Babyish Wiki
Don't have an account?
Register
Register
in: Articles with broken citations, Pages containing cite templates with deprecated parameters, 有未列明来源语句的条目,
and 6 more

Changes: OpenSSL

Back to page
Edit
Tag: sourceedit
Tag: sourceedit
Line 412: Line 412:
 
==Ikstörnol liŋks==
  
==Ikstörnol liŋks==
 
{{Commonscat|OpenSSL}}
  
{{Commonscat|OpenSSL}}
−  
 
{{Div col||30em}}
  
{{Div col||30em}}
  +
* {{Wikidata |id=1052790}}
 
* {{Official website|https://www.openssl.org/}}
  
* {{Official website|https://www.openssl.org/}}
 
* [https://people.gnome.org/~markmc/openssl-and-the-gpl.html The OpenSSL License and the GPL] by Mark McLoughlin
  
* [https://people.gnome.org/~markmc/openssl-and-the-gpl.html The OpenSSL License and the GPL] by Mark McLoughlin

Revision as of 08:21, 28 de-4-monŧ 2015

OpenSSL
OpenSSL logo
Divelopen bai The OpenSSL Project
Wraiten in C, assembly
Opèreitiŋ sistèm Cross-platform
Taip Security library
Laisèns Apache License 1.0 and four-clause BSD License
Websàit www.openssl.org

In computer networking, OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements basic cryptographic functions and provides various utility functions. Wrappers allowing the use of the OpenSSL library in a variety of computer languages are available.

Versions are available for most Unix-like operating systems (including Solaris, Linux, Mac OS X and the various open-source BSD operating systems), OpenVMS and Microsoft Windows. IBM provides a port for the System i (OS/400).

OpenSSL is based on SSLeay by Eric Andrew Young and Tim Hudson, development of which unofficially ended on December 17, 1998, when Young and Hudson both started to work for RSA Security.

Prōjekt dè històri

The OpenSSL project was founded in 1998 to invent a free set of encryption tools for the code used on the Internet. As of 2014 two thirds of all webservers use it.[1] The OpenSSL project management team consists of four Europeans. The entire development group consists of 11 members, out of which 10 are volunteers; there is only one full-time employee, Stephen Henson, the lead developer.[2]

The project has a budget of less than $1 million a year and relies in part on donations. Steve Marquess, a former military consultant in Maryland started the foundation for donations and consultancy contracts and garnered sponsorship from the United States Department of Homeland Security and the United States Department of Defense.[2]

Major version releases

OpenSSL release history[3][4][5]
Version Original release date Comment Last minor version
Old version, no longer supported: 0.9.1 December 23, 1998
  • Official start of the OpenSSL project
 0.9.1c (December 23, 1998)
Old version, no longer supported: 0.9.2 March 22, 1999
  • Successor of 0.9.1c
 0.9.2b (April 6, 1999)
Old version, no longer supported: 0.9.3 May 25, 1999
  • Successor of 0.9.2b
 0.9.3a (May 27, 1999)
Old version, no longer supported: 0.9.4 August 9, 1999
  • Successor of 0.9.3a
 0.9.4 (August 9, 1999)
Old version, no longer supported: 0.9.5 February 28, 2000
  • Successor of 0.9.4
 0.9.5a (April 1, 2000)
Old version, no longer supported: 0.9.6 September 24, 2000
  • Successor of 0.9.5a
 0.9.6m (March 17, 2004)
Old version, no longer supported: 0.9.7 December 31, 2002
  • Successor of 0.9.6m
 0.9.7m (February 23, 2007)
Older version, yet still supported: 0.9.8 July 5, 2005
  • Successor of 0.9.7m
  • Support will end on December 31, 2015[6]
 0.9.8zf (March 19, 2015)
Older version, yet still supported: 1.0.0 March 29, 2010
  • Successor of 0.9.8n
  • Support will end on December 31, 2015[6]
 1.0.0r (March 19, 2015)
Older version, yet still supported: 1.0.1 March 14, 2012
  • Successor of 1.0.0l
  • Support will end on December 31, 2016[6]
  • RFC 6520 TLS/DTLS heartbeat support.
  • SCTP support.
  • RFC 5705 TLS key material exporter.
  • RFC 5764 DTLS-SRTP negotiation.
  • Next Protocol Negotiation.
  • PSS signatures in certificates, requests and CRLs.
  • Support for password based recipient info for CMS.
  • Support TLS v1.2 and TLS v1.1.
  • Preliminary FIPS capability for unvalidated 2.0 FIPS module.
  • SRP support.
 1.0.1m (March 19, 2015)
Current stable version: 1.0.2 January 22, 2015
  • Successor of 1.0.1l
  • Suite B support for TLS 1.2 and DTLS 1.2
  • Support for DTLS 1.2
  • TLS automatic EC curve selection.
  • API to set TLS supported signature algorithms and curves
  • SSL_CONF configuration API.
  • TLS Brainpool support.
  • ALPN support.
  • CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
 1.0.2a (March 19, 2015)
Future release: 1.1.0
<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Legend:
<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Expression error: Unrecognized punctuation character "[".<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Older version, still supported<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Latest version<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Latest preview version<div style="float: left; margin-left: 1em; Expression error: Unrecognized punctuation character "[".">Future release

Algorithms

OpenSSL supports a number of different cryptographic algorithms:

Ciphers
AES, Blowfish, Camellia, SEED, CAST-128, DES, IDEA, RC2, RC4, RC5, Triple DES, GOST 28147-89[7]
Cryptographic hash functions
MD5, MD4, MD2, SHA-1, SHA-2, RIPEMD-160, MDC-2, GOST R 34.11-94[7]
Public-key cryptography
RSA, DSA, Diffie–Hellman key exchange, Elliptic curve, GOST R 34.10-2001[7]

(Perfect forward secrecy is supported using elliptic curve Diffie–Hellman since version 1.0.[8])

FIPS 140-2 compliance

截至Template:Startdate, OpenSSL is one of two open source programs to be involved with validation under the FIPS 140-2 computer security standard by the National Institute of Standards and Technology's (NIST) Cryptographic Module Validation Program (CMVP).[9] (OpenSSL itself is not validated, but a component called the OpenSSL FIPS Object Module, based on OpenSSL, was created to provide many of the same capabilities).[10]

A certificate was first awarded in January 2006 but revoked in July 2006 "when questions were raised about the validated module’s interaction with outside software." The certification was reinstated in February 2007.[11]

Licensing

OpenSSL is "dual licensed" under the OpenSSL License and the SSLeay License.[12] The OpenSSL License is Apache License 1.0 and SSLeay License bears some similarity to a 4-clause BSD License. The common usage of the term dual-license is that the user may pick which license they wish to use. However, OpenSSL documentation uses the term dual-license to mean that both licenses apply.

As the OpenSSL License is Apache License 1.0, but not Apache License 2.0, it requires the phrase This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/) to appear in advertising material and any redistributions (Sections 3 and 6 of the OpenSSL License). Due to this restriction, the OpenSSL License and the Apache License 1.0 are incompatible with the GPL.[13] Some GPL developers have added an OpenSSL exception to their licenses specifically allowing OpenSSL to be used with their system. GNU Wget and climm both use such exceptions.[14][15] Some packages (like Deluge) explicitly modify the GPL license by adding an extra section at the beginning of the license documenting the exception.[16] Other packages use the LGPL-licensed GnuTLS and MPL-licensed NSS, both of which perform the same task.

Notable vulnerabilities

Timing attacks on RSA Keys

On March 14, 2003, a timing attack on RSA keys was discovered, which meant a vulnerability within OpenSSL versions 0.9.7a and 0.9.6. This vulnerability was assigned CAN-2003-0147 by the Common Vulnerabilities and Exposures project. RSA blinding was not turned on by default by OpenSSL, since it is not easily possible to when providing SSL or TLS using OpenSSL. Almost all SSL enabled Apaches were affected, along with many other applications of OpenSSL. Timing differences on the number of extra reductions along and use of Karatsuba and normal integer multiplication algorithms meant that it was possible for local and remote attackers to obtain the private key of the server.

[來源請求]

Denial of Service ASN.1 parsing

OpenSSL 0.9.6k had a bug where certain ASN.1 sequences triggered a large amount of recursions on Windows machines, discovered on November 4, 2003. Windows could not handle large recursions correctly, so OpenSSL would crash as a result. Being able to send arbitrary large amounts of ASN.1 sequences would cause OpenSSL to crash as a result. A client certificate to a SSL/TLS enabled server could accept ASN.1 sequences and crash.

[來源請求]

OCSP stapling vulnerability

When creating a handshake, the client could send an incorrectly formatted ClientHello message, leading to OpenSSL parsing more than the end of the message. Titled CVE-2011-0014, this affected all OpenSSL versions 0.9.8h to 0.9.8q and OpenSSL 1.0.0 to 1.0.0c. Since the parsing could lead to a read on an incorrect memory address, it was possible for the attacker to cause a DDOS. It was also possible that some applications expose the contents of parsed OCSP extensions, leading to an attacker being able to read the contents of memory that came after the ClientHello.[17]

ASN1 Bio vulnerability

When using BIO or FILE based functions to read untrusted DER format data, OpenSSL is vulnerable. The CVE assigned this CVE-2012-2110, as this was discovered on April 19, 2012. While not directly affecting the SSL/TLS code of OpenSSL, any application that was using ASN1 functions (particularly d2i_X509 and d2i_PKCS12) were also not affected.[18]

SSL, TLS and DTLS Plaintext Recovery Attack

In handling CBC cipher-suites in SSL, TLS, and DTLS, OpenSSL was found to be vulnerable to a timing attack which arises during the MAC processing. This was found by Nadhem Alfardan and Kenny Paterson, who published their findings on February 5, 2013, given the name CVE-2013-0169. All versions of OpenSSL were affected, and it was only partially mitigated by the use of the OpenSSL FIPS Object Module and the FIPS mode of operation is enabled.

[來源請求]

Predictable keys (Debian-specific)

In order to keep a warning from being issued by the Valgrind analysis tool, a maintainer of the Debian distribution applied a patch to the Debian implementation of the OpenSSL suite, which inadvertently broke its random number generator in the process. The broken version was included in the Debian release of September 17, 2006 (version 0.9.8c-1). Any key generated with the broken random number generator, as well as data encrypted with such a key, was compromised.[來源請求] The error was reported by Debian on May 13, 2008.[19]

On the Debian 4.0 distribution (etch), these problems were fixed in version 0.9.8c-4etch3 and for the Debian 5.0 distribution (lenny), these problems were fixed in version 0.9.8g-9.[19]

Heartbleed

Mein artikol: Heartbleed
File:Heartbleed.svg

Logo representing Heartbleed

OpenSSL versions 1.0.1 through 1.0.1f had a severe memory handling bug in their implementation of the TLS Heartbeat Extension that could be used to reveal up to 64 kilobytes of the application's memory with every heartbeat.[20][21] By reading the memory of the web server, attackers could access sensitive data, including the server's private key.[22] This could allow attackers to decode earlier eavesdropped communications if the encryption protocol used does not ensure Perfect Forward Secrecy. Knowledge of the private key could also allow an attacker to mount a man-in-the-middle attack against any future communications.[23] The vulnerability might also reveal unencrypted parts of other users' sensitive requests and responses, including session cookies and passwords, which might allow attackers to hijack the identity of another user of the service.[24]

At its disclosure on April 7, 2014, around 17% or half a million of the Internet's secure web servers certified by trusted authorities were believed to have been vulnerable to the attack.[25] However, Heartbleed can affect both the server and client.

CCS Injection Vulnerability

CCS Injection Vulnerability (CVE-2014-0224) is a security bypass vulnerability that exists in OpenSSL. The vulnerability is due to a weakness in OpenSSL methods used for keying material.[26]

This vulnerability can be exploited through the use of a man-in-the-middle attack,[27] where an attacker may be able to decrypt and modify traffic in transit. A remote unauthenticated attacker could exploit this vulnerability by using a specially crafted handshake to force the use of weak keying material. Successful exploitation could lead to a security bypass condition where an attacker could gain access to potentially sensitive information. The attack can only be performed between a vulnerable client and server.

OpenSSL clients are vulnerable in all versions of OpenSSL before the versions 0.9.8za, 1.0.0m and 1.0.1h. Servers are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users of OpenSSL servers earlier than 1.0.1 are advised to upgrade as a precaution.[28]

ClientHello sigalgs DoS

This vulnerability allows anyone to take a certificate, read the contents and accurately modify it to abuse to exploit causing it to crash a client or server. A client connects to a OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can cause a DoS attack against the server.

A Stanford Security researcher, David Ramos had a private exploit and presented it before the OpenSSL team where they patched the issue.

OpenSSL classified the bug as a high-severity issue, noting version 1.0.2 was found vulnerable.[29]


Forks

Agglomerated SSL

In 2009, after frustrations with the original OpenSSL API, Marco Peereboom, an OpenBSD developer at the time, forked the original API by creating Agglomerated SSL (assl), which reuses OpenSSL API under the hood, but provides a much simpler external interface.[30]

LibreSSL

Mein artikol: LibreSSL

In the wake of Heartbleed, members of the OpenBSD project forked OpenSSL starting with the 1.0.1g branch, to create a project named LibreSSL.[31] In the first week of pruning the OpenSSL's codebase, more than 90,000 lines of C code had been removed from the fork.[32]

BoringSSL

In June 2014, Google announced its own fork of OpenSSL dubbed BoringSSL. Google plans to co-operate with OpenSSL and LibreSSL developers.[33]

Päkeijs

正在讀取套件清單... 完成
正在重建相依關係          
正在讀取狀態資料... 完成
籌備升級中... 完成

下列套件將會被升級：

  1. libegl1-mesa
  2. libegl1-mesa-drivers
  3. libgbm1
  4. libgl1-mesa-dev
  5. libgl1-mesa-dri
  6. libgl1-mesa-glx
  7. libglapi-mesa
  8. libgles2-mesa
  9. libgnutls-dev
  10. libgnutls-openssl27
  11. libgnutls26
  12. libgnutlsxx27
  13. libopenvg1-mesa
  14. libwayland-egl1-mesa
  15. libxatracker2
  16. linux-libc-dev
  17. mesa-common-dev
  18. unattended-upgrades
升級 18 個，新安裝 0 個，移除 0 個，有 3 個未被升級。
需要下載 8,821 kB 的套件檔。
此操作完成之後，會多佔用 6,144 B 的磁碟空間。
Do you want to continue? [Y/n] y

Dawnloudiŋ

  1. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgnutls-dev amd64 2.12.23-12ubuntu2.2 [372 kB]
  2. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgnutlsxx27 amd64 2.12.23-12ubuntu2.2 [17.3 kB]
  3. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgnutls-openssl27 amd64 2.12.23-12ubuntu2.2 [18.3 kB]
  4. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgnutls26 amd64 2.12.23-12ubuntu2.2 [393 kB]
  5. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgl1-mesa-dri amd64 10.1.3-0ubuntu0.4 [4,568 kB]
  6. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgbm1 amd64 10.1.3-0ubuntu0.4 [19.0 kB]
  7. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgl1-mesa-dev amd64 10.1.3-0ubuntu0.4 [5,242 B]
  8. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main mesa-common-dev amd64 10.1.3-0ubuntu0.4 [262 kB]
  9. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgl1-mesa-glx amd64 10.1.3-0ubuntu0.4 [114 kB]
  10. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libgles2-mesa amd64 10.1.3-0ubuntu0.4 [12.6 kB]
  11. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libwayland-egl1-mesa amd64 10.1.3-0ubuntu0.4 [6,462 B]
  12. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libegl1-mesa-drivers amd64 10.1.3-0ubuntu0.4 [1,994 kB]
  13. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libglapi-mesa amd64 10.1.3-0ubuntu0.4 [21.4 kB]
  14. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libopenvg1-mesa amd64 10.1.3-0ubuntu0.4 [13.0 kB]
  15. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libegl1-mesa amd64 10.1.3-0ubuntu0.4 [59.0 kB]
  16. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main libxatracker2 amd64 10.1.3-0ubuntu0.4 [143 kB]
  17. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main linux-libc-dev amd64 3.13.0-48.80 [778 kB]
  18. 下載: http://hk.archive.ubuntu.com/ubuntu/ trusty-updates/main unattended-upgrades all 0.82.1ubuntu2.2 [25.4 kB]
取得 8,821 kB 用了 38秒 (232 kB/s)                                             
正在預先設定套件 ...

Instoliŋ

（讀取資料庫 ... 目前共安裝了 332997 個檔案和目錄。） 

準備解開 .../libgnutls-dev_2.12.23-12ubuntu2.2_amd64.deb ...
Unpacking libgnutls-dev (2.12.23-12ubuntu2.2) over (2.12.23-12ubuntu2.1) ...

準備解開 .../libgnutlsxx27_2.12.23-12ubuntu2.2_amd64.deb ...
Unpacking libgnutlsxx27:amd64 (2.12.23-12ubuntu2.2) over (2.12.23-12ubuntu2.1) ...

準備解開 .../libgnutls-openssl27_2.12.23-12ubuntu2.2_amd64.deb ...
Unpacking libgnutls-openssl27:amd64 (2.12.23-12ubuntu2.2) over (2.12.23-12ubuntu2.1) ...

準備解開 .../libgnutls26_2.12.23-12ubuntu2.2_amd64.deb ...
Unpacking libgnutls26:amd64 (2.12.23-12ubuntu2.2) over (2.12.23-12ubuntu2.1) ...

準備解開 .../libgl1-mesa-dri_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libgl1-mesa-dri:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libgbm1_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libgbm1:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libgl1-mesa-dev_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libgl1-mesa-dev (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../mesa-common-dev_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking mesa-common-dev (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libgl1-mesa-glx_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libgl1-mesa-glx:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libgles2-mesa_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libgles2-mesa:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libwayland-egl1-mesa_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libwayland-egl1-mesa:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libegl1-mesa-drivers_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libegl1-mesa-drivers:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libglapi-mesa_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libglapi-mesa:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libopenvg1-mesa_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libopenvg1-mesa:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libegl1-mesa_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libegl1-mesa:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../libxatracker2_10.1.3-0ubuntu0.4_amd64.deb ...
Unpacking libxatracker2:amd64 (10.1.3-0ubuntu0.4) over (10.1.3-0ubuntu0.3) ...

準備解開 .../linux-libc-dev_3.13.0-48.80_amd64.deb ...
Unpacking linux-libc-dev:amd64 (3.13.0-48.80) over (3.13.0-46.79) ...

準備解開 .../unattended-upgrades_0.82.1ubuntu2.2_all.deb ...
Unpacking unattended-upgrades (0.82.1ubuntu2.2) over (0.82.1ubuntu2.1) ...

Setiŋ

Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Processing triggers for ureadahead (0.100.0-16) ...
ureadahead will be reprofiled on next reboot
設定 libgnutls26:amd64 (2.12.23-12ubuntu2.2) ...
設定 libgnutlsxx27:amd64 (2.12.23-12ubuntu2.2) ...
設定 libgnutls-openssl27:amd64 (2.12.23-12ubuntu2.2) ...
設定 libgnutls-dev (2.12.23-12ubuntu2.2) ...
設定 libgl1-mesa-dri:amd64 (10.1.3-0ubuntu0.4) ...
設定 libgbm1:amd64 (10.1.3-0ubuntu0.4) ...
設定 mesa-common-dev (10.1.3-0ubuntu0.4) ...
設定 libglapi-mesa:amd64 (10.1.3-0ubuntu0.4) ...
設定 libgl1-mesa-glx:amd64 (10.1.3-0ubuntu0.4) ...
設定 libgl1-mesa-dev (10.1.3-0ubuntu0.4) ...
設定 libgles2-mesa:amd64 (10.1.3-0ubuntu0.4) ...
設定 libegl1-mesa:amd64 (10.1.3-0ubuntu0.4) ...
設定 libwayland-egl1-mesa:amd64 (10.1.3-0ubuntu0.4) ...
設定 libopenvg1-mesa:amd64 (10.1.3-0ubuntu0.4) ...
設定 libegl1-mesa-drivers:amd64 (10.1.3-0ubuntu0.4) ...
設定 libxatracker2:amd64 (10.1.3-0ubuntu0.4) ...
設定 linux-libc-dev:amd64 (3.13.0-48.80) ...
設定 unattended-upgrades (0.82.1ubuntu2.2) ...
Processing triggers for libc-bin (2.19-0ubuntu6.6) ...

Jenereitiŋ çörtifikeits

tom@MW-GAMP103240:~$ openssl genrsa -out rootCA.key 2048[34]
Generating RSA private key, 2048 bit long modulus
..............+++
....................................................................................+++
e is 65537 (0x10001)

tom@MW-GAMP103240:~$ ls -l rootCA.key 
-rw-rw-r-- 1 tom tom 1679 Apr 28 15:52 rootCA.key

See also

File:Cryptography Free software portal
  • Comparison of TLS implementations
  • POSSE project

References

  1. ↑ "Critical crypto bug in OpenSSL opens two-thirds of the Web to eavesdropping". Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/. 
  2. ↑ 2.0 2.1 Yadron, Danny (2014-04-11). "Internet Security Relies on Very Few" in (Iŋgliš/English). WSJ.com. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://online.wsj.com/news/articles/SB20001424052702303873604579495362672447986. Ritrīven on 14 April 2014-04-14. 
  3. ↑ "OpenSSL – Project Newsflash". OpenSSL Software Foundation. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/. Ritrīven on 11 February 2013. 
  4. ↑ "OpenSSL – News summary". OpenSSL Software Foundation. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/news.html. Ritrīven on 11 February 2013. 
  5. ↑ "OpenSSL – Changelog". OpenSSL Software Foundation. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/changelog.html. Ritrīven on 29 October 2013. 
  6. ↑ 6.0 6.1 6.2 "OpenSSL: About, Release Strategy". OpenSSL Software Foundation. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/about/releasestrat.html. Ritrīven on 30 December 2014. 
  7. ↑ 7.0 7.1 7.2 "GOST engine OpenSSL 1.0.0 README". cvs.openssl.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://cvs.openssl.org/fileview?f=openssl/engines/ccgost/README.gost. 
  8. ↑ "Protecting data for the long term with forward secrecy". Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://googleonlinesecurity.blogspot.com.au/2011/11/protecting-data-for-long-term-with.html. Ritrīven on 2012-11-05. 
  9. ↑ Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules. NIST. Retrieved 2012-12-19.
  10. ↑ "Important Notes about OpenSSL and FIPS 140-2". openssl.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/docs/fips/fipsnotes.html. 
  11. ↑ "NIST recertifies open source encryption module". gcn.com. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.gcn.com/online/vol1_no1/43142-1.html. 
  12. ↑ "OpenSSL: Source, License". openssl.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/source/license.html. 
  13. ↑ "Licenses – Free Software Foundation". fsf.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.fsf.org/licensing/licenses. 
  14. ↑ "WGET 1.10.2 for Windows (win32)". users.ugent.be. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://users.ugent.be/~bpuype/wget. 
  15. ↑ "Releases of source and binaries". climm.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.climm.org/download.shtml.en. Ritrīven on 30 November 2010. 
  16. ↑ "Deluge LICENSE file". deluge-torrent.org. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://git.deluge-torrent.org/deluge/plain/LICENSE. Ritrīven on 24 January 2013. 
  17. ↑ "OpenSSL Updates Fix Critical Security Vulnerabilities [09 Aug 2014"]. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://blogs.comodo.com/it-security/openssl-updates-fix-critical-security-vulnerabilities/. Ritrīven on 25 Aug 2014. 
  18. ↑ "ASN1 BIO vulnerability". OpenSSL. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/secadv_20120419.txt. 
  19. ↑ 19.0 19.1 "DSA-1571-1 openssl – predictable random number generator". Debian. May 13, 2008. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.debian.org/security/2008/dsa-1571. 
  20. ↑ OpenSSL.org (7 April 2014). "OpenSSL Security Advisory [07 Apr 2014"]. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/secadv_20140407.txt. Ritrīven on 9 April 2014. 
  21. ↑ OpenSSL (2014-04-07). "TSL heartbeat read overrun (CVE-2014-0160)". Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/secadv_20140407.txt. Ritrīven on 2014-04-08. 
  22. ↑ Codenomicon Ltd (2014-04-08). "Heartbleed Bug". Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://heartbleed.com/. Ritrīven on 2014-04-08. 
  23. ↑ "Man in Middle Attacks [04 Jun 2014"]. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://blogs.comodo.com/it-security/openssl-vulnerability-exploited-man-middle-attacks/. Ritrīven on 25 Aug 2014. 
  24. ↑ "Why Heartbleed is dangerous? Exploiting CVE-2014-0160". IPSec.pl. 2014. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://ipsec.pl/ssl-tls/2014/why-heartbleed-dangerous-exploiting-cve-2014-0160.html. 
  25. ↑ Mutton, Paul (8 April 2014). "Half a million widely trusted websites vulnerable to Heartbleed bug". Netcraft Ltd.. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html. Ritrīven on 8 April 2014. 
  26. ↑ "OpenSSL continues to bleed out more flaws – more critical vulnerabilities found". Cyberoam Threat Research Labs. 2014. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.cyberoam.com/blog/openssl-continues-to-bleed-out-more-flaws-more-critical-vulnerabilities-found/. 
  27. ↑ "CVE-2014-0224". CVE. 2014. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. 
  28. ↑ "OpenSSL Security Advisory [05 Jun 2014"]. OpenSSL. 2014. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. https://www.openssl.org/news/secadv_20140605.txt. 
  29. ↑ "OpenSSL Patches Severe Denial-of-Service Vulnerability [20 March 2015"]. Brandon Stosh. 2015. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://freedomhacker.net/openssl-patches-severe-denial-of-service-vulnerability-3818/. 
  30. ↑ "security/assl: assl-1.5.0p0v0 – hide awful SSL API in a sane interface". OpenBSD ports. 2014-05-22. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://ports.su/security/assl. Ritrīven on 2015-02-10. 
  31. ↑ "OpenBSD has started a massive strip-down and cleanup of OpenSSL". OpenBSD journal. 2014-04-15. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.undeadly.org/cgi?action=article&sid=20140415093252&mode=expanded. 
  32. ↑ "OpenBSD forks, prunes, fixes OpenSSL". ZDNet. 21 April 2014. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/. Ritrīven on 21 April 2014. 
  33. ↑ "Google unveils independent 'fork' of OpenSSL called 'BoringSSL'". Ars Technica. 2014-06-21. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://arstechnica.com/security/2014/06/google-unveils-independent-fork-of-openssl-called-boringssl/. 
  34. ↑ "Creating Your Own SSL Certificate Authority (and Dumping Self Signed Certs)" in (Iŋgliš/English). 2012-03-01. Archived from the original. You must specify the date the archive was made using the |archivedate= parameter. http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/. 

Ikstörnol liŋks

Commons-logo
Wikimedia Commons has media related to:


Template:Cryptographic software Template:SSL/TLS

Community content is available under CC-BY-SA unless otherwise noted.