4 ms·
We now have GPG, openssl (not the best software, but after so many iterations can be considered...decent) and openssh. But even then with these great libraries
by dublinclontarf 15y ago
We now have GPG, openssl (not the best software, but after so many iterations can be considered...decent) and openssh.
But even then with these great libraries there is much room for mistakes, openssl is just horrible to use IMO.
- matthavener 15y agoOpenSSH uses OpenSSL for crypto
- yuhong 15y agoYea, OpenSSL can be used as part of a stack. tptacek is objecting to developers using OpenSSL directly.
- tptacek 15y agoOpenSSL is the worst kind of crypto library: the kind that gives you a menu of ciphers and a menu of cipher modes and says "go to town". There is virtually no chance that a generalist developer will ever build sound crypto with a library like that. The good kind of crypto library is Keyczar. Keyczar removes degrees of freedom; it says, "you don't tell me what block cipher to use, and you don't remember that your messages need a MAC, and you don't choose the order operations happen in, and your keys are all going to be from a CSPRNG, and you'll use this keystore, and that will be that". There are a very few other libraries like that (Guttman's cryptlib is another). Unfortunately, nobody uses libraries like that. They use OpenSSL (via their language's bindings to it) which seems to work until it blows up in their face during a pentest. My best advice is to use Bouncycastle's PGP implementation, which again removes all the degrees of freedom and has the benefit of building on very well studied constructions (poorly regarded constructions, but survivors nonetheless).
- wingo 15y agoWhat do you think of GnuTLS, Thomas?
- listrophy 15y agoWhat about writing a library that wraps OpenSSL and only implements a couple, strong ciphers/modes? Specifically, AES-256-CBC and RSA 4096? I mean, I've done my homework: I know enough to not call myself an expert, yet also know enough to avoid every crypto-algorithm like the plague until I've thoroughly investigated it and its "competitors."
- tptacek 15y agoSaying "AES-256-CBC and RSA 4096" isn't nearly enough detail to assess whether you know what you're talking about, and pushing me through a thread to the limit of what I personally know how to break is just going to give you false confidence, because I know less than a lot of people I know. In case this is what you were implying: it is absolutely not the case that the big problem with OpenSSL is that it'll let you use Camellia in ECB or 512 bit ElGamal. The problem is that there are (a) more things you can do terribly wrong with AES-256-CBC than there are things you ar likely to do with wrong with, say, C memory handling, and (b) things you have to do well beyond encrypting soundly with AES-256-CBC to make your system work as a whole.
- listrophy 15y agoAs with all things security, nothing is absolute... your reply is well received. Thank you.
- caf 15y agoOpenSSL does at least provide some high level interfaces now - EVP_Seal* & EVP_Sign* (and their inverses, EVP_Open* and EVP_Verify*) seem reasonable.