Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I have seen that openssl can generate RSA, DSA, EC keys but what about AES? I have a mainframe that can't use RSA because I don't understand RSA. Mainframe is AS/400. Currently trying to utilize vsftpd with ssl. While I have gotten this to work with RSA cert. I need to know if it's possible to generate and AES cert.
All the documents that I have found for openssl thus far to do not mention utilizing AES. Currently also looking to see if modules can be installed to allow RSA on mainframe.
Also from what reading i have done if I understand this correctly AES would require keys to be manually exchanged while RSA does exchange at the connection point. Thus RSA will be simpler to maintain when having multiple connections top server.
Any help with this would be much appreciated, and if I have misunderstood something please speak up and let me know.
OpenSSL is based on public-key cryptography: e.g., a pair of private/public key. AES is a symmetric crypto system: e.g., one key being used at both ends. In this way, they're very different. I believe many implementations using OpenSSL use RSA or DSA to actually exchange an AES or Blowfish or similar key which actually encrypts the channel. I hope this helped clear things up a bit -- I'm not sure I totally understood the question.
Yes, you cleared things up quite a bit... If RSA is only the "transfer medium" as I would call it, then I just need to create and AES cert. Which I think I am on the right track to doing. I am following the following instructions. http://www.tc.umn.edu/~brams006/selfsign.html The only thing I did was change des3 to aes256. We'll see what happens.
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
RSA is not a transfer mechanism. It's used to authenticate the identity of each side of a transmission so that trust can be established when you exchange information securely. The authentication key never changes (well, rarely), so it needs to be very strong. The keys used to encrypt a transmission are created on the fly, and they're symmetric, so they can be much smaller (symmetric key encryption is much faster than asymmetric key encryption, but since the same key is used for decryption as encryption, you can't use this for authentication).
The -des3 argument to genrsa is used to wrap encryption around the RSA key, requiring a passphase in order to access the RSA key. It does not generate a "3DES certificate". Certificates are signed by asymmetric keys, so they nearly always signed by RSA keys (some times DSA). A certificate is just an encoded set of information with a signature.
You are confusing the term "certificate" with the term "key"; they are not the same thing.
Ok, thank you for clearing that up. So right now I am trying to figure out why my encryption level is set to 3DES 168-bit encryption when I connect. Is it because I signed AES 256 level cert with my OWN CA which was 3DES although at what level I don't know? Does the CA Determine what the level the encryption will be.
Basically I have to meet IRS Fed Requirements which states the level must be more then 256. However since this is a private server and not a public server, it doesn't require that i have cert signed by a real CA such as Verisign or other CA.
This is what I am getting when I connect to vsftpd server.
220 (vsFTPd 2.0.5)
234 Proceed with negotiation.
TLSv1, cipher TLSv1/SSLv3 (DES-CBC3-SHA) - 168 bit
331 Please specify the password.
215 UNIX Type: L8
Keep alive off...
200 PBSZ set to 0.
200 PROT now Private.
227 Entering Passive Mode (XXX.XXX.XXX.XXX)
Connect socket #612 to XXX.XXX.XXX.XXX, port 6001...
TLSv1, cipher TLSv1/SSLv3 (DES-CBC3-SHA) - 168 bit
150 Here comes the directory listing.
226 Directory send OK.
Transferred 81 bytes in 0.008 seconds
Sensitive Information remove of course.Just need to get an AES 256-bit cert. I created one but signed with 3DES.
Thanks for that Chort. Specifying the chiphers to use really helped. Now it explicitly uses 256-bit. Now if I can just wrap my head around how this all works. If I have a 1024 bit cert but the connection is only 256-bits. I'll get it figure out when I can.
The security of a given key length is highly dependent upon the cipher in use. Symmetric-key cryptosystems (AES, DES, etc.) need a significantly shorter key length to withstand an attack than a public-key (or asymmetric, as in RSA, DSA, and ElGamal) cipher. Specifically, a 1024 bit RSA key is about equivalent to an 80-bit AES key. See http://en.wikipedia.org/wiki/Key_size for details on why this is the case.
3DES is the "minimum to implement" level for many standardized protocols, so it's a violation of various protocols to not support it. Remember, most of the Internet standards were created before AES existed, and even though they've been updated since then, there's still a significant amount of software out there written to the original standard (particularly on mainframes).