emboss

t = Thread.new do
  pid = Process.fork do
   loop do
     puts "Hi"
     sleep 0.5
   end
  end
  puts "Use 'kill -9 #{pid}' to kill me!"
  Process.wait pid  
end

emboss

==> openssl-build.bash <==
#!/bin/bash

set -e -x

export CFLAG="-g"
export CFLAGS="-g"

# Debugging Target
# debug-linux-elf-noefence

emboss

# Original castealer.rb with analysis
#####################################################################################
 
require 'rubygems' #redundant
require 'openssl'
require 'digest/md5' #redundant
 
key = OpenSSL::PKey::RSA.new(2048)
cipher = OpenSSL::Cipher::AES.new(256, :CBC) #redundant
ctx = OpenSSL::SSL::SSLContext.new #redundant

emboss

sjcl (http://crypto.stanford.edu/sjcl/)

crypto-js (https://code.google.com/p/crypto-js/)

jsCrypto (https://code.google.com/p/jscryptolib/)

triplesec (https://github.com/keybase/triplesec)

polycrypt (https://github.com/polycrypt)

emboss

The new Krypt::Asn1 implementation, written entirely in Ruby
                        vs.
OpenSSL::ASN1/OpenSSL::X509, both written in native C/Java code.


$ ruby --version
ruby 2.1.0dev (2013-09-25 trunk 43039) [x86_64-linux]

$ ruby -Ilib tmp/bm_asn1_parse.rb 
       

emboss

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
 
public class TestPolicyFiles {
 
    public static void main(String[] args) {
        try {
            KeyGenerator keygen = KeyGenerator.getInstance("AES");
            keygen.init(256);

emboss

Secure installation of OpenSSL FIPS module.

While looking into the "FIPS mode" of OpenSSL recently, I found this. What puzzled me was the footnote about "secure installation", and the details from section 6.6 of the OpenSSL FIPS User Guide. To count as a valid installation that fulfills all of the requirements, users are required to verify the integrity of the OpenSSL FIPS sources with an independently acquired FIPS 140-2-validated cryptographic module. The programmer in us immediately shouts "Infinite recursion!" and what seems like an overly academical troll on behalf of the CMVP at first turns out to be a delicate issue, while not novel at all, but with far-reaching consequences for the status of any "validated" piece of software in general, or as the OpenSSL FIPS User Guide puts it:

>Note this last point is downright mind-boggling: it amounts to an assertion that essentially all installations of v

emboss

require 'openssl'

group = OpenSSL::PKey::EC::Group.new('prime256v1')
generator = group.generator #the generator point

ec = OpenSSL::PKey::EC.new
ec.group = group
ec.generate_key #generate a key pair

priv = ec.private_key #this is a random number, a OpenSSL::BN

emboss

require 'openssl'
require 'base64'

rsa = OpenSSL::PKey::RSA.new(2048)
modulus = rsa.n
exponent = rsa.e

ary = [OpenSSL::ASN1::Integer.new(modulus), OpenSSL::ASN1::Integer.new(exponent)]
pub_key = OpenSSL::ASN1::Sequence.new(ary)
base64 = Base64.encode64(pub_key.to_der)

emboss

require 'openssl'
require 'socket'

KEY = OpenSSL::PKey::RSA.new <<-_end_of_pem_
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDLwsSw1ECnPtT+PkOgHhcGA71nwC2/nL85VBGnRqDxOqjVh7Cx
aKPERYHsk4BPCkE3brtThPWc9kjHEQQ7uf9Y1rbCz0layNqHyywQEVLFmp1cpIt/
Q3geLv8ZD9pihowKJDyMDiN6ArYUmZczvW4976MU3+l54E6lF/JfFEU5hwIDAQAB
AoGBAKSl/MQarye1yOysqX6P8fDFQt68VvtXkNmlSiKOGuzyho0M+UVSFcs6k1L0
maDE25AMZUiGzuWHyaU55d7RXDgeskDMakD1v6ZejYtxJkSXbETOTLDwUWTn618T