Re: How to do encryption using AES in Openssl
On Thu, Mar 29, 2012 at 5:40 AM, Prashanth kumar N
prashanth.kuma...@gmail.com wrote:
Thanks Ken for pointing out the mistake... after changing to
AES_Decrypt(), it worked but i still see issue when i print the
decrypted output as it has extra non-ascii characters in it.
Below is the input
unsigned char text[]=test12345678abc2;
After decryption, i get the following string: Decrypted o/p:
test12345678abc2Ȳu�z�B��� ��A��S��
You didn't encrypt the terminating NUL, so the decrypt is unterminated...
Few questions...
1. If we use AES, will decrypted files have same number of bytes as
encrypted file? (I assume it should be same)
2. When i did Google and found few examples on AES using CBC mode, many of
them add extra buffer while decrypting ie.,
sample eg:
unsigned char key[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
10 unsigned char iv[] = {1,2,3,4,5,6,7,8};
11 unsigned char outbuf[1024];
12 unsigned char decrebuf[1024];
13 int outlen,outlen2, tmplen;
14 unsigned char text[]=test12345678abc2;
15 char outfile[]= encfile;
if(!EVP_EncryptUpdate(ctx, outbuf, outlen, intext,
strlen(intext)))
26 {
27 /* Error */
28printf(\n Error:EVP_EncryptUpdate );
29return 0;
30}
31
32if(!EVP_EncryptFinal_ex(ctx, outbuf + outlen, tmplen))
33 {
34 /* Error */
35 printf(\n Error: EVP_EncryptFinal_ex);
36 return 0;
37 }
EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv);
45
46 if(!EVP_DecryptUpdate(ctx, decrebuf, outlen2, outbuf, outlen))
47 {
48 printf(\n Error : EVP_DecryptUpdate);
49 return 0;
50 }
EVP_DecryptFinal_ex(ctx, decrebuf + outlen2, tmplen )
Here i see even thought decrebuf is 1024, we still offset it by outlen and
pass the address to Decrytpion function?
3. Why is it like we have to choose 1024 as array size... when i know my
encryption text is only 16bytes. Any reasons?
-Prashanth
On Wed, Mar 28, 2012 at 7:29 PM, Ken Goldman kgold...@us.ibm.com wrote:
On 3/28/2012 3:01 AM, Prashanth kumar N wrote:
Here is the modified program
[snip]
18 AES_KEY ectx;
19 AES_KEY dectx;
20
21 AES_set_encrypt_key(key, 256, ectx);
22 AES_encrypt(text, out, ectx);
23
24 printf(encryp data = %s\n, out);
25
26 AES_set_encrypt_key(key, 256, dectx);
AES_set_decrypt_key()
27 AES_decrypt(out, decout, dectx);
__**__**
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Thu, Mar 29, 2012, Prashanth kumar N wrote: Thanks Marek. I will try the attached code in the attached files. In many of the examples i have come across, i see IV is always being. Is it not possible to use this API by setting IV to NULL? (As i understand for CBC IV is a must) . In AES_Encrypt(), we don't use IV. Does this mean this does stream ciphering (byte by byte)? The IV should be random and must be set to the same value on encrypt and decrypt. The information isn't security sensitive and can be sent in plain text. If you use AES_encrypt you're effectively using ECB mode. Does any one know if Openssl supports AES-XTS? Reason is we are exploring to see if we can employ this. When i Googled, i did see some change request log which said AES-XTS has been added to Openssl in v1.1.0 which i am not able to find for download... Any idea on this? XTS mode is very new and only supported in OpenSSL 1.0.1 and later. You use EVP_CIPHER functions EVP_aes_128_xts() and EVP_aes_256_xts(). Note that the key length is double that for nomal AES. You can get the key length of any cipher (provided you use EVP) using EVP_CIPHER_key_length(). Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/29/2012 1:40 AM, Prashanth kumar N wrote: Thanks Ken for pointing out the mistake... after changing to AES_Decrypt(), it worked but i still see issue when i print the decrypted output as it has extra non-ascii characters in it. That's what happens in C if you try to printf an array that's not NUL terminated. The printf just keeps going, right past the end of the buffer, until it either hits a \0 or segfaults. You encrypted 16 bytes, not nul terminated, decrypted to the same 16 bytes, then pretended that it was nul terminated and tried to printf. Below is the input unsigned char text[]=test12345678abc2; After decryption, i get the following string: Decrypted o/p: test12345678abc2Ȳu�z�B�����A��S�� Few questions... 1. If we use AES, will decrypted files have same number of bytes as encrypted file? (I assume it should be same) It depends on the mode and padding scheme. Some (CTR, OFB) don't pad, some (CFC) do pad. If you're just playing, fine. But if this is a real product you're designing, you shouldn't be asking this question. It's time to hire a crypto expert. Otherwise, your product will be insecure. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Stephen, Does it mean we can't use AES without IV ? As per XTS support in Openssl, i find the following function but don't see any implementation for the same AES_xts_encrypt(). I found the below link form which what i understand is new file called e_aes_xts.c should be present... am i missing something? lpermalink.gmane.org/gmane.comp.encryption.openssl.devel/18755 On Thu, Mar 29, 2012 at 4:07 PM, Dr. Stephen Henson st...@openssl.orgwrote: On Thu, Mar 29, 2012, Prashanth kumar N wrote: Thanks Marek. I will try the attached code in the attached files. In many of the examples i have come across, i see IV is always being. Is it not possible to use this API by setting IV to NULL? (As i understand for CBC IV is a must) . In AES_Encrypt(), we don't use IV. Does this mean this does stream ciphering (byte by byte)? The IV should be random and must be set to the same value on encrypt and decrypt. The information isn't security sensitive and can be sent in plain text. If you use AES_encrypt you're effectively using ECB mode. Does any one know if Openssl supports AES-XTS? Reason is we are exploring to see if we can employ this. When i Googled, i did see some change request log which said AES-XTS has been added to Openssl in v1.1.0 which i am not able to find for download... Any idea on this? XTS mode is very new and only supported in OpenSSL 1.0.1 and later. You use EVP_CIPHER functions EVP_aes_128_xts() and EVP_aes_256_xts(). Note that the key length is double that for nomal AES. You can get the key length of any cipher (provided you use EVP) using EVP_CIPHER_key_length(). Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Bit confusing... are you saying that i need to add NULL termination at the end of encrypted data? Isn't this wrong? I assume i shouldn't be NULL terminating the input string which needs to be encrypted. On Thu, Mar 29, 2012 at 7:10 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/29/2012 1:40 AM, Prashanth kumar N wrote: Thanks Ken for pointing out the mistake... after changing to AES_Decrypt(), it worked but i still see issue when i print the decrypted output as it has extra non-ascii characters in it. That's what happens in C if you try to printf an array that's not NUL terminated. The printf just keeps going, right past the end of the buffer, until it either hits a \0 or segfaults. You encrypted 16 bytes, not nul terminated, decrypted to the same 16 bytes, then pretended that it was nul terminated and tried to printf. Below is the input unsigned char text[]=test12345678abc2; After decryption, i get the following string: Decrypted o/p: test12345678abc2Ȳu�z�B��� ��A��S�� Few questions... 1. If we use AES, will decrypted files have same number of bytes as encrypted file? (I assume it should be same) It depends on the mode and padding scheme. Some (CTR, OFB) don't pad, some (CFC) do pad. If you're just playing, fine. But if this is a real product you're designing, you shouldn't be asking this question. It's time to hire a crypto expert. Otherwise, your product will be insecure. My requirement is mainly to support AES XTS but the reason for asking the above question was to understand if their is addition of extra bytes to encrypted data as it might consume more space when written to a drive... does my question make sense? __**__**__ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Hello, If your data to encrypt is not exactly 16 bytes (AES block length), you should add block padding before encryption and remove padding after decryption. In your case you have string virident (8bytes), you should add 16-8=8 bytes of padding before encryption (fill last 8 bytes with value 8). After decryption remove last 8 bytes (filed with value 8). For printf() you may fill this last 8 bytes to 0. Best regards, -- Marek Marcola marek.marc...@malkom.pl owner-openssl-us...@openssl.org wrote on 03/29/2012 04:02:17 PM: Prashanth kumar N prashanth.kuma...@gmail.com Sent by: owner-openssl-us...@openssl.org 03/29/2012 04:03 PM Please respond to openssl-users@openssl.org To openssl-users@openssl.org cc Subject Re: How to do encryption using AES in Openssl Bit confusing... are you saying that i need to add NULL termination at the end of encrypted data? Isn't this wrong? I assume i shouldn't be NULL terminating the input string which needs to be encrypted. On Thu, Mar 29, 2012 at 7:10 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/29/2012 1:40 AM, Prashanth kumar N wrote: Thanks Ken for pointing out the mistake... after changing to AES_Decrypt(), it worked but i still see issue when i print the decrypted output as it has extra non-ascii characters in it. That's what happens in C if you try to printf an array that's not NUL terminated. The printf just keeps going, right past the end of the buffer, until it either hits a \0 or segfaults. You encrypted 16 bytes, not nul terminated, decrypted to the same 16 bytes, then pretended that it was nul terminated and tried to printf. Below is the input unsigned char text[]=test12345678abc2; After decryption, i get the following string: Decrypted o/p: test12345678abc2Ȳu�z�B��� ��A��S�� Few questions... 1. If we use AES, will decrypted files have same number of bytes as encrypted file? (I assume it should be same) It depends on the mode and padding scheme. Some (CTR, OFB) don't pad, some (CFC) do pad. If you're just playing, fine. But if this is a real product you're designing, you shouldn't be asking this question. It's time to hire a crypto expert. Otherwise, your product will be insecure. My requirement is mainly to support AES XTS but the reason for asking the above question was to understand if their is addition of extra bytes to encrypted data as it might consume more space when written to a drive... does my question make sense? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Thanks Marek. If i select CBC mode encryption and i have data which is not aligned to block, i assume padding will be taken by the API's itself. -Prashanth On Thu, Mar 29, 2012 at 7:50 PM, marek.marc...@malkom.pl wrote: Hello, If your data to encrypt is not exactly 16 bytes (AES block length), you should add block padding before encryption and remove padding after decryption. In your case you have string virident (8bytes), you should add 16-8=8 bytes of padding before encryption (fill last 8 bytes with value 8). After decryption remove last 8 bytes (filed with value 8). For printf() you may fill this last 8 bytes to 0. Best regards, -- Marek Marcola marek.marc...@malkom.pl owner-openssl-us...@openssl.org wrote on 03/29/2012 04:02:17 PM: Prashanth kumar N prashanth.kuma...@gmail.com Sent by: owner-openssl-us...@openssl.org 03/29/2012 04:03 PM Please respond to openssl-users@openssl.org To openssl-users@openssl.org cc Subject Re: How to do encryption using AES in Openssl Bit confusing... are you saying that i need to add NULL termination at the end of encrypted data? Isn't this wrong? I assume i shouldn't be NULL terminating the input string which needs to be encrypted. On Thu, Mar 29, 2012 at 7:10 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/29/2012 1:40 AM, Prashanth kumar N wrote: Thanks Ken for pointing out the mistake... after changing to AES_Decrypt(), it worked but i still see issue when i print the decrypted output as it has extra non-ascii characters in it. That's what happens in C if you try to printf an array that's not NUL terminated. The printf just keeps going, right past the end of the buffer, until it either hits a \0 or segfaults. You encrypted 16 bytes, not nul terminated, decrypted to the same 16 bytes, then pretended that it was nul terminated and tried to printf. Below is the input unsigned char text[]=test12345678abc2; After decryption, i get the following string: Decrypted o/p: test12345678abc2Ȳu�z�B��� ��A��S�� Few questions... 1. If we use AES, will decrypted files have same number of bytes as encrypted file? (I assume it should be same) It depends on the mode and padding scheme. Some (CTR, OFB) don't pad, some (CFC) do pad. If you're just playing, fine. But if this is a real product you're designing, you shouldn't be asking this question. It's time to hire a crypto expert. Otherwise, your product will be insecure. My requirement is mainly to support AES XTS but the reason for asking the above question was to understand if their is addition of extra bytes to encrypted data as it might consume more space when written to a drive... does my question make sense? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Thu, Mar 29, 2012, Prashanth kumar N wrote: Thanks Marek. If i select CBC mode encryption and i have data which is not aligned to block, i assume padding will be taken by the API's itself. Only if you use EVP. For low level APIs you have to manually add and remove padding. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: How to do encryption using AES in Openssl
From: owner-openssl-us...@openssl.org On Behalf Of Prashanth kumar N Sent: Thursday, 29 March, 2012 10:02 Bit confusing... are you saying that i need to add NULL termination at the end of encrypted data? Isn't this wrong? I assume i shouldn't be NULL terminating the input string which needs to be encrypted. That's not what he said. See below. On Thu, Mar 29, 2012 at 7:10 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/29/2012 1:40 AM, Prashanth kumar N wrote: Thanks Ken for pointing out the mistake... after changing to AES_Decrypt(), it worked but i still see issue when i print the decrypted output as it has extra non-ascii characters in it. That's what happens in C if you try to printf an array that's not NUL terminated. The printf just keeps going, right past the end of the buffer, until it either hits a \0 or segfaults. You encrypted 16 bytes, not nul terminated, decrypted to the same 16 bytes, then pretended that it was nul terminated and tried to printf. This is partly wrong. The input actually was nul-terminated, because unsigned char text[]=test12345678abc2; allocates 17 bytes. If you had used printf %s on that input, it would have worked. But the termination wasn't needed for AES_Encrypt which takes exactly 16 bytes (one block) and ignores any more. In general crypto routines like OpenSSL work on arbitrary bytes with explicit lengths or fixed length like here, not using nul-termination. *Sometimes* plaintext is actually human-readable or otherwise printable characters, but sometimes it isn't, and (modern) ciphertext never is. Similarly AES_Encrypt gives and AES_Decrypt takes exactly 16 bytes, as you did correctly, and AES_Decrypt gives exactly 16 bytes. So far so good. But those 16 bytes don't include a nul-terminator, and aren't followed by one in the same array, so when you use printf %s which *requires* a nul-terminated string, it screws up. Similarly if you used other C string functions like strcpy() strlen(). There are ways in C to handle character arrays that aren't nul-terminated. In this case you could use: printf (Decrypted: %.16s\n, decrypted); which prints until nul OR 16 chars whichever is hit first. But usually in C it's easiest to follow the beaten path and use nul-termination. To do that you need to decrypt into an array of *17* unsigned chars and set decrypted[16] = 0. Or if you prefer, decrypt into an array of 16 bytes, then memcpy() that to an array of 17 bytes where you add the nul-terminator. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Here is the modified program
#include stdio.h
2 #include openssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
10
11 void main()
12 {
13 unsigned char text[]=test12345678abcf;
14 unsigned char out[16];
15 unsigned char decout[16];
16 int i;
17
18 AES_KEY ectx;
19 AES_KEY dectx;
20
21 AES_set_encrypt_key(key, 256, ectx);
22 AES_encrypt(text, out, ectx);
23
24 printf(encryp data = %s\n, out);
25
26 AES_set_encrypt_key(key, 256, dectx);
27 AES_decrypt(out, decout, dectx);
28 printf( Decrypted o/p: %s \n, decout);
29
30 for (i = 0;i 16; i++)
31 printf( %02x, decout[i]);
32 }
33
As i read min AES block size is 128 bits which can go up to 256 bits in
multiples of 32-bits. Is this correct?
I do know encrypted data is binary but when i pass the same data to
AES_decrypt() fucntion and print using %s, i get non-readable characters. *
*What i notice is when i change the input plain text, i do see o/p vaires.
On Tue, Mar 27, 2012 at 11:24 PM, Ken Goldman kgold...@us.ibm.com wrote:
On 3/27/2012 1:33 PM, pkumarn wrote:
I am trying to write a sample program to do AES encryption using Openssl.
I
tried going through Openssl documentation( it's a pain), could not figure
out much. I went through the code and found the API's using which i wrote
a
small program as below (please omit the line numbers). I don't see any
encryption happening... am i missing something?
Define I don't see any encryption happening.
PS: I don't get any errors upon compilation.
1 #includestdio.h
2 #includeopenssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
It's strange to define a 256 bit key and use 128 bits.
10
11 void main()
12 {
13 unsigned char text[]=virident;
The input must be equal to the AES block size.
14 unsigned char out[10];
The output must be equal to the AES block size.
15 unsigned char decout[10];
Same here.
16
17 AES_KEY wctx;
18
19 AES_set_encrypt_key(key, 128,wctx);
20 AES_encrypt(text, out,wctx);
This is a raw encrypt, which assumes input and output are one AES block.
21
22 printf(encryp data = %s\n, out);
The encrypted data is binary, not a printable C string.
23
24 AES_decrypt(out, decout,wctx);
25 printf( Decrypted o/p: %s \n, decout);
26
27
28 }
Please help me to figure this out...
__**__**__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
I tried to use EVP but let if of go due to bad documentation... On Wed, Mar 28, 2012 at 2:49 AM, Jakob Bohm jb-open...@wisemo.com wrote: On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/**crypto/EVP_DigestInit.htmlhttp://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/**crypto/EVP_EncryptInit.htmlhttp://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/**crypto/EVP_SignInit.htmlhttp://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/**crypto/EVP_VerifyInit.htmlhttp://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10 call: +4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __**__**__ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
As an independent follower of this list, I'd just like say that even if the documentation has its critics, the support provided here is incredibly good ! On Wed, Mar 28, 2012, at 12:32 PM, Prashanth kumar N wrote: I tried to use EVP but let if of go due to bad documentation... On Wed, Mar 28, 2012 at 2:49 AM, Jakob Bohm jb-open...@wisemo.com wrote: On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/**crypto/EVP_DigestInit.htmlhttp://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/**crypto/EVP_EncryptInit.htmlhttp://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/**crypto/EVP_SignInit.htmlhttp://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/**crypto/EVP_VerifyInit.htmlhttp://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10 call: +4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __**__**__ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
I agree with this as it has made many life's easy ... On Wed, Mar 28, 2012 at 12:48 PM, nudge nudge...@fastmail.fm wrote: As an independent follower of this list, I'd just like say that even if the documentation has its critics, the support provided here is incredibly good ! On Wed, Mar 28, 2012, at 12:32 PM, Prashanth kumar N wrote: I tried to use EVP but let if of go due to bad documentation... On Wed, Mar 28, 2012 at 2:49 AM, Jakob Bohm jb-open...@wisemo.com wrote: On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/**crypto/EVP_DigestInit.html http://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/**crypto/EVP_EncryptInit.html http://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/**crypto/EVP_SignInit.html http://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/**crypto/EVP_VerifyInit.html http://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10call: +4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __**__**__ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/28/2012 3:01 AM, Prashanth kumar N wrote: Here is the modified program [snip] 18 AES_KEY ectx; 19 AES_KEY dectx; 20 21 AES_set_encrypt_key(key, 256, ectx); 22 AES_encrypt(text, out, ectx); 23 24 printf(encryp data = %s\n, out); 25 26 AES_set_encrypt_key(key, 256, dectx); AES_set_decrypt_key() 27 AES_decrypt(out, decout, dectx); __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Hello,
If you want to use low-level AES functions to encrypt more then 16 bytes
you
should use AES in CBC mode. You can implement this mode using AES_encrypt
()
or better use AES_cbc_encrypt().
Using AES_encrypt() block-by-block is called ECB mode.
Look at: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
Example of using AES_cbc_encrypt() attached (pay attension of block
padding).
Best regards,
--
Marek Marcola marek.marc...@malkom.pl
owner-openssl-us...@openssl.org wrote on 03/28/2012 09:01:25 AM:
Prashanth kumar N prashanth.kuma...@gmail.com
Sent by: owner-openssl-us...@openssl.org
03/28/2012 09:03 AM
Please respond to
openssl-users@openssl.org
To
openssl-users@openssl.org
cc
Subject
Re: How to do encryption using AES in Openssl
Here is the modified program
#include stdio.h
2 #include openssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
10
11 void main()
12 {
13 unsigned char text[]=test12345678abcf;
14 unsigned char out[16];
15 unsigned char decout[16];
16 int i;
17
18 AES_KEY ectx;
19 AES_KEY dectx;
20
21 AES_set_encrypt_key(key, 256, ectx);
22 AES_encrypt(text, out, ectx);
23
24 printf(encryp data = %s\n, out);
25
26 AES_set_encrypt_key(key, 256, dectx);
27 AES_decrypt(out, decout, dectx);
28 printf( Decrypted o/p: %s \n, decout);
29
30 for (i = 0;i 16; i++)
31 printf( %02x, decout[i]);
32 }
33
As i read min AES block size is 128 bits which can go up to 256 bits in
multiples of 32-
bits. Is this correct?
I do know encrypted data is binary but when i pass the same data to
AES_decrypt()
fucntion and print using %s, i get non-readable characters. What i
notice is when i
change the input plain text, i do see o/p vaires.
On Tue, Mar 27, 2012 at 11:24 PM, Ken Goldman kgold...@us.ibm.com
wrote:
On 3/27/2012 1:33 PM, pkumarn wrote:
I am trying to write a sample program to do AES encryption using
Openssl. I
tried going through Openssl documentation( it's a pain), could not
figure
out much. I went through the code and found the API's using which i
wrote a
small program as below (please omit the line numbers). I don't see any
encryption happening... am i missing something?
Define I don't see any encryption happening.
PS: I don't get any errors upon compilation.
1 #includestdio.h
2 #includeopenssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
It's strange to define a 256 bit key and use 128 bits.
10
11 void main()
12 {
13 unsigned char text[]=virident;
The input must be equal to the AES block size.
14 unsigned char out[10];
The output must be equal to the AES block size.
15 unsigned char decout[10];
Same here.
16
17 AES_KEY wctx;
18
19 AES_set_encrypt_key(key, 128,wctx);
20 AES_encrypt(text, out,wctx);
This is a raw encrypt, which assumes input and output are one AES block.
21
22 printf(encryp data = %s\n, out);
The encrypted data is binary, not a printable C string.
23
24 AES_decrypt(out, decout,wctx);
25 printf( Decrypted o/p: %s \n, decout);
26
27
28 }
Please help me to figure this out...
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
aes_dec.c
Description: Binary data
aes_enc.c
Description: Binary data
Re: How to do encryption using AES in Openssl
I agree with you in general. I assumed the OP was just experimenting. I use the raw AES_encrypt() because the standard I'm complying to uses a non-standard counter mode. I had to construct it from scratch. On 3/28/2012 10:56 AM, Marek.Marcola- wrote: If you want to use low-level AES functions to encrypt more then 16 bytes you should use AES in CBC mode. You can implement this mode using AES_encrypt () or better use AES_cbc_encrypt(). Using AES_encrypt() block-by-block is called ECB mode. Look at: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Tue, Mar 27, 2012 at 8:26 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. I also use the low level APIs, just because they were easier to find and understand in the source. I hope you both know what you're doing - using low-level APIs directly is unlikely to result in a secure construction unless you do.
Re: How to do encryption using AES in Openssl
Hello, Maybe attached simple example will help. Use: # gcc -o evp_enc evp_enc.c -lcrypto # cat /etc/group | ./evp_enc Best regards, -- Marek Marcola marek.marc...@malkom.pl owner-openssl-us...@openssl.org wrote on 03/28/2012 09:02:59 AM: Prashanth kumar N prashanth.kuma...@gmail.com Sent by: owner-openssl-us...@openssl.org 03/28/2012 09:06 AM Please respond to openssl-users@openssl.org To openssl-users@openssl.org cc Subject Re: How to do encryption using AES in Openssl I tried to use EVP but let if of go due to bad documentation... On Wed, Mar 28, 2012 at 2:49 AM, Jakob Bohm jb-open...@wisemo.com wrote: On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10 call:+4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org evp_enc.c Description: Binary data
RE: How to do encryption using AES in Openssl
From: owner-openssl-us...@openssl.org On Behalf Of Prashanth kumar N Sent: Wednesday, 28 March, 2012 03:01 snip code; already answered As i read min AES block size is 128 bits which can go up to 256 bits in multiples of 32-bits. Is this correct? No but almost. The *algorithm* Rijndael designed by Rijmen and Daemen and submitted as an AES candidate supports various block and key sizes. But the *standard* AES allows only block 128 and key 128 192 or 256. Technically this is a profile of Rijndael, and most implementations (including OpenSSL) implement only the AES sizes, even when the same code could implement more flexible Rijndael sizes. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Thanks Ken for pointing out the mistake... after changing to
AES_Decrypt(), it worked but i still see issue when i print the
decrypted output as it has extra non-ascii characters in it.
Below is the input
unsigned char text[]=test12345678abc2;
After decryption, i get the following string: Decrypted o/p:
test12345678abc2Ȳu�z�B�����A��S��
Few questions...
1. If we use AES, will decrypted files have same number of bytes as
encrypted file? (I assume it should be same)
2. When i did Google and found few examples on AES using CBC mode, many of
them add extra buffer while decrypting ie.,
sample eg:
unsigned char key[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
10 unsigned char iv[] = {1,2,3,4,5,6,7,8};
11 unsigned char outbuf[1024];
12 unsigned char decrebuf[1024];
13 int outlen,outlen2, tmplen;
14 unsigned char text[]=test12345678abc2;
15 char outfile[]= encfile;
if(!EVP_EncryptUpdate(ctx, outbuf, outlen, intext,
strlen(intext)))
26 {
27 /* Error */
28printf(\n Error:EVP_EncryptUpdate );
29return 0;
30}
31
32if(!EVP_EncryptFinal_ex(ctx, outbuf + outlen, tmplen))
33 {
34 /* Error */
35 printf(\n Error: EVP_EncryptFinal_ex);
36 return 0;
37 }
EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv);
45
46 if(!EVP_DecryptUpdate(ctx, decrebuf, outlen2, outbuf, outlen))
47 {
48 printf(\n Error : EVP_DecryptUpdate);
49 return 0;
50 }
EVP_DecryptFinal_ex(ctx, decrebuf + outlen2, tmplen )
Here i see even thought decrebuf is 1024, we still offset it by outlen and
pass the address to Decrytpion function?
3. Why is it like we have to choose 1024 as array size... when i know my
encryption text is only 16bytes. Any reasons?
-Prashanth
On Wed, Mar 28, 2012 at 7:29 PM, Ken Goldman kgold...@us.ibm.com wrote:
On 3/28/2012 3:01 AM, Prashanth kumar N wrote:
Here is the modified program
[snip]
18 AES_KEY ectx;
19 AES_KEY dectx;
20
21 AES_set_encrypt_key(key, 256, ectx);
22 AES_encrypt(text, out, ectx);
23
24 printf(encryp data = %s\n, out);
25
26 AES_set_encrypt_key(key, 256, dectx);
AES_set_decrypt_key()
27 AES_decrypt(out, decout, dectx);
__**__**__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
Thanks Marek. I will try the attached code in the attached files.
In many of the examples i have come across, i see IV is always being. Is it
not possible to use this API by setting IV to NULL? (As i understand for
CBC IV is a must) . In AES_Encrypt(), we don't use IV. Does this mean this
does stream ciphering (byte by byte)?
Does any one know if Openssl supports AES-XTS? Reason is we are exploring
to see if we can employ this.
When i Googled, i did see some change request log which said AES-XTS has
been added to Openssl in v1.1.0 which i am not able to find for download...
Any idea on this?
-Prashanth
On Wed, Mar 28, 2012 at 8:26 PM, marek.marc...@malkom.pl wrote:
Hello,
If you want to use low-level AES functions to encrypt more then 16 bytes
you
should use AES in CBC mode. You can implement this mode using AES_encrypt
()
or better use AES_cbc_encrypt().
Using AES_encrypt() block-by-block is called ECB mode.
Look at: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
Example of using AES_cbc_encrypt() attached (pay attension of block
padding).
Best regards,
--
Marek Marcola marek.marc...@malkom.pl
owner-openssl-us...@openssl.org wrote on 03/28/2012 09:01:25 AM:
Prashanth kumar N prashanth.kuma...@gmail.com
Sent by: owner-openssl-us...@openssl.org
03/28/2012 09:03 AM
Please respond to
openssl-users@openssl.org
To
openssl-users@openssl.org
cc
Subject
Re: How to do encryption using AES in Openssl
Here is the modified program
#include stdio.h
2 #include openssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
10
11 void main()
12 {
13 unsigned char text[]=test12345678abcf;
14 unsigned char out[16];
15 unsigned char decout[16];
16 int i;
17
18 AES_KEY ectx;
19 AES_KEY dectx;
20
21 AES_set_encrypt_key(key, 256, ectx);
22 AES_encrypt(text, out, ectx);
23
24 printf(encryp data = %s\n, out);
25
26 AES_set_encrypt_key(key, 256, dectx);
27 AES_decrypt(out, decout, dectx);
28 printf( Decrypted o/p: %s \n, decout);
29
30 for (i = 0;i 16; i++)
31 printf( %02x, decout[i]);
32 }
33
As i read min AES block size is 128 bits which can go up to 256 bits in
multiples of 32-
bits. Is this correct?
I do know encrypted data is binary but when i pass the same data to
AES_decrypt()
fucntion and print using %s, i get non-readable characters. What i
notice is when i
change the input plain text, i do see o/p vaires.
On Tue, Mar 27, 2012 at 11:24 PM, Ken Goldman kgold...@us.ibm.com
wrote:
On 3/27/2012 1:33 PM, pkumarn wrote:
I am trying to write a sample program to do AES encryption using
Openssl. I
tried going through Openssl documentation( it's a pain), could not
figure
out much. I went through the code and found the API's using which i
wrote a
small program as below (please omit the line numbers). I don't see any
encryption happening... am i missing something?
Define I don't see any encryption happening.
PS: I don't get any errors upon compilation.
1 #includestdio.h
2 #includeopenssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
It's strange to define a 256 bit key and use 128 bits.
10
11 void main()
12 {
13 unsigned char text[]=virident;
The input must be equal to the AES block size.
14 unsigned char out[10];
The output must be equal to the AES block size.
15 unsigned char decout[10];
Same here.
16
17 AES_KEY wctx;
18
19 AES_set_encrypt_key(key, 128,wctx);
20 AES_encrypt(text, out,wctx);
This is a raw encrypt, which assumes input and output are one AES block.
21
22 printf(encryp data = %s\n, out);
The encrypted data is binary, not a printable C string.
23
24 AES_decrypt(out, decout,wctx);
25 printf( Decrypted o/p: %s \n, decout);
26
27
28 }
Please help me to figure this out...
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/27/2012 1:33 PM, pkumarn wrote:
I am trying to write a sample program to do AES encryption using Openssl. I
tried going through Openssl documentation( it's a pain), could not figure
out much. I went through the code and found the API's using which i wrote a
small program as below (please omit the line numbers). I don't see any
encryption happening... am i missing something?
Define I don't see any encryption happening.
PS: I don't get any errors upon compilation.
1 #includestdio.h
2 #includeopenssl/aes.h
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
It's strange to define a 256 bit key and use 128 bits.
10
11 void main()
12 {
13 unsigned char text[]=virident;
The input must be equal to the AES block size.
14 unsigned char out[10];
The output must be equal to the AES block size.
15 unsigned char decout[10];
Same here.
16
17 AES_KEY wctx;
18
19 AES_set_encrypt_key(key, 128,wctx);
20 AES_encrypt(text, out,wctx);
This is a raw encrypt, which assumes input and output are one AES block.
21
22 printf(encryp data = %s\n, out);
The encrypted data is binary, not a printable C string.
23
24 AES_decrypt(out, decout,wctx);
25 printf( Decrypted o/p: %s \n, decout);
26
27
28 }
Please help me to figure this out...
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Tue, Mar 27, 2012, pkumarn wrote: I am trying to write a sample program to do AES encryption using Openssl. I tried going through Openssl documentation( it's a pain), could not figure out much. I went through the code and found the API's using which i wrote a small program as below (please omit the line numbers). I don't see any encryption happening... am i missing something? You should really be using EVP instead of the low level routines. They are well documented with examples. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: On Tue, Mar 27, 2012, pkumarn wrote: I am trying to write a sample program to do AES encryption using Openssl. I tried going through Openssl documentation( it's a pain), could not figure out much. I went through the code and found the API's using which i wrote a small program as below (please omit the line numbers). I don't see any encryption happening... am i missing something? You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10 call:+4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. I also use the low level APIs, just because they were easier to find and understand in the source. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldman kgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/crypto/EVP_DigestInit.html Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/crypto/EVP_VerifyInit.html __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? -- Jakob Bohm, CIO, partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. direct: +45 31 13 16 10 call:+4531131610 This message is only for its intended recipient, delete if misaddressed. WiseMo - Remote Service Management for PCs, Phones and Embedded __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: How to do encryption using AES in Openssl
On Tue, Mar 27, 2012 at 5:19 PM, Jakob Bohm jb-open...@wisemo.com wrote: On 3/27/2012 10:42 PM, Jeffrey Walton wrote: On Tue, Mar 27, 2012 at 4:26 PM, Ken Goldmankgold...@us.ibm.com wrote: On 3/27/2012 3:51 PM, Jakob Bohm wrote: On 3/27/2012 9:37 PM, Dr. Stephen Henson wrote: You should really be using EVP instead of the low level routines. They are well documented with examples. Where, precisely? I didn't find it either when I was looking a few years ago, so I settled on the obvious low level APIs too. In fact, neither the low level or the EVP APIs are documented. I don't see any AES documentation at all. Digest (search for openssl evp digest example): http://www.openssl.org/docs/crypto/EVP_DigestInit.html At least this one is outdated, it recommends SHA1, does not mention any of the larger algorithms and still shows the old SSL MD5+SHA1 288 bit length as the maximum MD size. openssl/evp.h has later definitions but no documentation in it. This document also gives two good reason not to use this interface when retrofitting existing code: 1. The state structure (EVP_MD_CTX) requires an extra call to free internal memory, which may not fit into existing code that doesn't have such a requirement of its own. 2. The EVP_DigestInit_ex() function is documented as loading a specific implementation if NULL is passed, thus almost certainly ensuring that said specific implementation will be linked into programs that don't use it at all. It is also unclear how referencing a specific engine avoids loading the entire feature set of that engine when only a subset is needed. Such granularity issues basic questions one should always consider in any library design. Encrypt (search for openssl evp encrypt example): http://www.openssl.org/docs/crypto/EVP_EncryptInit.html Sign (search for openssl evp sign example): http://www.openssl.org/docs/crypto/EVP_SignInit.html Verify (search for openssl evp verify example): http://www.openssl.org/docs/crypto/EVP_VerifyInit.html (I have not checked out those yet). Explicitly adding the word EVP to those searches was non-obvious because as a programmer I tend not to consider parts of identifiers as separate search words (except when doing a raw grep). And besides, how should a newcomer to OpenSSL guess that something called EVP is of any significance? Good point. I think I learned it the hard way some time ago. Jeff __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
