrypt potentially gigabytes of data on my pc, and I wish to be able to decrypt and use those files. However, I am a noob, so bear with me. My idea is to use ...
2
votes
1answer
346 views

Decrypting AES256-CBC with wrong encryption key

Using OpenSSL library is there any chance that decrypting AES256-CBC encrypted data with wrong encryption key will succeed without an error? Asking this because I have read somewhere there is 1/256 ...
3
votes
3answers
825 views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
3
votes
1answer
794 views

Why can't decrypt with OpenSSL if salt changed (for CBC and ECB)

A file encrypted with OpenSSL (with, for example, AES 256-bit mode CBC) using the Linux command openssl enc -aes-256-cbc -in texte -out encrypted_texte -k password ...
1
vote
1answer
248 views

What is the encoding protocol for passphrase protected RSA private keys?

What is the protocol used to encode an RSA key protected with a passphrase? If I generate an RSA key with ssh-keygen -t rsa -b 4096 and do: ...
2
votes
1answer
408 views

Is this a good PHP encryption Strategy?

I'm writing a multi-tenant application that interacts with a couple of different APIs on behalf of each customer. Obviously, we need to store private keys for these various different APIs in the ...
2
votes
1answer
840 views
2
votes
1answer
380 views

X25519 - why openssl shows 253 bits?

When using ECDHE with Curve25519 with openssl: Server Temp Key: X25519, 253 bits I thought when we use X25519, it use 256 bit key. Why openssl shows the server temp key as 253 bits?
3
votes
0answers
79 views

How to see Diffie Hellman private key used during negotiation? [closed]

I used OpenSSL s_client to connect to a test server. Because OpenSSL generated client side private DH key, I think there will be a way to show the private key or ...
2
votes
1answer
538 views

The “openssl genrsa” command only generates a private key?

The command : openssl genrsa -out RootCA.key 4096 generates a single file named RootCA.key. When I open the file, it only contains the private key. Then ...
1
vote
1answer
121 views

Question about OpenSSL testing for FIPS 186-4 and using BN_generate_prime_ex

I am working on testing my implementation of OpenSSL using the CAVP 186-4 RSA Validation System (RSA2VS). There are tools under openssl-fips-2.0.16/test and I am working on modifying fips_rsagtest.c ...
1
vote
1answer
64 views

Question about using BN_rand() [closed]

I am working on a project and I'm noticing a peculiar behavior that I was hoping someone could tell me if it is correct or not. I have a program that is trying to generate some random numbers using ...
-1
votes
1answer
43 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
2
votes
1answer
39 views

Does the server signs message body after ssl handshake?

So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) ...
0
votes
1answer
147 views

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of “openssl speed”? What do the letters P/K/B refer to?

openssl speed tests the speed of different protocols on your computer: ...
1
vote
3answers
1k views

Differences between DSA and RSA Algorithms

Despite having learned much related to RSA and DSA, I cannot understand their differences. Can anyone tell me at least 4-5 differences between these algorithms? I have just used them for two-factor ...
1
vote
1answer
177 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The ...
0
votes
2answers
814 views

Appropriate key for AES 256 GCM

I am updating a system that has Rails' OpenSSL on one side and Python's cryptography.io on the other. The Rails side has to generate keys for the AES-256-GCM and here are two methods that appear to ...
2
votes
1answer
274 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
1
vote
0answers
39 views

Benefits of using SSL certificate over a raw key pair for non-browser use?

For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting ...
1
vote
1answer
1k views

symmetric AES encryption with php produces different result than openssl MacOX

I need to make a simple very basic encryption with AES 128 ECB mode. The idea is to generate a cryptogram, code it in base64 and then decipher that text from a web service in php to process its ...
1
vote
0answers
202 views

openssl command line equivalent of AESWrap? (defined in RFC3394; use in AmazonS3 Client Side Encryption of datakey wrapping) [closed]

when dealing with S3 Client Side Encryption, it's using "AESWrap" (defined in rfc3394) algorithm to encrypt the data-key; I'm trying to play with openssl command line to see if it's possible decrypt ...
0
votes
1answer
71 views

Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key: ...
2
votes
1answer
70 views

CAs are pre-loaded on the system, but how is it able to get intermediate certs?

I have the following X509 certificate: ...
0
votes
1answer
550 views

What is the Peer Signing digest on an OpenSSL s_client connection?

For a little background, I am trying resolve an issue with an ISAM (reverse proxy) appliance not being able to connect to a server due to it failing to complete a TLS connection. A server that is ...
0
votes
1answer
499 views

Discrepancy between 3DES in OpenSSL and PyDES [closed]

I'm trying to encrypt some data using triple DES ECB, but I get a discrepancy between OpenSSL and the pyDES library I'm using. When trying to get a KCV value, I'm using a file consisting of 8 bytes ...
0
votes
0answers
64 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
1answer
331 views

Best method to achieve authenticated encryption with openssl

Problem I want to send a plaintext document between from myself to someone else over an untrusted link. I want to firstly stop third parties from reading the document, I want the receiver to be able ...
0
votes
1answer
445 views

Which cipher to use with openssl for shortest output?

I'd like to encrypt my 12-24 words seed for my bitcoin wallet with openssl command line tool to be able to have it with me on paper without the risk that somebody could use it Which cipher should I ...
1
vote
1answer
205 views

How to select elements randomly from a multiplicative group Zn*

I am working on a problem in which I have two large safe primes say p and q randomly selected each of 512 bits. I have generated ...