Girish Venkatachalam wrote:
> FILE *fp;
> sprintf(buf,"echo %s | openssl aes-256-cbc -salt -a -e
> -pass pass:%s",password,passphrase);
> fp = popen(buf);
> fgets(fd...) for the output

Dear "be_tnt", don't believe him ;-) This code snipped blatantly calls
for buffer overflows and other unwanted behaviour.

1) You don't need OpenSSL sources. Headers and development libraries are
enough.
2) Depending on what system/distribution you use install the appropriate
package (e.g. openssl-devel on SuSE, openssl-dev on Debian, etc).
3) Go through "man evp" and all relevant referenced EVP_Cipher* manpages.
4) Play with the stuff until you come up with those three or four calls
needed to encrypt stuff with OpenSSL library.
5) Eventually get the sources and see how your command is implemented.
It won't be too difficult. See openssl/apps directory.

Michal Ludvig
-- 
* Stuff: http://www.logix.cz/michal




______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [email protected]
Automated List Manager                           [EMAIL PROTECTED]

Reply via email to