5 ms·
What is really troubling is not the amount of entropy, 256 is fine for everything up to paranoia. What is troubling and reflects the sad status and detachment f
by FiloSottile 13y ago
What is really troubling is not the amount of entropy, 256 is fine for everything up to paranoia. What is troubling and reflects the sad status and detachment from reality of the project is this:
>Historically, the OpenSSL command line tools have been intended for debugging only.
- dekz 13y agoApart from genrsa, what exactly have you used the openssl cli for in the past? My answer would be the exact same as you quoted, the openssl cli tools are quite horrendous to use and you certainly wouldn't use them if you were a CA. If you are a CA or deal with certificates, openssl does provide sweet inspection dumping tools for asn1 and certs. If you have an application which generates keys or certificates, why would you system exec openssl cli when your language of choice has a Crypto implementation, or glue to OpenSSL. So I ask openly, run `history | grep openssl` and see. Even running `openssl help` is daunting unless you're familiar with most symmetric block modes.
- ryan-c 13y agoThere are a number of tools for running a small CA that wrap the OpenSSL command line tools.
- pjungwir 13y agoI use the openssl cli every time I generate a CSR or a self-signed certificate. If you Google "generate csr" you'll find lots of sites, including companies that issue SSL certificates, instructing you to use the openssl cli.
- chrisbolt 13y agoopenssl s_client -connect <hostname>:<port> Also for conversion of certificates to different formats and removing passphrases from existing certificates.
- mmastrac 13y agoI've used them a ton for ASN.1 parsing, base64 encoding/decoding, hashing, certificate dumping and the occasional RSA decryption or signature check. The command-line interface is horrendous, but man is that a useful crypto toolbox.
- FiloSottile 13y agoAll the responses in this thread, plus one-off symmetrically encrypting files.
- tptacek 13y agoThis response is baffling, because the OpenSSL CLI is just a wrapper around functions that real applications use.
- TazeTSchnitzel 13y agoI'm guessing it was a quickly written wrapper with poor error checking, or something to that effect, then.
- JoshTriplett 13y ago> What is troubling and reflects the sad status and detachment from reality of the project A random comment by one Debian developer do not constitute the position of the Debian project. On top of that, consider the subsequent comment that the information in question came from an OpenSSL developer.