Re: How to configure DES ECB encryption without the "no padding" mode?
Hi Ali,
Thus wrote Ali Sydney (asyd...@k-state.edu):
> Thanks for the speedy response. I have been attempting to use the EVP
> interface, but the cipher text produced is wrong (and I am fairly new
> to this). As a simple test, I have hard-coded an 8 byte block for the
> key (in hexadecimal), and also an 8 byte block (also in hex) for the
> plaintext. Can you kindly take a look and provide feedback?
> int main()
> {
>EVP_CIPHER_CTX *ctx = (EVP_CIPHER_CTX*)malloc(sizeof(EVP_CIPHER_CTX));
>EVP_CIPHER_CTX_init(ctx);
>unsigned char key[]={0x01, 0x91, 0xd0, 0xad, 0x79, 0x4c, 0xae, 0x9b};
> //64-bit KEY
>unsigned char plaintext[]={0x61, 0x62, 0x63, 0x64, 0x61, 0x62, 0x63,
> 0x64}; //64-bit Plaintext to be encrypted
>int ret;
>ret = EVP_EncryptInit_ex(ctx, EVP_des_ecb(), NULL, key, NULL); //USE DES
> ECB mode
>assert(ret == 1);
>ret = EVP_CIPHER_CTX_set_padding(ctx, 0); //No padding
>assert(ret == 1);
>int val, num_bytes_in(8),num_bytes_out(8); //8 bytes of plaintext, 8 bytes
> of ciphertext
>unsigned char out[8]; //Store ciphertext in "out"
>val=EVP_EncryptUpdate(ctx, out, &num_bytes_out, plaintext, num_bytes_in );
> //Encrypt plaintext
> for (int i=0; i<8; i++) //Print ciphertext
> {
> printf("%02x",out[i]);
> }
> cout< }
EVP_EncryptFinal() is missing.
The attached example works ok for me
Best regards,
Martin
#include
#include
#include
#include
#include
#include
unsigned char K[] = { 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7 };
int main(void)
{
int ret;
EVP_CIPHER_CTX ctx;
char in[] = "abcdefgh";
int inl;
char out[500];
int outl;
char back[500];
int backl;
int tmp;
inl = strlen(in);
/* ATTENTION: the _ex routines require an initialized context, i.e.
* EVP_CIPHER_CTX_init() must be called before Init_ex,
* it's enough to do this once before encryption, no need to call it a
* second time before decryption */
EVP_CIPHER_CTX_init(&ctx);
/* - encryption - */
/* EVP_EncryptInit_ex() cleans up the context, it doesn't initialize it */
ret = EVP_EncryptInit_ex(&ctx, EVP_des_ecb(), NULL, K, NULL);
assert(ret == 1);
/* this must be called after EVP_EncryptInit() because EVP_EncryptInit()
* reinitialises the ctx !!!
* 0 turns padding off, i.e. the input string must be exactly N blocks */
ret = EVP_CIPHER_CTX_set_padding(&ctx, 0);
assert(ret == 1);
ret = EVP_EncryptUpdate(&ctx, out, &outl, in, inl);
assert(ret == 1);
assert(outl == inl);/* input must be exactly N blocks */
tmp = outl;
ret = EVP_EncryptFinal_ex(&ctx, &out[outl], &outl);
assert(ret == 1);
assert(outl == 0); /* no remaining incomplete blocks */
outl += tmp;
/* is this really necessary? -> it seems so*/
ret = EVP_CIPHER_CTX_cleanup(&ctx);
assert(ret == 1);
/* - decryption - */
/* EVP_DecryptInit_ex() cleans up the context, it doesn't initialize it
-> no need to call EVP_CIPHER_CTX_init(&ctx) here,
but padding setting must be renewed */
ret = EVP_DecryptInit_ex(&ctx, EVP_des_ecb(), NULL, K, NULL);
assert(ret == 1);
ret = EVP_CIPHER_CTX_set_padding(&ctx, 0);
assert(ret == 1);
/* out, outl == input data, back, backl == output data */
ret = EVP_DecryptUpdate(&ctx, back, &backl, out, outl);
assert(ret == 1);
assert(backl == outl); /* input to decryption must be exactly N blocks */
tmp = backl;
ret = EVP_DecryptFinal_ex(&ctx, &back[backl], &backl);
assert(ret == 1);
assert(backl == 0); /* no remaining incomplete blocks */
backl += tmp;
ret = EVP_CIPHER_CTX_cleanup(&ctx);
assert(ret == 1);
back[backl+1] = 0x0;
printf("%s\n", back);
return 0;
}
Re: Extracting RSA public key from private key
Thank you very much !
It worked ;)
Dr. Stephen Henson wrote:
On Sat, Apr 10, 2010, Julien Kauffmann wrote:
Hello,
I need to extract the RSA public key from a RSA private key using OpenSSL.
I'm currently using |RSAPublicKey_dup()| passing the |RSA*| private key to
get the public key. However, while the call seems to work, I cannot load
(or use) this public key using the openssl command-line tool.
If I generate the public key using the command-line tool ("|$ openssl rsa
-in private.pem -pubout > public.pem|"), I can use it and it works like a
charm.
Do you guys know how I can get this work ? Maybe another function ?
Thank you.
P.S: Here is the command line result when I try to use the generated public
key:
u...@computer:~$ openssl rsa -text -pubin -in public.pem -noout
unable to load Public Key
4379:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:647:Expecting: PUBLIC KEY
Use the functions with RSA_PUBKEY in the name to write out the key and not
RSAPublicKey.
Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: openLDAP with CRL
Hi there: One other thing to keep in mind is that the DN for the CRLDP *SHOULD* be the same as that for the CA that signs the CRL. I believe this is a "Best Practice", and not completely normative, but it is well enough enshrined (USFBCA CP and all cross-certified CA's, Canadian Govn't, etc.), that to be safe, if at all possible, you should follow this guidance. To answer your question, a simple way to do this is to create an LDIF file, which has : DN: Whatever you choose changetype: modify replace: certificateRevocationList;binary certificateRevocationList;binary:< file:///path/to/crl.der and then run it through ldapmodify from the command line. Oh - and the LDAP URL has to specify the ;binary as well...and the objectclass should be pkiCA, not certificateRevocationList. Have fun, Patrick. On 10/04/10 8:40 AM, Michael Ströder wrote: > shake kvc wrote: >> >> I want to be able to store CRLs in the openldap repository so that I can >> retrieve them using a LDAP client. >> >> Basically, the client would be given a LDAP URL as follows: >> >> ldap://xxx.yyy.com/CN=Challenger(1),CN=xxx,CN=C >> DP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=yyy,DC=com?certificateRevocationList?base?objectclass=cRLDistributionPoint >> >> The client would then open a LDAP request and search for the CRL. >> >> So I guess my problem would be to be able to store the CRL in cn=CDP, which >> belongs to cn=Public Key Services, which is in cn=Services, which is in >> cn=Configuration, which is in dc=yyy,dc=com. >> >> I have already installed openldap and created a suffix "dc=xxx,dc=com". >> >> However, I didn't see any manual to install/publish the CRL there. > > This is rather a LDAP-related question. You might want to ask on the > l...@umich.edu or the openldap-technical mailing list. The only thing which is > OpenSSL-specific is that the CRL has to be generated/converted with -outform > DER. > > Ciao, Michael. > __ > OpenSSL Project http://www.openssl.org > User Support Mailing Listopenssl-users@openssl.org > Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Extracting RSA public key from private key
On Sat, Apr 10, 2010, Julien Kauffmann wrote:
> Hello,
>
> I need to extract the RSA public key from a RSA private key using OpenSSL.
>
> I'm currently using |RSAPublicKey_dup()| passing the |RSA*| private key to
> get the public key. However, while the call seems to work, I cannot load
> (or use) this public key using the openssl command-line tool.
>
> If I generate the public key using the command-line tool ("|$ openssl rsa
> -in private.pem -pubout > public.pem|"), I can use it and it works like a
> charm.
>
> Do you guys know how I can get this work ? Maybe another function ?
>
> Thank you.
>
> P.S: Here is the command line result when I try to use the generated public
> key:
>
> u...@computer:~$ openssl rsa -text -pubin -in public.pem -noout
> unable to load Public Key
> 4379:error:0906D06C:PEM routines:PEM_read_bio:no start
> line:pem_lib.c:647:Expecting: PUBLIC KEY
>
Use the functions with RSA_PUBKEY in the name to write out the key and not
RSAPublicKey.
Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: Problems with DSA 2048-bit keys
On Sat, 10 Apr 2010 15:55:38 +0100 Sad Clouds wrote: > On the server side I set up a callback function for DH parameters: Could someone explain to me the relationship between DH parameters and DSA key lengths? For example, with larger keys, do I need to load larger DH parameters? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Problems with DSA 2048-bit keys
On Sat, 10 Apr 2010 15:55:38 +0100 Sad Clouds wrote: > I'm testing a very simple SSL web server. Everything seems to work OK > with RSA and DSA 1024-bit keys. > > I tried using DSA 2048-bit key and now I'm getting errors: Maybe it's just the Firefox issue, trying 'openssl s_clien ...' results in a negotiated SSL connection: New, TLSv1/SSLv3, Cipher is DHE-DSS-AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE ... GET / HTTP/1.1 HTTP/1.1 200 OK Content-type: text/plain Content-length: 25 Sat Apr 10 16:24:27 2010 __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Extracting RSA public key from private key
Hello,
I need to extract the RSA public key from a RSA private key using OpenSSL.
I'm currently using |RSAPublicKey_dup()| passing the |RSA*| private key
to get the public key. However, while the call seems to work, I cannot
load (or use) this public key using the openssl command-line tool.
If I generate the public key using the command-line tool ("|$ openssl
rsa -in private.pem -pubout > public.pem|"), I can use it and it works
like a charm.
Do you guys know how I can get this work ? Maybe another function ?
Thank you.
P.S: Here is the command line result when I try to use the generated
public key:
u...@computer:~$ openssl rsa -text -pubin -in public.pem -noout
unable to load Public Key
4379:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:647:Expecting: PUBLIC KEY
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: OpenSSL 0.9.8n released - it doesn't compile
This version also doesn't compile on both Suse and RedHat on the s390 z-series platform: gcc -I.. -I../.. -I../../include -DDSO_DLFCN -DHAVE_DLFCN_H -fPIC -mbackchain -DB_ENDIAN -DTERMIO -O1 -Wall -c -o md4_dgst.o md4_dgst.c md4_dgst.c: In function 'md4_block_data_order': md4_dgst.c:115: error: expected ':' or ')' before ';' token ... make[8]: *** [md4_dgst.o] Error 1 make[8]: Leaving directory 'openssl/single/64/openssl/crypto/md4' The cause here appears to be changes made in definitions of HOST_c2l in crypto\md32_common.h. http://cvs.openssl.org/chngview?cn=19506 is the fix. A. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Problems with DSA 2048-bit keys
I'm testing a very simple SSL web server. Everything seems to work OK
with RSA and DSA 1024-bit keys.
I tried using DSA 2048-bit key and now I'm getting errors:
# Generate DSA parameters
openssl dsaparam -out dsa_param.pem -outform PEM 2048
# Generate a certificate request
openssl req -newkey dsa:dsa_param.pem \
-keyout netcorp_privkey_dsa.pem -keyform PEM \
-out netcorp_req.pem -outform PEM
# Issue a certificate from a certificate request
openssl ca -in netcorp_req.pem
On the server side I set up a callback function for DH parameters:
DH *tmp_dh_callback(SSL *ssl, int is_export, int keylength)
{
printf("keylength = %d\n", keylength);
if(dh1024 == NULL || dh2048 == NULL)
init_dhparams();
switch(keylength)
{
case 1024:
return dh1024;
break;
case 2048:
return dh2048;
break;
default:
return dh1024;
}
}
Then when I use Firefox to connect to the server I get:
Thread starting
keylength = 1024
SSL_accept() error
error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error
Any ideas why I'm getting decrypt error with OpenSSL? Is this related
to the fact that the tmp_dh_callback() is passed 1024-bit key length,
even though the certificate was set up with a 2048-bit key? Why does
this happen?
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: openLDAP with CRL
shake kvc wrote: > > I want to be able to store CRLs in the openldap repository so that I can > retrieve them using a LDAP client. > > Basically, the client would be given a LDAP URL as follows: > > ldap://xxx.yyy.com/CN=Challenger(1),CN=xxx,CN=C > DP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=yyy,DC=com?certificateRevocationList?base?objectclass=cRLDistributionPoint > > The client would then open a LDAP request and search for the CRL. > > So I guess my problem would be to be able to store the CRL in cn=CDP, which > belongs to cn=Public Key Services, which is in cn=Services, which is in > cn=Configuration, which is in dc=yyy,dc=com. > > I have already installed openldap and created a suffix "dc=xxx,dc=com". > > However, I didn't see any manual to install/publish the CRL there. This is rather a LDAP-related question. You might want to ask on the l...@umich.edu or the openldap-technical mailing list. The only thing which is OpenSSL-specific is that the CRL has to be generated/converted with -outform DER. Ciao, Michael. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Openssl tarball SHA1 checksum
This is an openssl security meta-question. I notice that the tarballs also include a SHA1 digest. What's the point? 1 - If anyone has authority to update the tarball with a counterfeit, can't they also update the SHA1. 2 - The web site isn't protected by ssl (ironic). A MIM altering the tarball could similarly alter the SHA1. The FAQ implies that one should get the SHA1 from the main site and the tarball from a mirror. Is that the point? -- Ken Goldman kg...@watson.ibm.com 914-784-7646 (863-7646)
Decrypting the String using openssl
Hi All, I am new to the openssl. Well, let me explain you the problem what I am facing. Server will send a string which I need to decrypt it. Plane text is first encrypted using AES algorithm, then it is base64 converted and sent. I have to receive the string then do a base64 decode and then I have to decrypt to get the plane text. (I have the key with me for decryption) After receiving the string, I am able to do a base64 decode, but I am not able to decrypt the string. I tried using the code that are available on the net, but its not working. The server is using JAVA AESCypher for doing the encryption. Please let me know who to go ahead... Thanks in advance Nishith -- View this message in context: http://old.nabble.com/Decrypting-the-String-using-openssl-tp28200754p28200754.html Sent from the OpenSSL - User mailing list archive at Nabble.com. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
openLDAP with CRL
Hi, I want to be able to store CRLs in the openldap repository so that I can retrieve them using a LDAP client. Basically, the client would be given a LDAP URL as follows: ldap://xxx.yyy.com/CN=Challenger(1),CN=xxx,CN=C DP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=yyy,DC=com?certificateRevocationList?base?objectclass=cRLDistributionPoint The client would then open a LDAP request and search for the CRL. So I guess my problem would be to be able to store the CRL in cn=CDP, which belongs to cn=Public Key Services, which is in cn=Services, which is in cn=Configuration, which is in dc=yyy,dc=com. I have already installed openldap and created a suffix "dc=xxx,dc=com". However, I didn't see any manual to install/publish the CRL there. Any info is appreciated. thanks, Shekar. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
How to configure DES ECB encryption without the "no padding" mode?
All, I am attempting to implement DES (in C++ with the OpenSSL libraries) in ECB mode without padding. I am using the following function for encryption: void DES_ecb_encrypt(const_DES_cblock *input, DES_cblock *output, DES_key_schedule *ks, int enc); However, this function does not have any parameters to specify the "no padding" option. How do I configure "no padding"? Thank you. Best Regards, - Sydney __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Windows Binary Distribution
Hi, How do I get the windows binary distribution for the most recent release version 0.9.8.n or 1.0 ? Thanks, Jim OSD CAPE 703-601-4860 Ext. 105 james.a.williams@osd.mil
