book

Network Security with OpenSSL

by John Viega, Matt Messier, Pravir Chandra

June 2002

Intermediate to advanced

384 pages

13h 21m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Dedication
A Note Regarding Supplemental Files
Preface
About This BookConventions Used in This Book Comments and Questions Acknowledgments
1. Introduction
1.1. Cryptography for the Rest of Us1.1.1. Goals of Cryptography1.1.2. Cryptographic Algorithms1.1.2.1. Symmetric key encryption1.1.2.2. Public key encryption1.1.2.3. Cryptographic hash functions and Message Authentication Codes1.1.2.4. Digital signatures1.2. Overview of SSL1.3. Problems with SSL1.3.1. Efficiency1.3.1.1. Cryptographic acceleration hardware1.3.1.2. Load balancing1.3.2. Keys in the Clear1.3.3. Bad Server Credentials1.3.4. Certificate Validation1.3.5. Poor Entropy1.3.6. Insecure Cryptography1.4. What SSL Doesn’t Do Well1.4.1. Other Transport Layer Protocols1.4.2. Non-Repudiation1.4.3. Protection Against Software Flaws1.4.4. General-Purpose Data Security1.5. OpenSSL Basics1.6. Securing Third-Party Software1.6.1. Server-Side Proxies1.6.2. Client-Side Proxies
2. Command-Line Interface
2.1. The Basics2.1.1. Configuration Files2.2. Message Digest Algorithms2.2.1. Examples2.3. Symmetric Ciphers2.3.1. Examples2.4. Public Key Cryptography2.4.1. Diffie-Hellman2.4.1.1. Examples2.4.2. Digital Signature Algorithm2.4.2.1. Examples2.4.3. RSA2.4.3.1. Examples2.5. S/MIME2.5.1. Examples2.6. Passwords and Passphrases2.7. Seeding the Pseudorandom Number Generator
3. Public Key Infrastructure (PKI)
3.1. Certificates3.1.1. Certification Authorities3.1.1.1. Private Certification Authorities3.1.1.2. Public Certification Authorities3.1.2. Certificate Hierarchies3.1.3. Certificate Extensions3.1.4. Certificate Revocation Lists3.1.5. Online Certificate Status Protocol3.2. Obtaining a Certificate3.2.1. Personal Certificates3.2.2. Code-Signing Certificates3.2.3. Web Site Certificates3.3. Setting Up a Certification Authority3.3.1. Creating an Environment for Your Certification Authority3.3.2. Building an OpenSSL Configuration File3.3.3. Creating a Self-Signed Root Certificate3.3.4. Issuing Certificates3.3.5. Revoking Certificates
4. Support Infrastructure
4.1. Multithread Support4.1.1. Static Locking Callbacks4.1.2. Dynamic Locking Callbacks4.2. Internal Error Handling4.2.1. Manipulating Error Queues4.2.2. Human-Readable Error Messages4.2.3. Threading and Practical Applications4.3. Abstract Input/Output4.3.1. Source/Sink BIOs4.3.1.1. Memory sources/sinks4.3.1.2. File sources/sinks4.3.1.3. Socket sources/sinks4.3.1.4. BIO pairs4.3.2. Filter BIOs4.4. Random Number Generation4.4.1. Seeding the PRNG4.4.2. Using an Alternate Entropy Source4.5. Arbitrary Precision Math4.5.1. The Basics4.5.2. Mathematical Operations4.5.3. Generating Prime Numbers4.6. Using Engines
5. SSL/TLS Programming
5.1. Programming with SSL5.1.1. The Application(s) to Secure5.1.2. Step 1: SSL Version Selection and Certificate Preparation5.1.2.1. Background 5.1.2.2. Certificate preparation5.1.2.3. Our example extended5.1.3. Step 2: Peer Authentication5.1.3.1. Background5.1.3.2. Incorporating trusted certificates5.1.3.3. Certificate verification5.1.3.4. Incorporating certificate revocation lists5.1.3.5. Post-connection assertions5.1.3.6. Further extension of the examples5.1.4. Step 3: SSL Options and Cipher Suites5.1.4.1. Setting SSL options5.1.4.2. Ephemeral keying5.1.4.3. Cipher suite selection5.1.4.4. The final product5.1.4.5. Beyond the example5.2. Advanced Programming with SSL5.2.1. SSL Session Caching5.2.1.1. Client-side SSL sessions5.2.1.2. Server-side SSL sessions5.2.1.3. An on-disk, session caching framework5.2.2. I/O on SSL Connections5.2.2.1. Reading and writing functions5.2.2.2. Blocking I/O5.2.2.3. Non-blocking I/O5.2.3. SSL Renegotiations5.2.3.1. Implementing renegotiations5.2.3.2. Renegotiations in 0.9.75.2.3.3. Further notes
6. Symmetric Cryptography
6.1. Concepts in Symmetric Cryptography6.1.1. Block Ciphers and Stream Ciphers6.1.2. Basic Block Cipher Modes6.2. Encrypting with the EVP API6.2.1. Available Ciphers6.2.1.1. AES6.2.1.2. Blowfish6.2.1.3. CAST56.2.1.4. DES6.2.1.5. DESX6.2.1.6. Triple DES6.2.1.7. IDEA6.2.1.8. RC2™6.2.1.9. RC4™6.2.1.10. RC5™6.2.2. Initializing Symmetric Ciphers6.2.3. Specifying Key Length and Other Options6.2.4. Encryption6.2.5. Decryption6.2.6. Handling UDP Traffic with Counter Mode6.3. General Recommendations
7. Hashes and MACs
7.1. Overview of Hashes and MACs7.2. Hashing with the EVP API7.3. Using MACs7.3.1. Other MACs7.3.1.1. CBC-MAC7.3.1.2. XCBC-MAC7.3.1.3. XOR-MAC7.3.1.4. UMAC7.4. Secure HTTP Cookies

8. Public Key Algorithms
8.1. When to Use Public Key Cryptography8.2. Diffie-Hellman8.2.1. The Basics8.2.2. Generating and Exchanging Parameters8.2.3. Computing Shared Secrets8.2.4. Practical Applications8.3. Digital Signature Algorithm (DSA)8.3.1. The Basics8.3.2. Generating Parameters and Keys8.3.3. Signing and Verifying 8.3.4. Practical Applications8.4. RSA8.4.1. The Basics8.4.2. Generating Keys8.4.3. Data Encryption, Key Agreement, and Key Transport8.4.4. Signing and Verifying8.4.5. Practical Applications8.5. The EVP Public Key Interface8.5.1. Signing and Verifying8.5.2. Encrypting and Decrypting8.6. Encoding and Decoding Objects8.6.1. Writing and Reading DER-Encoded Objects8.6.2. Writing and Reading PEM-Encoded Objects
9. OpenSSL in Other Languages
9.1. Net::SSLeay for Perl9.1.1. Net::SSLeay Variables9.1.2. Net::SSLeay Error Handling9.1.3. Net::SSLeay Utility Functions9.1.4. Net::SSLeay Low-Level Bindings9.2. M2Crypto for Python9.2.1. Low-Level Bindings9.2.2. High-Level Classes9.2.2.1. M2Crypto.SSL9.2.2.2. M2Crypto.BIO9.2.2.3. M2Crypto.EVP9.2.2.4. Miscellaneous crypto9.2.3. Python Module Extensions9.2.3.1. Extensions to httplib: httpslib9.2.3.2. Extensions to urllib: m2urllib9.2.3.3. Extensions to xmlrpclib: m2xmlrpclib9.3. OpenSSL Support in PHP9.3.1. General Functions9.3.2. Certificate Functions9.3.3. Encryption and Signing Functions9.3.4. PKCS#7 (S/MIME) Functions
10. Advanced Programming Topics
10.1. Object Stacks10.2. Configuration Files10.3. X.50910.3.1. Generating Requests10.3.1.1. Subject name10.3.1.2. X.509 Version 3 extensions10.3.1.3. Putting it all together10.3.2. Making Certificates10.3.3. X.509 Certificate Checking10.4. PKCS#7 and S/MIME10.4.1. Signing and Verifying10.4.2. Encrypting and Decrypting10.4.3. Combined Operations10.4.4. PKCS#7 Flags10.5. PKCS#1210.5.1. Wrapping Information into a PKCS#12 Object10.5.2. Importing Objects from PKCS#12 Data
A. Command-Line Reference
asn1parse
ca
ciphers
crl
crl2pkcs7
dgst
dhparam
dsa
dsaparam
enc
errstr
gendsa
genrsa
nseq
passwd
pkcs7
pkcs8
pkcs12
rand
req
rsa
rsautl
s_client
s_server
s_time
sess_id
smime
speed
spkac
verify
version
x509
Index
About the Authors
Colophon
Copyright

Content preview from Network Security with OpenSSL

Name

s_server

Synopsis

The s_server command is a basic SSL-enabled server that can be used as a diagnostic tool when building, setting up, and debugging SSL clients.

Options

-accept port: Specify the port on which to listen for connections. If this option is not specified, the default of 4433 is used.
-context ID: Specify any string that will be used as the SSL context ID.
-cert filename: Specify the name of a file containing the certificate to use. If this option is not specified, the command will look for a file called server.pem in the directory from which the command-line tool was started.
-key filename: Specify the name of a file containing the private key to use. The private key must match the certificate that is being used. If this option is not specified, the command will expect to find the private key in the same file as the certificate.
-dcert filename: Specify the name of a file containing an additional certificate that the server can use. This is useful for providing both RSA and DSA keys for connecting clients. There is no default if this option is not specified.
-dkey filename: Specify the name of a file containing the private key that matches the certificate specified with the dcert option. If the dcert option is specified without this one, the key should be in the same file as the certificate.
-nocert: Cause no certificate to be used. Use of this option severely restricts the ciphers that are available for use. This means that only anonymous Diffie-Hellman ciphers may ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cryptography: Learn Public Key Infrastructure from Scratch

Publisher Resources

ISBN: 059600270XErrata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design