Re: Using variable length Blowfish key with command line

2012-08-21 Thread Nathan McCrina
On 08/21/12 23:04, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Nathan McCrina Sent: Tuesday, 21 August, 2012 21:31 Not in commandline; in library it's fine. See http://marc.info/?l=openssl-users&m=134463726501144&w=2 for the similar but undocumented RC4 case, and adj

RE: Using variable length Blowfish key with command line

2012-08-21 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Nathan McCrina > Sent: Tuesday, 21 August, 2012 21:31 > I'm using 'openssl enc' on the command line to check my > [Blowfish]. However, the man page seems to indicate that it is only > possible to use 128-bit keys with the openssl Blowfish. Is

Using variable length Blowfish key with command line

2012-08-21 Thread Nathan McCrina
Hi all, I'm writing a program that encrypts and decrypts stuff with the Blowfish algorithm, and I'm using 'openssl enc' on the command line to check my results. However, the man page seems to indicate that it is only possible to use 128-bit keys with the openssl Blowfish. Is there absolutely n

RE: Any security risk in cat-ing certificate and key?

2012-08-21 Thread Charles Mills
Thanks for your thorough answer. -- Sent from my mobile phone. Please excuse my brevity. Charles Dave Thompson wrote: > From: owner-openssl-us...@openssl.org On Behalf Of Charles Mills > Sent: Tuesday, 21 August, 2012 14:41 > The O'Reilly OpenSSL book - in some examples but not others - > cat'

RE: What is the Java equivalent of "openssl smime binary" ?

2012-08-21 Thread Dave Thompson
>From: owner-openssl-us...@openssl.org On Behalf Of Bart W Jenkins >Sent: Monday, 20 August, 2012 09:15 >I've created a prototype, in Java that creates an s/mime file, >and now I need to convert that to the equivalent of what the >"binary" switch does when using openssl. The command in openssl

RE: Any security risk in cat-ing certificate and key?

2012-08-21 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Charles Mills > Sent: Tuesday, 21 August, 2012 14:41 > The O'Reilly OpenSSL book - in some examples but not others - > cat's the > certificate and key together and then just uses that one file as both > certificate_chain_file and PrivateKey_fil

Re: change passphrase on CA

2012-08-21 Thread Wim Lewis
On 21 Aug 2012, at 8:03 AM, Brian J. Murrell wrote: > I have an openssl generated CA and I want to change the passphrase on > the CA certificate/key. I can't seem to find any documentation on how > to go about that. IIRC, the newer way is to use the 'pkey' subcommand, and the older way is to us

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Ben Laurie
On Tue, Aug 21, 2012 at 2:14 PM, Charles Mills wrote: > Actually, there IS *almost* a general solution to this problem. > > The input consists of characters from some set of 'n' characters. (Perhaps > 'n' is 94 -- 0x21 through 0x7e inclusive -- but it does not matter.) You need > to pack those c

change passphrase on CA

2012-08-21 Thread Brian J. Murrell
I have an openssl generated CA and I want to change the passphrase on the CA certificate/key. I can't seem to find any documentation on how to go about that. Any ideas or hints? Cheers, b. signature.asc Description: OpenPGP digital signature

What is the Java equivalent of "openssl smime binary" ?

2012-08-21 Thread Bart W Jenkins
I've created a prototype, in Java that creates an s/mime file, and now I need to convert that to the equivalent of what the "binary" switch does when using openssl. The command in openssl is: openssl smime -binary -sign -passin "pass:MyPassword" -signer cert.pem -inkey key.pem -in DocumentToSi

Any security risk in cat-ing certificate and key?

2012-08-21 Thread Charles Mills
The O'Reilly OpenSSL book - in some examples but not others - cat's the certificate and key together and then just uses that one file as both certificate_chain_file and PrivateKey_file. cat servercert.pem serverkey.pem > server.pem Is that okay? It does seem more convenient to only have one file

Timeout Engine OpenSSL

2012-08-21 Thread Rick Lopes de Souza
Hi, I have some doubt about the Engine OpenSSL. If i load it, does it have a timeout to unload the engine? For example, I want to make a webservice that may use the openssl any time, so i need to load the engine and let it loaded all the time. Thanks for your atention, -- Rick Lopes de Souza

RE: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Charles Mills
Agreed all around. Also there is a '6' in my post where there should be a '64'. Great minds think alike. Charles From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Matt Caswell (fr...@baggins.org) Sent: Tuesday, August 21, 2012 9:35 AM To: openssl-

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Matt Caswell (fr...@baggins.org)
On 21 August 2012 14:14, Charles Mills wrote: > Actually, there IS *almost* a general solution to this problem. > > The input consists of characters from some set of 'n' characters. (Perhaps > 'n' is 94 -- 0x21 through 0x7e inclusive -- but it does not matter.) You > need to pack those characters

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Jakob Bohm
Actually, your method can be extended to almost any number of permitted characters. 1. Suppose the OPs format allows n different chars, dream up a private encoding where each of those is given a number from 0 to n-1 2. Convert the 24 char input to this private encoding. 3. Treat this as a base

RE: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Charles Mills
Actually, there IS *almost* a general solution to this problem. The input consists of characters from some set of 'n' characters. (Perhaps 'n' is 94 -- 0x21 through 0x7e inclusive -- but it does not matter.) You need to pack those characters with maximum density. It's conceptually the easiest if

RE: CA-signed certificate reported as self-signed

2012-08-21 Thread Charles Mills
Bingo! As the organization was the same in both cases I had put the same value in every place. Thanks, Charles -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Dave Thompson Sent: Monday, August 20, 2012 4:45 PM To: openssl-us

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Ken Goldman
On 8/21/2012 7:17 AM, Matt Caswell wrote: On 21 August 2012 12:00, Tarun Thakur wrote: Output of my software application (after encryption and encoding with any mechanism) should be of 24 bytes containing alphanumeric characters only. So, if I get encrypted 24 bytes from plain 24bytes, then

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Tarun Thakur
Thank you all for your suggested solutions. Matt Caswell (fr...@baggins.org) wrote: > > On 21 August 2012 12:00, Tarun Thakur wrote: > >> >> Hi All, >> >> Thank you very much for your responses. >> >> Output of my software application (after encryption and encoding with any >> mechanism) sh

RE: Losing extension Alternative Names on signing

2012-08-21 Thread Charles Mills
> Nit: I forgot to say last time, but this doesn't sign the CSR. > It creates a cert from the CSR, and signs the cert. Got it. Thanks. > copy_extensions = copy or copyall Bingo! Thanks again. > Per 'man ca', All the information may be out there but it is hard to know where to look for the ans

RE: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Charles Mills
The encrypted output could also contain a null (‘\0’) which is probably even more of a problem for your application. Charles From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Tarun Thakur Sent: Tuesday, August 21, 2012 3:26 AM To: openssl-users@openssl

RE: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Charles Mills
6 bits will encode 64 different characters. So if you can restrict your input to A-Z, a-z, 0-9, plus two other characters (space and period perhaps) then 24 characters of input can be represented in 6*24 = 144 bits. 144/8 = 18 characters. It is a Programming 101 exercise to encode 64 different c

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Matt Caswell (fr...@baggins.org)
On 21 August 2012 12:00, Tarun Thakur wrote: > > Hi All, > > Thank you very much for your responses. > > Output of my software application (after encryption and encoding with any > mechanism) should be of 24 bytes containing alphanumeric characters only. > > So, if I get encrypted 24 bytes from p

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Tarun Thakur
Hi All, Thank you very much for your responses. Output of my software application (after encryption and encoding with any mechanism) should be of 24 bytes containing alphanumeric characters only. So, if I get encrypted 24 bytes from plain 24bytes, then which encoding mechanism can convert encr

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Matt Caswell (fr...@baggins.org)
As Andrey has said the output from encryption is binary and so can be any character (prinatable and non-printable). Therefore you are going to have to do some kind of encoding of the output to force it to be printablethis is going to increase the length no matter what. What is the allowed set

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Andrey Koltsov
Hi. base64 format can encode strings of any length. The encoded result would be longer of course. Best regards, Andrey Koltsov software developer CyberplatSoft Ltd 21.08.2012 11:45, Tarun Thakur пишет: Hi, Thanks for your reply.. But issue in base64 encoding is it will generate encoded t

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Tarun Thakur
Hi, Thanks for your reply.. But issue in base64 encoding is it will generate encoded test greater than 24 bytes. Application output should generate encrypted code exactly 24 bytes as input. Thanks, Tarun Andrey Koltsov-2 wrote: > > Hi Tarun. > > Output of every encryption function is alway

Re: OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Andrey Koltsov
Hi Tarun. Output of every encryption function is always binary so it can contains ANY character. You should encode this binary string to base64 or hex format by yourself to pass it to your application. Do not forget to do reverse encoding before decrypting. Best regards, Andrey Koltsov sof

OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Tarun Thakur
Hi All, Issue is encrypted code contains '\n' which is an major issue for my software application. Given below is problem summarized. I have used OpenSSL library's DES_ede3_ofb64_encrypt() function to perform encryption byte by byte on chunk of 24 bytes. For example: Input 24 bytes are: [roo

OpenSSL DES generates '\n' in encrypted code

2012-08-21 Thread Tarun Thakur
Hi All, Issue is encrypted code contains '\n' which is an major issue for my software application. Given below is problem summarized. I have used OpenSSL library's DES_ede3_ofb64_encrypt() function to perform encryption byte by byte on chunk of 24 bytes. For example: Input 24 bytes are: [root