book

Network Security with OpenSSL

by John Viega, Matt Messier, Pravir Chandra

June 2002

Intermediate to advanced

384 pages

13h 21m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Dedication
A Note Regarding Supplemental Files
Preface
About This BookConventions Used in This Book Comments and Questions Acknowledgments
1. Introduction
1.1. Cryptography for the Rest of Us1.1.1. Goals of Cryptography1.1.2. Cryptographic Algorithms1.1.2.1. Symmetric key encryption1.1.2.2. Public key encryption1.1.2.3. Cryptographic hash functions and Message Authentication Codes1.1.2.4. Digital signatures1.2. Overview of SSL1.3. Problems with SSL1.3.1. Efficiency1.3.1.1. Cryptographic acceleration hardware1.3.1.2. Load balancing1.3.2. Keys in the Clear1.3.3. Bad Server Credentials1.3.4. Certificate Validation1.3.5. Poor Entropy1.3.6. Insecure Cryptography1.4. What SSL Doesn’t Do Well1.4.1. Other Transport Layer Protocols1.4.2. Non-Repudiation1.4.3. Protection Against Software Flaws1.4.4. General-Purpose Data Security1.5. OpenSSL Basics1.6. Securing Third-Party Software1.6.1. Server-Side Proxies1.6.2. Client-Side Proxies
2. Command-Line Interface
2.1. The Basics2.1.1. Configuration Files2.2. Message Digest Algorithms2.2.1. Examples2.3. Symmetric Ciphers2.3.1. Examples2.4. Public Key Cryptography2.4.1. Diffie-Hellman2.4.1.1. Examples2.4.2. Digital Signature Algorithm2.4.2.1. Examples2.4.3. RSA2.4.3.1. Examples2.5. S/MIME2.5.1. Examples2.6. Passwords and Passphrases2.7. Seeding the Pseudorandom Number Generator
3. Public Key Infrastructure (PKI)
3.1. Certificates3.1.1. Certification Authorities3.1.1.1. Private Certification Authorities3.1.1.2. Public Certification Authorities3.1.2. Certificate Hierarchies3.1.3. Certificate Extensions3.1.4. Certificate Revocation Lists3.1.5. Online Certificate Status Protocol3.2. Obtaining a Certificate3.2.1. Personal Certificates3.2.2. Code-Signing Certificates3.2.3. Web Site Certificates3.3. Setting Up a Certification Authority3.3.1. Creating an Environment for Your Certification Authority3.3.2. Building an OpenSSL Configuration File3.3.3. Creating a Self-Signed Root Certificate3.3.4. Issuing Certificates3.3.5. Revoking Certificates
4. Support Infrastructure
4.1. Multithread Support4.1.1. Static Locking Callbacks4.1.2. Dynamic Locking Callbacks4.2. Internal Error Handling4.2.1. Manipulating Error Queues4.2.2. Human-Readable Error Messages4.2.3. Threading and Practical Applications4.3. Abstract Input/Output4.3.1. Source/Sink BIOs4.3.1.1. Memory sources/sinks4.3.1.2. File sources/sinks4.3.1.3. Socket sources/sinks4.3.1.4. BIO pairs4.3.2. Filter BIOs4.4. Random Number Generation4.4.1. Seeding the PRNG4.4.2. Using an Alternate Entropy Source4.5. Arbitrary Precision Math4.5.1. The Basics4.5.2. Mathematical Operations4.5.3. Generating Prime Numbers4.6. Using Engines
5. SSL/TLS Programming
5.1. Programming with SSL5.1.1. The Application(s) to Secure5.1.2. Step 1: SSL Version Selection and Certificate Preparation5.1.2.1. Background 5.1.2.2. Certificate preparation5.1.2.3. Our example extended5.1.3. Step 2: Peer Authentication5.1.3.1. Background5.1.3.2. Incorporating trusted certificates5.1.3.3. Certificate verification5.1.3.4. Incorporating certificate revocation lists5.1.3.5. Post-connection assertions5.1.3.6. Further extension of the examples5.1.4. Step 3: SSL Options and Cipher Suites5.1.4.1. Setting SSL options5.1.4.2. Ephemeral keying5.1.4.3. Cipher suite selection5.1.4.4. The final product5.1.4.5. Beyond the example5.2. Advanced Programming with SSL5.2.1. SSL Session Caching5.2.1.1. Client-side SSL sessions5.2.1.2. Server-side SSL sessions5.2.1.3. An on-disk, session caching framework5.2.2. I/O on SSL Connections5.2.2.1. Reading and writing functions5.2.2.2. Blocking I/O5.2.2.3. Non-blocking I/O5.2.3. SSL Renegotiations5.2.3.1. Implementing renegotiations5.2.3.2. Renegotiations in 0.9.75.2.3.3. Further notes
6. Symmetric Cryptography
6.1. Concepts in Symmetric Cryptography6.1.1. Block Ciphers and Stream Ciphers6.1.2. Basic Block Cipher Modes6.2. Encrypting with the EVP API6.2.1. Available Ciphers6.2.1.1. AES6.2.1.2. Blowfish6.2.1.3. CAST56.2.1.4. DES6.2.1.5. DESX6.2.1.6. Triple DES6.2.1.7. IDEA6.2.1.8. RC2™6.2.1.9. RC4™6.2.1.10. RC5™6.2.2. Initializing Symmetric Ciphers6.2.3. Specifying Key Length and Other Options6.2.4. Encryption6.2.5. Decryption6.2.6. Handling UDP Traffic with Counter Mode6.3. General Recommendations
7. Hashes and MACs
7.1. Overview of Hashes and MACs7.2. Hashing with the EVP API7.3. Using MACs7.3.1. Other MACs7.3.1.1. CBC-MAC7.3.1.2. XCBC-MAC7.3.1.3. XOR-MAC7.3.1.4. UMAC7.4. Secure HTTP Cookies

8. Public Key Algorithms
8.1. When to Use Public Key Cryptography8.2. Diffie-Hellman8.2.1. The Basics8.2.2. Generating and Exchanging Parameters8.2.3. Computing Shared Secrets8.2.4. Practical Applications8.3. Digital Signature Algorithm (DSA)8.3.1. The Basics8.3.2. Generating Parameters and Keys8.3.3. Signing and Verifying 8.3.4. Practical Applications8.4. RSA8.4.1. The Basics8.4.2. Generating Keys8.4.3. Data Encryption, Key Agreement, and Key Transport8.4.4. Signing and Verifying8.4.5. Practical Applications8.5. The EVP Public Key Interface8.5.1. Signing and Verifying8.5.2. Encrypting and Decrypting8.6. Encoding and Decoding Objects8.6.1. Writing and Reading DER-Encoded Objects8.6.2. Writing and Reading PEM-Encoded Objects
9. OpenSSL in Other Languages
9.1. Net::SSLeay for Perl9.1.1. Net::SSLeay Variables9.1.2. Net::SSLeay Error Handling9.1.3. Net::SSLeay Utility Functions9.1.4. Net::SSLeay Low-Level Bindings9.2. M2Crypto for Python9.2.1. Low-Level Bindings9.2.2. High-Level Classes9.2.2.1. M2Crypto.SSL9.2.2.2. M2Crypto.BIO9.2.2.3. M2Crypto.EVP9.2.2.4. Miscellaneous crypto9.2.3. Python Module Extensions9.2.3.1. Extensions to httplib: httpslib9.2.3.2. Extensions to urllib: m2urllib9.2.3.3. Extensions to xmlrpclib: m2xmlrpclib9.3. OpenSSL Support in PHP9.3.1. General Functions9.3.2. Certificate Functions9.3.3. Encryption and Signing Functions9.3.4. PKCS#7 (S/MIME) Functions
10. Advanced Programming Topics
10.1. Object Stacks10.2. Configuration Files10.3. X.50910.3.1. Generating Requests10.3.1.1. Subject name10.3.1.2. X.509 Version 3 extensions10.3.1.3. Putting it all together10.3.2. Making Certificates10.3.3. X.509 Certificate Checking10.4. PKCS#7 and S/MIME10.4.1. Signing and Verifying10.4.2. Encrypting and Decrypting10.4.3. Combined Operations10.4.4. PKCS#7 Flags10.5. PKCS#1210.5.1. Wrapping Information into a PKCS#12 Object10.5.2. Importing Objects from PKCS#12 Data
A. Command-Line Reference
asn1parse
ca
ciphers
crl
crl2pkcs7
dgst
dhparam
dsa
dsaparam
enc
errstr
gendsa
genrsa
nseq
passwd
pkcs7
pkcs8
pkcs12
rand
req
rsa
rsautl
s_client
s_server
s_time
sess_id
smime
speed
spkac
verify
version
x509
Index
About the Authors
Colophon
Copyright

Content preview from Network Security with OpenSSL

Name

rsautl

Synopsis

The rsautl command is used to utilize RSA keys for encryption and signing. It can be used to encrypt and decrypt data, as well as sign and verify signatures.

Options

-in filename: Specify the name of a file from which data will be read. If this option is omitted, stdin will be used.
-inkey filename: Specify the name of a file containing the public or private key to use. By default, the file should contain a private key unless the pubin or certin option is specified.
-pubin: Indicate that the file specified by the inkey option contains a public key.
-certin: Indicate that the file specified by the inkey option contains a certificate, which contains a public key.
-out filename: Specify the name of a file to which data will be written. If this option is omitted, stdout will be used.
-hexdump: Cause the output data to be output in a hexdump format.
-asn1parse: Cause the output data to be ASN.1-parsed and output in the same format as the one that the asn1parse command emits.
-sign: Cause the input data to be signed and the output to be the result. Signing requires a private key. Note that because signing uses the RSA algorithm directly, only small pieces of data can be signed.
-verify: Cause the input data to be interpreted as a signature and verified. The output is the original input data that was signed. Verifying requires the public key matching the private key that was used to sign the data.
-encrypt: Cause the input data to be encrypted. Encryption requires a public ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cryptography: Learn Public Key Infrastructure from Scratch

Publisher Resources

ISBN: 059600270XErrata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design