Hot answers tagged

206 votes
Accepted

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
20 votes
Accepted

Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
Maarten Bodewes's user avatar
  • 91.8k
16 votes
Accepted

Why do crypto tools display key components in such an unusual format?

As for the leading zero, I believe the tools are just displaying what's in the ASN.1 as is; the BER/DER encoding rules will insist on a leading 00 byte in some cases. Specifically, if you encode a ...
poncho's user avatar
  • 145k
14 votes
Accepted

What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
Maarten Bodewes's user avatar
  • 91.8k
12 votes
Accepted

Why is OpenSSL generated 256-bit AES key 64 characters in length?

The key is hexadecimal. So every two characters makes up one hexadecimal byte, which brings the length down to 32 actual bytes. There are 8 bits per bytes, so 8*32 = 256.
Austin Wile's user avatar
12 votes
Accepted

How much entropy do you need for a secure certificate generation?

The answer to "how much entropy" is always "128 bits". The tricky point is that the term "entropy" is very often misused. In general terms, the situation is the following: A computer is a ...
Thomas Pornin's user avatar
12 votes
Accepted

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously....
Squeamish Ossifrage's user avatar
10 votes
Accepted

Anatomy of an RSA private key

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...? Only the modulus really - the key size is identical to the modulus size by definition. The primes are commonly ...
Maarten Bodewes's user avatar
  • 91.8k
10 votes
Accepted

RSA Private Exponent Generation according to FIPS 186-4 in openssl v1

FIPS 186-4's $d_1=e^{-1}\bmod m_1$ with $m_1=\operatorname{lcm}(p-1,q-1)$, and OpenSSL's $d_2=e^{-1}\bmod m_2$ with $m_2=(p-1)(q-1)$, are different with probability $>1/2$ for random choice of $p$ ...
fgrieu's user avatar
  • 138k
10 votes

Does this RSA decryption scheme make sense?

You're right, normal RSA does not (and cannot) work like that. Most likely, your client either: is using RSA with an absurdly low (and insecure) key size, is not actually using RSA at all, or has ...
Ilmari Karonen's user avatar
10 votes

Theoretical Approaches to crack large files encrypted with AES

It sounds like you're decrypting the entire file. That's going to be slow. The easiest option is to just truncate the encrypted file, try the decryption and check if the result is a valid tar file ...
Richard Thiessen's user avatar
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
Maarten Bodewes's user avatar
  • 91.8k
8 votes
Accepted

OpenSSL Signature different each time

It depends on what algorithm (determined by key type) and padding you use. If the key is a DSA key, or an ECC key used for ECDSA, those algorithms normally use randomized signatures to remain secure, ...
dave_thompson_085's user avatar
8 votes

Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...
Thomas Pornin's user avatar
8 votes
Accepted

Is the openssl implementation of ECDH missing something?

There are two reasons: Reason one is that the ECDH shared secret is not equidistributed; not all values are possible. In particular, and $x$ that is not a possible solution to the elliptic curve ...
poncho's user avatar
  • 145k
8 votes

curve25519 by openSSL

Use the genpkey command: openssl genpkey -algorithm x25519 or, for edwards25519: ...
Frank Denis's user avatar
  • 2,925
8 votes
Accepted

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
Marc's user avatar
  • 1,583
7 votes
Accepted

How is SSL secure?

No, you can't; the reason you can't depends on the negotiated TLS ciphersuite: The original ciphersuites had the server send to the client the server's RSA public key; the client selects a random ...
poncho's user avatar
  • 145k
7 votes
Accepted

What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
fgrieu's user avatar
  • 138k
7 votes

Is it possible to decrypt the 2nd byte of AES-256-CFB-8 ciphertext without decrypting the 1st byte?

Yes, you can do this. If you want to know how to do it (as opposed to just blindly copying a code snipped written by someone else and hoping it'll work), you'll need to understand a little bit about ...
Ilmari Karonen's user avatar
7 votes

How does OpenSSL know if a decryption failed?

This code is very near the lines the error mentions for evp_enc.c (there may be some differences between different versions of OpenSSL): ...
Maarten Bodewes's user avatar
  • 91.8k
7 votes
Accepted

Do aes_256_gcm IVs just need to be unique for that key?

For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
Thomas Pornin's user avatar
7 votes
Accepted

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of "openssl speed"? What do the letters P/K/B refer to?

First: If you're looking for a signature scheme, forget all of those; I recommend Ed25519. It too uses elliptic curves, it's standardized in RFC 8032, and there are implementations widely available. ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Why does OpenSSL show 253 bits?

The order of the base point of Curve25519 is the a 253-bit integer $2^{252}+ 27742317777372353535851937790883648493$. Choosing as private key a random positive integer less than said order is a common ...
fgrieu's user avatar
  • 138k
7 votes

How does openssl signature verification work?

It depends on the type of key, and (thus) signature. If it is an RSA key, by default OpenSSL uses the original PKCS1 'block type 1' signature scheme, now retronymed RSASSA-PKCS1-v1_5 and currently ...
dave_thompson_085's user avatar
7 votes
Accepted

When do clients use TLS in PSK mode?

Pre-shared keys aren't used on the web. Using asymmetric cryptography and a public-key infrastructure has huge advantages: there's no need to exchange long-term secrets at any point, all the security ...
Gilles 'SO- stop being evil''s user avatar
7 votes

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

OpenSSL is not being dumb and there is a reason the keys have different OIDs, but it's unrelated to the key data — it's the key metadata. The metadata describes the key. Specifically, the ASN.1 type ...
datKiDfromNY's user avatar
7 votes
Accepted

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I do not know how they are related to each other. EtM, MtE and E&M are generic constructions that take pairs of schemes that satisfy weaker security notions (chosen-plaintext security and ...
SEJPM's user avatar
  • 45.7k
6 votes

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

1) If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically) a) why must I specify another hash algorithm? HMAC is not a hash algorithm. It's a MAC, a message ...
Maarten Bodewes's user avatar
  • 91.8k
6 votes

Is it secure to use hexadecimal data for IV instead of raw binary?

An initialization vector is, in fact, always binary. It's just random bits. So, if you choose to encode those bits as a hexadecimal string for ease of storage or transportation, that is fine. ...
Xander's user avatar
  • 387

Only top scored, non community-wiki answers of a minimum length are eligible