81–84 of 84 posts
Earlier quoted context omitted.
You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…
They're rather working on the assumption that readers know that anything with a "(1)" or an "(8)" after it is a reference to a user manual. This is a very common thing in BSD doco, and in Unix doco more generally. For experienced Unix users this is likely to be true. It's something that one just learns. For novice users, it is less likely.
Earlier quoted context omitted.
Debian (OpenSSL), man page is present, and 2048 mod is default: openssl genrsa -out private_key.pem Generating RSA private key, 2048 bit long modulus (2 primes) These are all either MacOS or LibreSSL problems. This may not even be a LibreSSL problem since the version the author is using is 3 years old [1] MacOS userland is always so ancient, the other bits of BSD userland are even worse as far as I remember. [1] http…
> These are all MacOS | LibreSSL problems Just MacOS. > If you want documented examples, everyone should know this is where man pages suck in general, they are usually just reference manuals. OpenBSD is generally pretty good about providing some useful examples in man pages. The libressl man page has examples too, for genpkey at least.
$ openssl genrsa -out private_key.pem
Generating RSA private key, 2048 bit long modulus
.................+++
........................................+++
e is 65537 (0x10001)Earlier quoted context omitted.
If anyone really wanted FIPS 140-2 compliance for libressl they should pony up the money to get it certified instead of complaining about it on message boards.
They actively removed and refuse FIPS mode as policy. https://marc.info/?l=openbsd-misc&m=139819485423701&w=2 No one that cares enough to use LibreSSL over OpenSSL would want FIPS as reintroducing it would make LibreSSL demonstrably worse. Anyone that requires FIPS doesn't know or care enough about security to have a dog in the fight.
This is news to me! All I can say is, "Godspeed, Ted Unangst."