# Tag Info

## Hot answers tagged openssl

Accepted

### What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...

### AES256-GCM - can someone explain how to use it securely (ruby)

Before answering your questions: GCM is an authenticated encryption mode of operation, it is composed of two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It ...
• 6,369
Accepted

### Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
• 85.8k
Accepted

### How does TLS_FALLBACK_SCSV help?

In a better world, TLS_FALLBACK_SCSV would not be necessary: SSL has been supporting downgrade-proof version negotiation since at least SSL 3.0, so a man in the middle should never be able to limit a ...
• 1,758
Accepted

### Why do crypto tools display key components in such an unusual format?

As for the leading zero, I believe the tools are just displaying what's in the ASN.1 as is; the BER/DER encoding rules will insist on a leading 00 byte in some cases. Specifically, if you encode a ...
• 133k
Accepted

### How is OID 2a 86 48 86 f7 0d parsed as 1.2.840.113549?

The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type ...
• 125k
Accepted

### What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
• 85.8k

### Static DH/Static ECDH certificate using OpenSSL

DH: OpenSSL commandline has three options for creating certs, but all of them either selfsign the cert or require a selfsigned CSR, and DH can't do either of those. OpenSSL library called from a ...
• 5,525
Accepted

### Why is OpenSSL generated 256-bit AES key 64 characters in length?

The key is hexadecimal. So every two characters makes up one hexadecimal byte, which brings the length down to 32 actual bytes. There are 8 bits per bytes, so 8*32 = 256.
• 176
Accepted

### How much entropy do you need for a secure certificate generation?

The answer to "how much entropy" is always "128 bits". The tricky point is that the term "entropy" is very often misused. In general terms, the situation is the following: A computer is a ...
• 84.8k
Accepted

### Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously....
Accepted

### RSA Private Exponent Generation according to FIPS 186-4 in openssl v1

FIPS 186-4's $d_1=e^{-1}\bmod m_1$ with $m_1=\operatorname{lcm}(p-1,q-1)$, and OpenSSL's $d_2=e^{-1}\bmod m_2$ with $m_2=(p-1)(q-1)$, are different with probability $>1/2$ for random choice of $p$ ...
• 125k
Accepted

### Anatomy of an RSA private key

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...? Only the modulus really - the key size is identical to the modulus size by definition. The primes are commonly ...
• 85.8k

### What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
• 85.8k

### Calculate the RSA private exponent from the CRT parameters

Calculate $\phi(n) = (p-1) (q-1) = n - p - q + 1$. Then $d = e^{-1} \mod \phi(n)$. With OpenSSL, the code should look something like this (error checking omitted): ...
Accepted

### How to derive a symmetric key from ECDH shared secret?

The general idea to derive keys from (ephemeral) Diffie-Hellman key agreement is to use a KBKDF - a key based key derivation function. KBKDFs are mostly ill defined with regards to what security ...
• 85.8k

### Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...
• 84.8k
Accepted

### Is the openssl implementation of ECDH missing something?

There are two reasons: Reason one is that the ECDH shared secret is not equidistributed; not all values are possible. In particular, and $x$ that is not a possible solution to the elliptic curve ...
• 133k

### curve25519 by openSSL

Use the genpkey command: openssl genpkey -algorithm x25519 or, for edwards25519: ...
• 2,829
Accepted

### openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
• 1,573
Accepted

### In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

There's no real difference between $p$ and $q$ in RSA. It looks like OpenSSL just has the agreement "$p$ has to be bigger than $q$" for conveniences. One of the numbers has to be bigger than the other ...
• 3,820
Accepted

### How is SSL secure?

No, you can't; the reason you can't depends on the negotiated TLS ciphersuite: The original ciphersuites had the server send to the client the server's RSA public key; the client selects a random ...
• 133k
Accepted

### OpenSSL Signature different each time

It depends on what algorithm (determined by key type) and padding you use. If the key is a DSA key, or an ECC key used for ECDSA, those algorithms normally use randomized signatures to remain secure, ...
• 5,525
Accepted

### What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
• 125k

### Is it possible to decrypt the 2nd byte of AES-256-CFB-8 ciphertext without decrypting the 1st byte?

Yes, you can do this. If you want to know how to do it (as opposed to just blindly copying a code snipped written by someone else and hoping it'll work), you'll need to understand a little bit about ...
• 44.5k

### How does OpenSSL know if a decryption failed?

This code is very near the lines the error mentions for evp_enc.c (there may be some differences between different versions of OpenSSL): ...
• 85.8k
Accepted

### Do aes_256_gcm IVs just need to be unique for that key?

For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
• 84.8k
Accepted

### What is the difference between: ecdsap, ecdsak, and ecdsab in the output of "openssl speed"? What do the letters P/K/B refer to?

First: If you're looking for a signature scheme, forget all of those; I recommend Ed25519. It too uses elliptic curves, it's standardized in RFC 8032, and there are implementations widely available. ...