Quale crittografia predefinita usa OpenSSL?

0

Se creo una chiave privata tramite:
openssl req -x509 -newkey rsa:2048 -out cert.crt
quindi OpenSSL scrive la chiave privata nel file privkey.pem e, se non si fornisce il parametro -nodes , crittografa la chiave privata. Quale crittografia predefinita è utilizzata?

Una chiave privata generata con questo comando: cat privkey.pem :

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIo1rE/z2PcrMCAggA
MBQGCCqGSIb3DQMHBAiDRNWrVvL7CQSCBMgkkOxb7ovb6T0xPjl40T64qNeMhYav
lqXpBLdZZGAnu6Y+Cl4yhr9/Aqnt6wWWf8Dlbdd/cRxenZ1Y+bAhiXWTVNxqMX9I
Qjk2pIpjSkIVSM3tt47XGX+7qIEQxGBaM9yq8U8FjkvkvlVFvJhhbMZQLB0wxheC
+P/YA2co74u51DZr2YKf8Oo/ZVpQ3ivv2Nv7HCDMsymQKylFtOWWup20jAUMrcVx
VAu+Nn95XYa9yBXGMxMw/52p9/FZMcgtCG5EdITP/xerVh0Qrl+aZWYs9n6yl25K
pQ7eboewA8hDHg0CrOsImm4KquB1bhHQTL8Ns5xvq7c43PEUi6CTu4/5bNlkgg71
/y9zzJH1K3xvqS2rb7tjOYLyDMvJkHguNL0WG/SxetArppdrA3wwuBeSogCEFbKE
dXoQwTPf56uMbVXjHIHCJKnn6oRNDBAUgYvd3ifsiZX0MF1Tll64iqLgUilAItoa
wASWsudJCb0HhXR73hmtPC+BQECtsXfRYmCg/ffKtZZIqXRplECWDQR8F0kcsvj1
rZQDffFKGiv9ftW6bS51a0xa1WGpIgtcNeLtz0JBGkZwN3ykQCGDkk2khBGFYxfu
Xkm2G6cuwVMDg8ekg0ie95Zj2nCjS2TtnpKFiX+kxjPmfgTFzdd9jdVyA3ZEpfC/
HZRwEfoaXDgiUP6nOBEB00VLXkjoTw7oFheP8LkX9yJkGokXeSstyl3YXyFvTbNs
vk1oa4qyTmTAaWWIpkYDFc/8p6wtQpYLqkz8eyKiNDsZIxpo5upyya1U3dEuX1Pu
XCoHDsR6t+OINW2CCtMh2VhG5FRMK0sRPDGfOof32/HbIRE/mJf+cyxdk12aXrbu
3kiKxM72LJiEmcP2Yzw9Wbgnen5zBZlLEcLopHqVdWZS1QNKvpGHl+drUAGmGGIZ
fB4evfS2YLmZrhP01nAqNwRHntJXlyoOWKsJz9F6RAA87tGRhAuKX9R7j6vMFrU8
83RL3JAqnt1AvSOSkd8NMJb041aSKvlRcGC1Gzw/kebzQTy5m4PZDiNrgnRGtucO
KPwyMA43HnObY4apD5H8VQrgREp+o1Rnjnvx3+l8o7SuGXf7CqMT6B2kpYgECSP5
9f3YNLkxGZFAoD5G4QPQRHLJmoFsiZ25bYVjleCHIR05WkktV6ps9Hk5qyQocmaU
Agf4opOJfV3KoL3czcnNLdXzG+O6q1n9W+9OCI7ku+Z/v+K8sQkUaH0qjc8w3tV/
Bjq+6kvyk70V9rftbu0yu2gBXqjTdtCE4jhM4pdAGpC2iQr0pKGMRYaSDqNbXtZX
bRreZTxxk8mI+mEjpIyA8jrm0E6jdBd2M0SLI4VCUdkINyk1zRZp+A2zZMUhMp5V
jC2syFs2Od19Ax7WVj+bkDsRSF0TKdpp8/hC9zEzz+oztrhHOG3+sfJJznjm4ZtW
Wm2Wwa5PVQxNVIXT5kX6/HNBdgRdc09bYAo5KPXgeNNgd7Jpz1GinEIR4y8mZa8s
DXkBlXfew+jzHA7eqRSWdwVHvlj9an6snSuBeKjNYKew9zRTX1ANFpq4Pa9mV+LI
/ckYfEoHD3wLWohzNs42dNvtj4DWeqlIHiu5dEpLMjxKeMvqMFxP/SZufE3VCMN+
sMY=  
-----END ENCRYPTED PRIVATE KEY-----

Se si genera una chiave privata RSA con:
openssl genrsa -out privkey2.pem 2048
quindi non è crittografato per impostazione predefinita. Se aggiungi -aes256 (o qualsiasi altra cosa supportata) l'output sarà:
cat privkey2.pem

-----BEGIN RSA PRIVATE KEY-----  
Proc-Type: 4,ENCRYPTED  
DEK-Info: AES-256-CBC,D02DE734A8C2DBA625FC4180E7AECC78

T6KNkW3KdCoIaAoLqBaDZIqFbG9o8Zk+xy+N10GKJTSS51kW1At7zV0JWbnpSpsR
X/M/ntawXqntZdffX+YQSc3wkd7cAislnclfnRPuoXjHl8VVN3cw1nDV7En2RrwD
4V2zwcnMtzct6chKE+fitOB+br0+G073Rd3IcBWRnu978zHu+geKUnzC4HIylrhq
mbsAQBpPpq1GS0Si/hKRG3MZl4tCAtfdWUC8xTKJ/JKb7IC/wGb3FmegMRAkahXn
NqbyoFG0UmM25KGSYNJQl+iEVubF1T66HTBstN1Eccmq5Cas1FGWCtLE1+RiYziL
ve+ZXPjxy+a0zsnA1FKRLpAb/TH2U4PdBQpznfw1ULszAiO/9oX7lU/ImjvmT8Zd
ko3OKb4wlaEN3/I3aD/RQq1rJwXY09+235PNSj/W7MUZ67N14/K/Q+6mVYykj+I7
VhEt54xa39kHpO5UWbEitnNYlmJmTs+tzJZkSzxjCPTYMzYX+CSJvYZ7Qa5Fazq4
XDXyYL7qbTaaxBloj1TKSbnGDxfW4aTLgDg63zNBQyz/jRPBsQE9KdtFr2Tndkvr
efbiz+gKHFsdl0xnZJax/AtTgL1DFwID/zMrrPXRy60mHMRf4s8Uab9X5aqflqch
iIQA55b+pZuhvNPWsW39H7xQDrYeLACaP0c8cHrsDTALh9ebQrrIfC7iutU5Nih8
1E4xLz0/6H4VtLXx78cYTkFTlb4Quar5W2MxzIZK27Rn5XvWWoHc0tLZQVVzyGfj
+/ZRbBv+VPkHwhNUHH+dyeiA6dmY/B/hsbftjx3tAt0DsEoMTYUZ0eY24kOb1FGg
WZpws2PQEOOCU/Wpflbf4o8Go1NY/1UjKOieqS1bphzFO9CthdBEmlx6nnW+X2jc
JgXkhh7dWp6Z/ziSmfXaCfKIhCwmxUbL5OFgRZIaTSIl2BNGunBFoLIAJHl1YPMy
Fyr29bj9yvvMFwFgiGfJ6euDKh8J28FFacKAptEnIDJITKX9lnTTlJnSC7AKUN/z
GlJbh+ZAnMn5nR0ghS8DS42A8nXfClfKiRO277e7sf/RWq/ktBrjS65bDvhiz7nl
QuF+BJiAZL6Evfj5IQA4V7xpbdt/izjIjQAeOT8UejVs9XJGu90sLlDXlnBLxowV
K1gqU5kj1Uqt3kzU7omokNGM8LRaiPj6brWt3zOzWiyQb0RUGHbm7tEVQXcoAa8h
SEtZRPmUgyIiLIA23uASVUcV7qL4TYlO4mL1KeaC/8ZAEjFAECQSNu6l80lChunE
jbftFHV9vPZkyiM3Sfjv49PNoJ2v7NdBUTZr+ajiDIi1AW7lXmrcIBHo15a4+pHU
PvMvJXO5cXwexzbuBADicXcq1PooZogs6mFlHuDDBb9avnZhVTk+yq+Ii8OTvDVi
ZdFxQhxB6FbV72xdqRXvaqwujcvQRWVmUM4jUR+WQR1ZcW1jl1UjJKu+CcfmbjPG
RlK10HH4CId3VqHsYUhf2JuzLcRwR4dng5Z/Ye3c0hip0QRBWyp/HzVh66ItPtB9
A2UIk2IBvMI9YPciXTWSjcZogemRH1GL0ZiE0Lgma9iPttdWSofL0yJ09lUW3bR6  
-----END RSA PRIVATE KEY-----

Non ho trovato alcun comando per ottenere il tipo di crittografia.

La passphrase per entrambi sono: pass .

    
posta Rufus_12 21.05.2014 - 13:23
fonte

2 risposte

1

Penso che l'interruttore -nodes lo doni quasi. Utilizza 3DES in modalità CBC, quella che è specificata in questo RFC . La pagina delle FAQ dell'autore di questo specifico strumento OpenSSL menziona questo.

Puoi confermare usando il codice sorgente. È il primo impostato sul valore predefinito e successivamente reset se l'utente ha fornito l'opzione -nodes .

    
risposta data 21.05.2014 - 13:46
fonte
2

des-EDE3-CBC

OpenSSL ti dirà che la crittografia è des-ede3-cbc se usi asn1parse .

Comando:

$ openssl asn1parse -in privkey.pem -i -dlimit 16

Output:

    0:d=0  hl=4 l=1294 cons: SEQUENCE
    4:d=1  hl=2 l=  64 cons:  SEQUENCE
    6:d=2  hl=2 l=   9 prim:   OBJECT            :PBES2
   17:d=2  hl=2 l=  51 cons:   SEQUENCE
   19:d=3  hl=2 l=  27 cons:    SEQUENCE
   21:d=4  hl=2 l=   9 prim:     OBJECT            :PBKDF2
   32:d=4  hl=2 l=  14 cons:     SEQUENCE
   34:d=5  hl=2 l=   8 prim:      OCTET STRING
      0000 - a3 5a c4 ff 3d 8f 72 b3-                          .Z..=.r.
   44:d=5  hl=2 l=   2 prim:      INTEGER           :0800
   48:d=3  hl=2 l=  20 cons:    SEQUENCE
   50:d=4  hl=2 l=   8 prim:     OBJECT            :des-ede3-cbc
   60:d=4  hl=2 l=   8 prim:     OCTET STRING
      0000 - 83 44 d5 ab 56 f2 fb 09-                          .D..V...
   70:d=1  hl=4 l=1224 prim:  OCTET STRING
      0000 - 24 90 ec 5b ee 8b db e9-3d 31 3e 39 78 d1 3e b8   $..[....=1>9x.>.

E secondo la documentazione di OpenSSL, des-ede3-cbc significa Three key triple DES EDE in CBC mode .

    
risposta data 29.06.2015 - 08:41
fonte

Leggi altre domande sui tag