Hot answers tagged

187 votes
Accepted

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
52 votes

AES256-GCM - can someone explain how to use it securely (ruby)

Before answering your questions: GCM is an authenticated encryption mode of operation, it is composed of two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It ...
user avatar
  • 6,369
19 votes
Accepted

Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
user avatar
  • 85.8k
16 votes
Accepted

How does TLS_FALLBACK_SCSV help?

In a better world, TLS_FALLBACK_SCSV would not be necessary: SSL has been supporting downgrade-proof version negotiation since at least SSL 3.0, so a man in the middle should never be able to limit a ...
user avatar
  • 1,758
16 votes
Accepted

Why do crypto tools display key components in such an unusual format?

As for the leading zero, I believe the tools are just displaying what's in the ASN.1 as is; the BER/DER encoding rules will insist on a leading 00 byte in some cases. Specifically, if you encode a ...
user avatar
  • 133k
15 votes
Accepted

How is OID 2a 86 48 86 f7 0d parsed as 1.2.840.113549?

The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type ...
user avatar
  • 125k
13 votes
Accepted

What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
user avatar
  • 85.8k
12 votes

Static DH/Static ECDH certificate using OpenSSL

DH: OpenSSL commandline has three options for creating certs, but all of them either selfsign the cert or require a selfsigned CSR, and DH can't do either of those. OpenSSL library called from a ...
user avatar
12 votes
Accepted

Why is OpenSSL generated 256-bit AES key 64 characters in length?

The key is hexadecimal. So every two characters makes up one hexadecimal byte, which brings the length down to 32 actual bytes. There are 8 bits per bytes, so 8*32 = 256.
user avatar
12 votes
Accepted

How much entropy do you need for a secure certificate generation?

The answer to "how much entropy" is always "128 bits". The tricky point is that the term "entropy" is very often misused. In general terms, the situation is the following: A computer is a ...
user avatar
11 votes
Accepted

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously....
user avatar
10 votes
Accepted

RSA Private Exponent Generation according to FIPS 186-4 in openssl v1

FIPS 186-4's $d_1=e^{-1}\bmod m_1$ with $m_1=\operatorname{lcm}(p-1,q-1)$, and OpenSSL's $d_2=e^{-1}\bmod m_2$ with $m_2=(p-1)(q-1)$, are different with probability $>1/2$ for random choice of $p$ ...
user avatar
  • 125k
9 votes
Accepted

Anatomy of an RSA private key

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...? Only the modulus really - the key size is identical to the modulus size by definition. The primes are commonly ...
user avatar
  • 85.8k
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
user avatar
  • 85.8k
8 votes

Calculate the RSA private exponent from the CRT parameters

Calculate $\phi(n) = (p-1) (q-1) = n - p - q + 1$. Then $d = e^{-1} \mod \phi(n)$. With OpenSSL, the code should look something like this (error checking omitted): ...
user avatar
8 votes
Accepted

How to derive a symmetric key from ECDH shared secret?

The general idea to derive keys from (ephemeral) Diffie-Hellman key agreement is to use a KBKDF - a key based key derivation function. KBKDFs are mostly ill defined with regards to what security ...
user avatar
  • 85.8k
8 votes

Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...
user avatar
8 votes
Accepted

Is the openssl implementation of ECDH missing something?

There are two reasons: Reason one is that the ECDH shared secret is not equidistributed; not all values are possible. In particular, and $x$ that is not a possible solution to the elliptic curve ...
user avatar
  • 133k
8 votes

curve25519 by openSSL

Use the genpkey command: openssl genpkey -algorithm x25519 or, for edwards25519: ...
user avatar
  • 2,829
8 votes
Accepted

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
user avatar
  • 1,573
7 votes
Accepted

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

There's no real difference between $p$ and $q$ in RSA. It looks like OpenSSL just has the agreement "$p$ has to be bigger than $q$" for conveniences. One of the numbers has to be bigger than the other ...
user avatar
  • 3,820
7 votes
Accepted

How is SSL secure?

No, you can't; the reason you can't depends on the negotiated TLS ciphersuite: The original ciphersuites had the server send to the client the server's RSA public key; the client selects a random ...
user avatar
  • 133k
7 votes
Accepted

OpenSSL Signature different each time

It depends on what algorithm (determined by key type) and padding you use. If the key is a DSA key, or an ECC key used for ECDSA, those algorithms normally use randomized signatures to remain secure, ...
user avatar
7 votes
Accepted

What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
user avatar
  • 125k
7 votes

Is it possible to decrypt the 2nd byte of AES-256-CFB-8 ciphertext without decrypting the 1st byte?

Yes, you can do this. If you want to know how to do it (as opposed to just blindly copying a code snipped written by someone else and hoping it'll work), you'll need to understand a little bit about ...
user avatar
7 votes

How does OpenSSL know if a decryption failed?

This code is very near the lines the error mentions for evp_enc.c (there may be some differences between different versions of OpenSSL): ...
user avatar
  • 85.8k
7 votes
Accepted

Do aes_256_gcm IVs just need to be unique for that key?

For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
user avatar
7 votes
Accepted

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of "openssl speed"? What do the letters P/K/B refer to?

First: If you're looking for a signature scheme, forget all of those; I recommend Ed25519. It too uses elliptic curves, it's standardized in RFC 8032, and there are implementations widely available. ...
user avatar
7 votes

How does openssl signature verification work?

It depends on the type of key, and (thus) signature. If it is an RSA key, by default OpenSSL uses the original PKCS1 'block type 1' signature scheme, now retronymed RSASSA-PKCS1-v1_5 and currently ...
user avatar
7 votes
Accepted

When do clients use TLS in PSK mode?

Pre-shared keys aren't used on the web. Using asymmetric cryptography and a public-key infrastructure has huge advantages: there's no need to exchange long-term secrets at any point, all the security ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible