RE: Is it not possible to decrypt partial AES messages?
Christina Penn wrote: > Hello David, > Can you show me exactly how to break up my example code to make my example work? It's really simple. When you want to decrypt a message, call EVP_DecryptInit_ex. For each chunk of data you want to decrypt that is part of the message, call EVP_DecryptUpdate. For the last block (or after it), call EVP_DecryptFinal_ex. > I tried removing the EVP_DecryptFinal_ex from my DecryptMessage function and > just seeing if the first part would just decrypt the first 7 bytes, but it got > thrown into my catch statement. I am really confused. I'm not sure what you mean. That should have worked. (Note that zero bytes coming out *is* working. You are not guaranteed that any particular number of input bytes will produce any particular number of output bytes except that all of the input will, of course, produce all of the output. If you want a stream cipher, you know where to find them.) By the way, I strongly advise you not to use the C++ 'string' class for arbitrary chunks of bytes. It's really not suitable. DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Is it not possible to decrypt partial AES messages?
* Christina Penn wrote on Wed, May 05, 2010 at 07:42 -0400: >Can you show me exactly how to break up my example code to make my >example work? I tried removing the EVP_DecryptFinal_ex from my >DecryptMessage function and just seeing if the first part would just >decrypt the first 7 bytes, the algorithm works on lengths with (len % blocksize) == 0, i.e. on lengths that are multiples of blocksize, for AES-128 that are 16 byte (or 32, 48...). Note that the blocksize of AES-128 is 128 bits (16 byte), but your `int blockSize=128;' is used as 128 bytes, which at least is confusing. Also, note not to use `std::string message' for encrypted binary data because it may contain binary zeros (also note malloc() can fail etc, casts are ugly and C-casts in C++ are worse, etc, SCNR :)). >but it got thrown into my catch statement. >I am really confused. (I'm also confused, because there is no `throw' anywhere...) oki, Steffen About Ingenico: Ingenico is a leading provider of payment solutions, with over 15 million terminals deployed in more than 125 countries. Its 2,850 employees worldwide support retailers, banks and service providers to optimize and secure their electronic payments solutions, develop their offer of services and increase their point of sales revenue. More information on http://www.ingenico.com/. This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation. P Please consider the environment before printing this e-mail __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Cipher Block Chaining
Hello, Yes I did try that and that was what happened, I have attached a jpg that also shows it if your curious about the graphic. My understanding however is that CBC should be able to recover from lost data (not just a few bad bytes or bits) - if the data is lost the decryption algorithm would have no a priori knowledge and therefore be lost and I wouldn't know where to pad it on the other end. Can you give me a bit more on the alignment - how and why does the alignment occur? Thanks - I appreciate the help, Anthony - Original Message - From: "Phillip Hellewell" To: openssl-users@openssl.org Sent: Wednesday, May 5, 2010 10:07:53 AM GMT -05:00 US/Canada Eastern Subject: Re: Cipher Block Chaining On Wed, May 5, 2010 at 7:07 AM, Anthony Gabrielson wrote: > works. So I'm curious whats going on - ism y understanding of CBC mistaken? You need to keep things aligned for it to work properly. Try replacing the first 7 bytes with 0 rather than removing them and shifting everything over. You should only lose the first block and part of the second if I am not mistaken. Phillip __ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org <>
Re: convert xml cert to cer or pfx format
Oh, nice to know it. But if is that he is talking about, then he can't convert this to x509 certificates. Not without re-signing it. He may generate a new x509 certificate to the same key pair, but without more details, it is hard to tell if this is an option. 2010/5/5 Mark H. Wood > On Wed, May 05, 2010 at 06:48:23AM -0300, Cristian Thiago Moecke wrote: > > XML certificate? Are you sure that it is a certificate? Never heard about > > such thing. > > That could refer to one or more of the Recommendations at: > > http://www.w3.org/standards/xml/security > > > Probably this XML is not *a* certificate, but *maybe* it *contains* a > > certificate. > > That would seem to be consistent with my brief look at the above. For > example: > > http://www.w3.org/TR/2005/REC-xkms2-20050628/#XKMS_2_0_Section_4_1_1 > > If the OP would tell us the namespace and type of the element > containing the certificate, that might help. > > -- > Mark H. Wood, Lead System Programmer mw...@iupui.edu > Balance your desire for bells and whistles with the reality that only a > little more than 2 percent of world population has broadband. >-- Ledford and Tyler, _Google Analytics 2.0_ >
Re: Cipher Block Chaining
On Wed, May 5, 2010 at 7:07 AM, Anthony Gabrielson wrote: > works. So I'm curious whats going on - ism y understanding of CBC mistaken? You need to keep things aligned for it to work properly. Try replacing the first 7 bytes with 0 rather than removing them and shifting everything over. You should only lose the first block and part of the second if I am not mistaken. Phillip __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: convert xml cert to cer or pfx format
On Wed, May 05, 2010 at 06:48:23AM -0300, Cristian Thiago Moecke wrote: > XML certificate? Are you sure that it is a certificate? Never heard about > such thing. That could refer to one or more of the Recommendations at: http://www.w3.org/standards/xml/security > Probably this XML is not *a* certificate, but *maybe* it *contains* a > certificate. That would seem to be consistent with my brief look at the above. For example: http://www.w3.org/TR/2005/REC-xkms2-20050628/#XKMS_2_0_Section_4_1_1 If the OP would tell us the namespace and type of the element containing the certificate, that might help. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Balance your desire for bells and whistles with the reality that only a little more than 2 percent of world population has broadband. -- Ledford and Tyler, _Google Analytics 2.0_ pgpWMvJc1KSb0.pgp Description: PGP signature
Re: Is it not possible to decrypt partial AES messages?
On Wed, May 05, 2010, Christina Penn wrote: > Hello David, > > Can you show me exactly how to break up my example code to make my example > work? I tried removing the EVP_DecryptFinal_ex from my DecryptMessage > function and just seeing if the first part would just decrypt the first 7 > bytes, but it got thrown into my catch statement. I am really confused. > In that mode (CBC) you can decrypt partial messages but only in multiples of the block size: 16 bytes for AES. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Is it not possible to decrypt partial AES messages?
Hello David, Can you show me exactly how to break up my example code to make my example work? I tried removing the EVP_DecryptFinal_ex from my DecryptMessage function and just seeing if the first part would just decrypt the first 7 bytes, but it got thrown into my catch statement. I am really confused. Thanks, Christina Penn On Tue, May 4, 2010 at 6:42 PM, David Schwartz wrote: > > Christina Penn wrote: > > > Here is some example code of me trying to decrypt a partial AES message. > > It doesn't work.. is there a way I can do something like this? It only > works > > if I call DecryptMessage() with the entire encrypted string. Why? > > Your DecryptMessage function is specifically designed to require the entire > encrypted string: > >if(!EVP_DecryptFinal_ex(&deCTX, plaintext+p_len, &f_len)) >cerr << "ERROR in EVP_DecryptFinal_ex" << endl; > > See how it calls EVP_DecryptFinal_ex? > > As EVP_DecryptInit should only be called at the very start to initialize a > message, so EVP_DecryptFinal_ex should only be called at the very end to > finish a complete message. In the middle, you should only be using > EVP_DecryptUpdate. > > DS > > __ > OpenSSL Project http://www.openssl.org > User Support Mailing Listopenssl-users@openssl.org > Automated List Manager majord...@openssl.org >
Re: convert xml cert to cer or pfx format
XML certificate? Are you sure that it is a certificate? Never heard about such thing. OpenSSL works with x509v3 certificate. There is no such thing as .pfx or .cer certificate formats, they are x509 format certificates, that may be encoded on PEM or DER format. This certificates can be put into packages, like PKCS#7 or PKCS#12 (if im not wrong, pfx is PKCS#12), but then you have not a certificate anymore, you have a *package* that *contains* a certificate. Probably this XML is not *a* certificate, but *maybe* it *contains* a certificate. Or maybe you are not talking about x509 certificates. We will need more info, maybe you can provide the contents of the XML. Att, Cristian 2010/5/4 Chris Kordish > Hi, > > I need to convert an XML certificate meant for a Windows system ( which I > unpacked from a CAB file) into something I can use on a Linux-like > SmartPhone like *.cer or *.pfx format. Is there anyway to use openssl (or > any other tool) to convert from one format to the other ? > thanks > -- > Chris Kordish >
Problem building openssl-1.0.0 with Visual Studio 8
Hello all, I'm having trouble building openssl-1.0.0 with the visual studio 8 compiler. I'm following the 'Visual C++' section in INSTALL.W32 almost without exception: $ perl Configure VC-WIN32 $ ms\do_nasm.bat $ sed -e "/^CFLAG/ s/\\/MD/\\/MT/" ms\nt.mak > ms\nt.tmp $ mv ms\nt.tmp ms\nt.mak $ nmake -f ms\nt.mak The result is as follows: link /nologo /subsystem:console /opt:ref /out:out32\md4test.exe @.\nm3.tmp libeay32.lib(x86cpuid.obj) : error LNK2005: _OPENSSL_ia32cap_P already defined in libeay32.lib(cryptlib.obj) libeay32.lib(bn-586.obj) : error LNK2005: _OPENSSL_ia32cap_P already defined in libeay32.lib(cryptlib.obj) libeay32.lib(x86-mont.obj) : error LNK2005: _OPENSSL_ia32cap_P already defined in libeay32.lib(cryptlib.obj) libeay32.lib(sha512-586.obj) : error LNK2005: _OPENSSL_ia32cap_P already defined in libeay32.lib(cryptlib.obj) libeay32.lib(aes-586.obj) : error LNK2005: _OPENSSL_ia32cap_P already defined in libeay32.lib(cryptlib.obj) out32\md4test.exe : fatal error LNK1169: one or more multiply defined symbols found NMAKE : fatal error U1077: '"C:\Program Files\Microsoft Visual Studio 8\VC\BIN\link.EXE"' : return code '0x491' The same problems are not experienced when building openssl-0.9.8n. Thank you very much for any insight, Johan. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
crash
Hi, i am running an application in mac os libcurl/7.19.4 OpenSSL/0.9.7l zlib/1.2.3 c-ares/1.7.0 i got a crash when left idle Thread 3 Crashed: 0 libcrypto.0.9.7.dylib 0x00873b13 sha1_block_data_order + 1224 1 libcrypto.0.9.7.dylib 0x00863346 SHA1_Update + 569 2 libcrypto.0.9.7.dylib 0x008670e1 ssleay_rand_bytes + 841 3 libcrypto.0.9.7.dylib 0x008d7141 RSA_padding_add_PKCS1_type_2 + 107 4 libcrypto.0.9.7.dylib 0x008d628c RSA_eay_public_encrypt + 412 5 libssl.0.9.7.dylib 0x00832065 ssl3_send_client_key_exchange + 267 6 libssl.0.9.7.dylib 0x0083388d ssl3_connect + 4718 7 libssl.0.9.7.dylib 0x00839c02 ssl23_connect + 2670 8 libcurl.4.dylib 0x00795991 ossl_connect_common + 209 9 libcurl.4.dylib 0x00796a4d Curl_ossl_connect + 29 10 libcurl.4.dylib 0x007a8985 Curl_ssl_connect + 53 11 libcurl.4.dylib 0x00785f25 Curl_http_connect + 165 12 libcurl.4.dylib 0x0078f4bb Curl_protocol_connect + 107 13 libcurl.4.dylib 0x00791c0f setup_conn + 687 14 libcurl.4.dylib 0x00791d4e Curl_connect + 110 15 libcurl.4.dylib 0x0079e639 Curl_perform + 153 16 com.polycom.CMADesktop 0x003f430f 0x1000 + 4141839 17 com.polycom.CMADesktop 0x003f4fd1 0x1000 + 4145105 18 com.polycom.CMADesktop 0x003efeb2 0x1000 + 4124338 19 com.apple.CoreFoundation0x91396aad __invoking___ + 29 20 com.apple.CoreFoundation0x91396a18 -[NSInvocation invoke] + 136 21 com.polycom.CMADesktop 0x003ee6b6 0x1000 + 4118198 22 com.apple.Foundation0x95c0ade5 __NSThreadPerformPerform + 506 23 com.apple.CoreFoundation0x9135c15b __CFRunLoopDoSources0 + 1563 24 com.apple.CoreFoundation0x91359c1f __CFRunLoopRun + 1071 25 com.apple.CoreFoundation0x913590f4 CFRunLoopRunSpecific + 452 26 com.apple.CoreFoundation0x91358f21 CFRunLoopRunInMode + 97 27 com.polycom.CMADesktop 0x003ef8e8 0x1000 + 4122856 28 com.apple.Foundation0x95bf48dc -[NSThread main] + 45 29 com.apple.Foundation0x95bf488c __NSThread__main__ + 1499 30 libSystem.B.dylib 0x94755a19 _pthread_start + 345 31 libSystem.B.dylib 0x9475589e thread_start + 34 Is this crash already addressed??? Plz help to solve this Thanks smitha
convert xml cert to cer or pfx format
Hi, I need to convert an XML certificate meant for a Windows system ( which I unpacked from a CAB file) into something I can use on a Linux-like SmartPhone like *.cer or *.pfx format. Is there anyway to use openssl (or any other tool) to convert from one format to the other ? thanks -- Chris Kordish
is it not possible to decrypt partial AES messages?
Hello,
Here is some example code of me trying to decrypt a partial AES message. It
doesn't work.. is there a way I can do something like this? It only works if
I call DecryptMessage() with the entire encrypted string. Why?
Thanks!!
#include
#include
#include
using namespace std;
#pragma comment (lib, "libeay32MDd.lib")
EVP_CIPHER_CTX enCTX, deCTX;
int blockSize=128;
string DecryptMessage(const string message)
{
try
{
int p_len = message.length(), f_len = 0;
unsigned char* plaintext = (unsigned char*)malloc(p_len);
if(!EVP_DecryptInit_ex(&deCTX, NULL, NULL, NULL, NULL))
cerr << "ERROR in EVP_DecryptInit_ex" << endl;
if(!EVP_DecryptUpdate(&deCTX, plaintext, &p_len, (unsigned
char*)message.data(),
message.length()))
cerr << "ERROR in EVP_DecryptUpdate" << endl;
if(!EVP_DecryptFinal_ex(&deCTX, plaintext+p_len, &f_len))
cerr << "ERROR in EVP_DecryptFinal_ex" << endl;
return string((char*)plaintext, p_len + f_len-1);
}
catch(...)
{
return message;
}
}
string EncryptMessage(const string message)
{
try
{
// max ciphertext len for a n bytes of plaintext is n +
AES_BLOCK_SIZE bytes
int c_len = message.length() + blockSize;
unsigned char *ciphertext = (unsigned char*)malloc(c_len);
if(!EVP_EncryptInit_ex(&enCTX, NULL, NULL, NULL, NULL))
cerr << "ERROR in EVP_EncryptInit_ex" << endl;
// update ciphertext, c_len is filled with the length of ciphertext
generated
if(!EVP_EncryptUpdate(&enCTX, ciphertext, &c_len, (unsigned
char*)message.data(),
message.length()+1))
cerr << "ERROR in EVP_EncryptUpdate" << endl;
// update ciphertext with the final remaining bytes
int f_len = 0;
if(!EVP_EncryptFinal_ex(&enCTX, ciphertext+c_len, &f_len))
cerr << "ERROR in EVP_EncryptFinal_ex" << endl;
return string((char*)ciphertext, c_len + f_len);
}
catch(...)
{
return message;
}
}
int main()
{
// ssl init
const EVP_CIPHER* c = EVP_aes_128_cbc();
unsigned char key[32], iv[32];
string passphrase="test";
string salt="12345678";
int rounds=5;
EVP_BytesToKey(c, EVP_sha1(), (unsigned char*)salt.data(), (unsigned
char*)passphrase.data(), passphrase.length(), rounds, key, iv);
EVP_CIPHER_CTX_init(&deCTX);
EVP_DecryptInit_ex(&deCTX, c, NULL, key, iv);
EVP_CIPHER_CTX_init(&enCTX);
EVP_EncryptInit_ex(&enCTX, c, NULL, key, iv);
// trying to encrypt and decrypt
string plaintext = "015this is a test!";
cout << "plaintext: " << plaintext << endl;
string ciphertext = EncryptMessage(plaintext);
cout << "ciphertext: " << ciphertext << endl;
string header = ciphertext.substr(0, 7);
cout << "header: " << header << endl;
string decrypted_header = DecryptMessage(header);
cout << "decrypted header: " << decrypted_header << endl;
}
