[openssl-users] Does openssl pick low level interface or high level interface to do encrypt?

2017-08-10 Thread - JinsongJi
Hi, For one simple operation: openssl enc -aes-256-cbc -salt -in foo.txt -out foo.enc Does openssl pick classic implementation or AES-NI implementation to do this encrypt? Does any user/application always pick classic implementation for AES operation regardless of AES-NI improves speed much?

Re: [openssl-users] Does openssl pick low level interface or high level interface to do encrypt?

2017-08-10 Thread Salz, Rich via openssl-users
What OpenSSL does is not necessarily obvious. The INSTALL document talks about the no-asm configuration option. Details about what the assembler code does in terms of optimization are only available by reading the source code comments in the various Perl files that generate the assembler,

[openssl-users] SMime encrypted mail - find out which key was used

2017-08-10 Thread openssl mailing list via openssl-users
Hi, Is there a command line way to find out with which key an S/Mime encrypted e-mail was encrypted, so that I can use the correct private key for decryption? In my case users can have - for internal reasons - more than one public/private key pair, so using the e-mail address of the receiver

[openssl-users] Password protect EC private key

2017-08-10 Thread Robert Moskowitz
I am following: https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html But modifying it to produce ECDSA certs. So the first step is to make the private key. Jamie says: openssl genrsa -aes256 -out private/ca.key.pem 4096 The -aes256 option supposedly password

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Viktor Dukhovni
On Thu, Aug 10, 2017 at 03:17:02PM -0400, Robert Moskowitz wrote: > > Are you sure you want secp256k1? By far the more common choice is > > prime256r1 (aka P-256 or secp256r1). > > Do you mean prime256v1? Yes, it is the primary name in OpenSSL for secp256r1 aka (NIST) P-256. --

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Robert Moskowitz
On 08/10/2017 04:26 PM, Viktor Dukhovni wrote: On Thu, Aug 10, 2017 at 03:17:02PM -0400, Robert Moskowitz wrote: Are you sure you want secp256k1? By far the more common choice is prime256r1 (aka P-256 or secp256r1). Do you mean prime256v1? Yes, it is the primary name in OpenSSL for

Re: [openssl-users] Does openssl pick low level interface or high level interface to do encrypt?

2017-08-10 Thread Viktor Dukhovni
On Wed, Aug 09, 2017 at 01:08:47PM +, - JinsongJi wrote: > For one simple operation: openssl enc -aes-256-cbc -salt -in foo.txt -out > foo.enc > Does openssl pick classic implementation or AES-NI implementation to do this > encrypt? The enc(1) command uses the EVP API to access the

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Viktor Dukhovni
On Thu, Aug 10, 2017 at 12:03:31PM -0400, Robert Moskowitz wrote: > openssl ecparam -name secp256k1 -genkey -noout -out private/ca.key.pem > > But openssl ecparam does not have any option equivalent (that I can find) to > -aes256 Yes, this command does not currently support key encryption. >

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Robert Moskowitz
Thank you, Viktor. On 08/10/2017 02:27 PM, Viktor Dukhovni wrote: On Thu, Aug 10, 2017 at 12:03:31PM -0400, Robert Moskowitz wrote: openssl ecparam -name secp256k1 -genkey -noout -out private/ca.key.pem But openssl ecparam does not have any option equivalent (that I can find) to -aes256

Re: [openssl-users] Fwd: Error in Opening SSL Certificate

2017-08-10 Thread Viktor Dukhovni
On Thu, Aug 10, 2017 at 06:27:41PM +0530, Amiya Das wrote: > I have written an application for connecting to AzureIOT hub using AMQP > protocol. > When i run the application it fails because of SSL issue stating *14090086:SSL > routines:ssl3_get_server_certificate:certificate verify failed.*

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Viktor Dukhovni
On Thu, Aug 10, 2017 at 02:49:02PM -0400, Robert Moskowitz wrote: > > The command that does is: > > > > $ openssl genpkey -aes256 -algorithm ec \ > > -pkeyopt ec_paramgen_curve:secp256k1 \ > > -pkeyopt ec_param_enc:named_curve \ > > -out private/ca.key.pem > > So I see that I

Re: [openssl-users] Password protect EC private key

2017-08-10 Thread Robert Moskowitz
On 08/10/2017 02:27 PM, Viktor Dukhovni wrote: On Thu, Aug 10, 2017 at 12:03:31PM -0400, Robert Moskowitz wrote: openssl ecparam -name secp256k1 -genkey -noout -out private/ca.key.pem But openssl ecparam does not have any option equivalent (that I can find) to -aes256 Yes, this command

[openssl-users] Fwd: Error in Opening SSL Certificate

2017-08-10 Thread Amiya Das
Hi, I have written an application for connecting to AzureIOT hub using AMQP protocol. When i run the application it fails because of SSL issue stating *14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed.* Any help would be appreciate.. Below are the details for the OS