book

Network Security with OpenSSL

by John Viega, Matt Messier, Pravir Chandra

June 2002

Intermediate to advanced

384 pages

13h 21m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Dedication
A Note Regarding Supplemental Files
Preface
About This BookConventions Used in This Book Comments and Questions Acknowledgments
1. Introduction
1.1. Cryptography for the Rest of Us1.1.1. Goals of Cryptography1.1.2. Cryptographic Algorithms1.1.2.1. Symmetric key encryption1.1.2.2. Public key encryption1.1.2.3. Cryptographic hash functions and Message Authentication Codes1.1.2.4. Digital signatures1.2. Overview of SSL1.3. Problems with SSL1.3.1. Efficiency1.3.1.1. Cryptographic acceleration hardware1.3.1.2. Load balancing1.3.2. Keys in the Clear1.3.3. Bad Server Credentials1.3.4. Certificate Validation1.3.5. Poor Entropy1.3.6. Insecure Cryptography1.4. What SSL Doesn’t Do Well1.4.1. Other Transport Layer Protocols1.4.2. Non-Repudiation1.4.3. Protection Against Software Flaws1.4.4. General-Purpose Data Security1.5. OpenSSL Basics1.6. Securing Third-Party Software1.6.1. Server-Side Proxies1.6.2. Client-Side Proxies
2. Command-Line Interface
2.1. The Basics2.1.1. Configuration Files2.2. Message Digest Algorithms2.2.1. Examples2.3. Symmetric Ciphers2.3.1. Examples2.4. Public Key Cryptography2.4.1. Diffie-Hellman2.4.1.1. Examples2.4.2. Digital Signature Algorithm2.4.2.1. Examples2.4.3. RSA2.4.3.1. Examples2.5. S/MIME2.5.1. Examples2.6. Passwords and Passphrases2.7. Seeding the Pseudorandom Number Generator
3. Public Key Infrastructure (PKI)
3.1. Certificates3.1.1. Certification Authorities3.1.1.1. Private Certification Authorities3.1.1.2. Public Certification Authorities3.1.2. Certificate Hierarchies3.1.3. Certificate Extensions3.1.4. Certificate Revocation Lists3.1.5. Online Certificate Status Protocol3.2. Obtaining a Certificate3.2.1. Personal Certificates3.2.2. Code-Signing Certificates3.2.3. Web Site Certificates3.3. Setting Up a Certification Authority3.3.1. Creating an Environment for Your Certification Authority3.3.2. Building an OpenSSL Configuration File3.3.3. Creating a Self-Signed Root Certificate3.3.4. Issuing Certificates3.3.5. Revoking Certificates
4. Support Infrastructure
4.1. Multithread Support4.1.1. Static Locking Callbacks4.1.2. Dynamic Locking Callbacks4.2. Internal Error Handling4.2.1. Manipulating Error Queues4.2.2. Human-Readable Error Messages4.2.3. Threading and Practical Applications4.3. Abstract Input/Output4.3.1. Source/Sink BIOs4.3.1.1. Memory sources/sinks4.3.1.2. File sources/sinks4.3.1.3. Socket sources/sinks4.3.1.4. BIO pairs4.3.2. Filter BIOs4.4. Random Number Generation4.4.1. Seeding the PRNG4.4.2. Using an Alternate Entropy Source4.5. Arbitrary Precision Math4.5.1. The Basics4.5.2. Mathematical Operations4.5.3. Generating Prime Numbers4.6. Using Engines
5. SSL/TLS Programming
5.1. Programming with SSL5.1.1. The Application(s) to Secure5.1.2. Step 1: SSL Version Selection and Certificate Preparation5.1.2.1. Background 5.1.2.2. Certificate preparation5.1.2.3. Our example extended5.1.3. Step 2: Peer Authentication5.1.3.1. Background5.1.3.2. Incorporating trusted certificates5.1.3.3. Certificate verification5.1.3.4. Incorporating certificate revocation lists5.1.3.5. Post-connection assertions5.1.3.6. Further extension of the examples5.1.4. Step 3: SSL Options and Cipher Suites5.1.4.1. Setting SSL options5.1.4.2. Ephemeral keying5.1.4.3. Cipher suite selection5.1.4.4. The final product5.1.4.5. Beyond the example5.2. Advanced Programming with SSL5.2.1. SSL Session Caching5.2.1.1. Client-side SSL sessions5.2.1.2. Server-side SSL sessions5.2.1.3. An on-disk, session caching framework5.2.2. I/O on SSL Connections5.2.2.1. Reading and writing functions5.2.2.2. Blocking I/O5.2.2.3. Non-blocking I/O5.2.3. SSL Renegotiations5.2.3.1. Implementing renegotiations5.2.3.2. Renegotiations in 0.9.75.2.3.3. Further notes
6. Symmetric Cryptography
6.1. Concepts in Symmetric Cryptography6.1.1. Block Ciphers and Stream Ciphers6.1.2. Basic Block Cipher Modes6.2. Encrypting with the EVP API6.2.1. Available Ciphers6.2.1.1. AES6.2.1.2. Blowfish6.2.1.3. CAST56.2.1.4. DES6.2.1.5. DESX6.2.1.6. Triple DES6.2.1.7. IDEA6.2.1.8. RC2™6.2.1.9. RC4™6.2.1.10. RC5™6.2.2. Initializing Symmetric Ciphers6.2.3. Specifying Key Length and Other Options6.2.4. Encryption6.2.5. Decryption6.2.6. Handling UDP Traffic with Counter Mode6.3. General Recommendations
7. Hashes and MACs
7.1. Overview of Hashes and MACs7.2. Hashing with the EVP API7.3. Using MACs7.3.1. Other MACs7.3.1.1. CBC-MAC7.3.1.2. XCBC-MAC7.3.1.3. XOR-MAC7.3.1.4. UMAC7.4. Secure HTTP Cookies

8. Public Key Algorithms
8.1. When to Use Public Key Cryptography8.2. Diffie-Hellman8.2.1. The Basics8.2.2. Generating and Exchanging Parameters8.2.3. Computing Shared Secrets8.2.4. Practical Applications8.3. Digital Signature Algorithm (DSA)8.3.1. The Basics8.3.2. Generating Parameters and Keys8.3.3. Signing and Verifying 8.3.4. Practical Applications8.4. RSA8.4.1. The Basics8.4.2. Generating Keys8.4.3. Data Encryption, Key Agreement, and Key Transport8.4.4. Signing and Verifying8.4.5. Practical Applications8.5. The EVP Public Key Interface8.5.1. Signing and Verifying8.5.2. Encrypting and Decrypting8.6. Encoding and Decoding Objects8.6.1. Writing and Reading DER-Encoded Objects8.6.2. Writing and Reading PEM-Encoded Objects
9. OpenSSL in Other Languages
9.1. Net::SSLeay for Perl9.1.1. Net::SSLeay Variables9.1.2. Net::SSLeay Error Handling9.1.3. Net::SSLeay Utility Functions9.1.4. Net::SSLeay Low-Level Bindings9.2. M2Crypto for Python9.2.1. Low-Level Bindings9.2.2. High-Level Classes9.2.2.1. M2Crypto.SSL9.2.2.2. M2Crypto.BIO9.2.2.3. M2Crypto.EVP9.2.2.4. Miscellaneous crypto9.2.3. Python Module Extensions9.2.3.1. Extensions to httplib: httpslib9.2.3.2. Extensions to urllib: m2urllib9.2.3.3. Extensions to xmlrpclib: m2xmlrpclib9.3. OpenSSL Support in PHP9.3.1. General Functions9.3.2. Certificate Functions9.3.3. Encryption and Signing Functions9.3.4. PKCS#7 (S/MIME) Functions
10. Advanced Programming Topics
10.1. Object Stacks10.2. Configuration Files10.3. X.50910.3.1. Generating Requests10.3.1.1. Subject name10.3.1.2. X.509 Version 3 extensions10.3.1.3. Putting it all together10.3.2. Making Certificates10.3.3. X.509 Certificate Checking10.4. PKCS#7 and S/MIME10.4.1. Signing and Verifying10.4.2. Encrypting and Decrypting10.4.3. Combined Operations10.4.4. PKCS#7 Flags10.5. PKCS#1210.5.1. Wrapping Information into a PKCS#12 Object10.5.2. Importing Objects from PKCS#12 Data
A. Command-Line Reference
asn1parse
ca
ciphers
crl
crl2pkcs7
dgst
dhparam
dsa
dsaparam
enc
errstr
gendsa
genrsa
nseq
passwd
pkcs7
pkcs8
pkcs12
rand
req
rsa
rsautl
s_client
s_server
s_time
sess_id
smime
speed
spkac
verify
version
x509
Index
About the Authors
Colophon
Copyright

Content preview from Network Security with OpenSSL

Name

verify

Synopsis

The verify command is used to verify the validity of X.509 certificates. It performs an exhaustive check on a certificate, including validation of each certificate in a chain of certificates.

Options

-CAfile filename: Specify the name of a file containing one or more trusted certificates.
-CApath directory: Specify the name of a directory containing trusted certificates. There should be one certificate per file in the directory, and each file should be named by the certificate issuer name’s hash and an extension of “.0”.
-untrusted filename: Specify the name of a file containing one or more untrusted certificates.
-purpose purpose: Specify the purpose for the certificate being verified. If this option is omitted, no chain verification of certificates is performed. Valid purposes are sslclient, sslserver, nssslserver, smimesign, and smimeencrypt.
-issuer_checks: Cause diagnostic messages relating to searches for issuer certificates to be printed.
-verbose: Cause extra information about the operations that are being performed to be printed.

Notes

An argument consisting only of a dash (-) is considered a marker that means each argument that follows is the name of a file containing a certificate to be verified. It may be omitted, but is useful when a filename begins with a dash. Each argument that is not an option or parameter to an option is interpreted as the name of a file containing a certificate to be verified.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cryptography: Learn Public Key Infrastructure from Scratch

Publisher Resources

ISBN: 059600270XErrata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business