Skip to main content
213 votes
Accepted

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
20 votes
Accepted

Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
Maarten Bodewes's user avatar
  • 93.2k
16 votes
Accepted

Why do crypto tools display key components in such an unusual format?

As for the leading zero, I believe the tools are just displaying what's in the ASN.1 as is; the BER/DER encoding rules will insist on a leading 00 byte in some cases. Specifically, if you encode a ...
poncho's user avatar
  • 148k
15 votes
Accepted

What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
Maarten Bodewes's user avatar
  • 93.2k
12 votes
Accepted

Why is OpenSSL generated 256-bit AES key 64 characters in length?

The key is hexadecimal. So every two characters makes up one hexadecimal byte, which brings the length down to 32 actual bytes. There are 8 bits per bytes, so 8*32 = 256.
Austin Wile's user avatar
12 votes
Accepted

How much entropy do you need for a secure certificate generation?

The answer to "how much entropy" is always "128 bits". The tricky point is that the term "entropy" is very often misused. In general terms, the situation is the following: A computer is a ...
Thomas Pornin's user avatar
12 votes
Accepted

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously....
Squeamish Ossifrage's user avatar
10 votes
Accepted

Anatomy of an RSA private key

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...? Only the modulus really - the key size is identical to the modulus size by definition. The primes are commonly ...
Maarten Bodewes's user avatar
  • 93.2k
10 votes
Accepted

RSA Private Exponent Generation according to FIPS 186-4 in openssl v1

FIPS 186-4's $d_1=e^{-1}\bmod m_1$ with $m_1=\operatorname{lcm}(p-1,q-1)$, and OpenSSL's $d_2=e^{-1}\bmod m_2$ with $m_2=(p-1)(q-1)$, are different with probability $>1/2$ for random choice of $p$ ...
fgrieu's user avatar
  • 142k
10 votes

Does this RSA decryption scheme make sense?

You're right, normal RSA does not (and cannot) work like that. Most likely, your client either: is using RSA with an absurdly low (and insecure) key size, is not actually using RSA at all, or has ...
Ilmari Karonen's user avatar
10 votes

Theoretical Approaches to crack large files encrypted with AES

It sounds like you're decrypting the entire file. That's going to be slow. The easiest option is to just truncate the encrypted file, try the decryption and check if the result is a valid tar file ...
Richard Thiessen's user avatar
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
Maarten Bodewes's user avatar
  • 93.2k
8 votes

Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...
Thomas Pornin's user avatar
8 votes
Accepted

Is the openssl implementation of ECDH missing something?

There are two reasons: Reason one is that the ECDH shared secret is not equidistributed; not all values are possible. In particular, and $x$ that is not a possible solution to the elliptic curve ...
poncho's user avatar
  • 148k
8 votes

curve25519 by openSSL

Use the genpkey command: openssl genpkey -algorithm x25519 or, for edwards25519: ...
Frank Denis's user avatar
  • 2,973
8 votes
Accepted

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
Marc's user avatar
  • 1,583
7 votes
Accepted

What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
fgrieu's user avatar
  • 142k
7 votes

Is it possible to decrypt the 2nd byte of AES-256-CFB-8 ciphertext without decrypting the 1st byte?

Yes, you can do this. If you want to know how to do it (as opposed to just blindly copying a code snipped written by someone else and hoping it'll work), you'll need to understand a little bit about ...
Ilmari Karonen's user avatar
7 votes

How does OpenSSL know if a decryption failed?

This code is very near the lines the error mentions for evp_enc.c (there may be some differences between different versions of OpenSSL): ...
Maarten Bodewes's user avatar
  • 93.2k
7 votes
Accepted

Do aes_256_gcm IVs just need to be unique for that key?

For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
Thomas Pornin's user avatar
7 votes
Accepted

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of "openssl speed"? What do the letters P/K/B refer to?

First: If you're looking for a signature scheme, forget all of those; I recommend Ed25519. It too uses elliptic curves, it's standardized in RFC 8032, and there are implementations widely available. ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Why does OpenSSL show 253 bits?

The order of the base point of Curve25519 is the a 253-bit integer $2^{252}+ 27742317777372353535851937790883648493$. Choosing as private key a random positive integer less than said order is a common ...
fgrieu's user avatar
  • 142k
7 votes

How does openssl signature verification work?

It depends on the type of key, and (thus) signature. If it is an RSA key, by default OpenSSL uses the original PKCS1 'block type 1' signature scheme, now retronymed RSASSA-PKCS1-v1_5 and currently ...
dave_thompson_085's user avatar
7 votes
Accepted

When do clients use TLS in PSK mode?

Pre-shared keys aren't used on the web. Using asymmetric cryptography and a public-key infrastructure has huge advantages: there's no need to exchange long-term secrets at any point, all the security ...
Gilles 'SO- stop being evil''s user avatar
7 votes

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

OpenSSL is not being dumb and there is a reason the keys have different OIDs, but it's unrelated to the key data — it's the key metadata. The metadata describes the key. Specifically, the ASN.1 type ...
datKiDfromNY's user avatar
7 votes
Accepted

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I do not know how they are related to each other. EtM, MtE and E&M are generic constructions that take pairs of schemes that satisfy weaker security notions (chosen-plaintext security and ...
SEJPM's user avatar
  • 46.1k
6 votes
Accepted

What are KDF parameters in OpenSSL command-line utility for `enc`?

OpenSSL uses EVP_BytesToKey, an algorithm proprietary to OpenSSL, with a salt and an iteration count set to 1. The algorithm is secure; the iteration count of 1 of ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes
Accepted

DSS security in comparison to ECDSA or RSA

As noted in comments, DSS strictly means the Digital Signature Standard, a document (FIPS 186) published by NIST, a part of the US government. The original version of FIPS 186 in 1994 defined (and was ...
dave_thompson_085's user avatar
6 votes
Accepted

ChaCha20-Poly1305 test vectors

For the complete picture, as was pointed out, you should use the final RFC, not drafts. There are two relevant RFC here: RFC 7539 describes the stream cipher ChaCha20, the MAC algorithm Poly1305, and ...
Thomas Pornin's user avatar
6 votes
Accepted

Why can't decrypt with OpenSSL if salt changed (for CBC and ECB)

In your command: openssl enc -aes-256-cbc -in texte -out encrypted_texte -k password a password is supplied, which will be used to derive the key and IV for ...
Changyu Dong's user avatar
  • 4,188

Only top scored, non community-wiki answers of a minimum length are eligible