Live data from Hacker News

The sorry state of OpenSSL usability (2017)

jameshfisher.com

51–60 of 84 posts

Re: The sorry state of OpenSSL usability (2017)

#51
post #16

Earlier quoted context omitted.

> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…

1. The OpenSSL API hasn't changed, and if Apple changed it on their own that would break more things 2. The issue the author complained about was `openssl --help` not working, and it doesn't work on any platform (because he got the command wrong). `openssl help` does work on OSX (I literally just tested it). 3. Yeah, that's the one issue we agree is an Apple issue. 4. Apple didn't make LibreSSL. Other systems besides…

> `openssl help` does work on OSX (I literally just tested it).

For anyone else interested, I just tested it as well. It appears that it prints a listing of all the commands offered by openssl (split into sections "Standard commands", "Message Digest commands", and "Cipher commands"), with no other descriptions or usage instructions. I tried `openssl help bf` to get more information, and it prints the options available to that command and their descriptions. I did not see any way to actually figure out what a command does, but it is possible I missed it.

Re: The sorry state of OpenSSL usability (2017)

#52
post #17

Earlier quoted context omitted.

Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)

If anyone really wanted FIPS 140-2 compliance for libressl they should pony up the money to get it certified instead of complaining about it on message boards.

They actively removed and refuse FIPS mode as policy.

https://marc.info/?l=openbsd-misc&m=139819485423701&w=2

No one that cares enough to use LibreSSL over OpenSSL would want FIPS as reintroducing it would make LibreSSL demonstrably worse. Anyone that requires FIPS doesn't know or care enough about security to have a dog in the fight.

Re: The sorry state of OpenSSL usability (2017)

#54

Earlier quoted context omitted.

If anyone really wanted FIPS 140-2 compliance for libressl they should pony up the money to get it certified instead of complaining about it on message boards.

They actively removed and refuse FIPS mode as policy. https://marc.info/?l=openbsd-misc&m=139819485423701&w=2 No one that cares enough to use LibreSSL over OpenSSL would want FIPS as reintroducing it would make LibreSSL demonstrably worse. Anyone that requires FIPS doesn't know or care enough about security to have a dog in the fight.

There are people in government that care about security. Unfortunately we aren't the ones that write the specifications/regulations.

Re: The sorry state of OpenSSL usability (2017)

#55

Earlier quoted context omitted.

> by improving the codebase of OpenSSL Just to clarify: LibreSSL forked OpenSSL [1]. By definition they did not improve the codebase of OpenSSL. [1] https://en.wikipedia.org/wiki/LibreSSL

Didnt most of their changes get merged back?

Most of the LibreSSL changes were removing features or platform support so I don't know how many of their changes were desired or applicable to OpenSSL.

Re: The sorry state of OpenSSL usability (2017)

#56

My question is: Why are you trying to use RSA at all? It's 2019! I can't think of anyone who seriously recommends RSA anymore. Switch to elliptic curve cryptography, where footbullets like a 512-bit RSA key offer aren't even on the table.

This article was written years ago

Re: The sorry state of OpenSSL usability (2017)

#57

My question is: Why are you trying to use RSA at all? It's 2019! I can't think of anyone who seriously recommends RSA anymore. Switch to elliptic curve cryptography, where footbullets like a 512-bit RSA key offer aren't even on the table.

> Why are you trying to use RSA at all?

Probably because you have to use something, and it's not obvious which things have footbullets and which don't.

Re: The sorry state of OpenSSL usability (2017)

#58

My question is: Why are you trying to use RSA at all? It's 2019! I can't think of anyone who seriously recommends RSA anymore. Switch to elliptic curve cryptography, where footbullets like a 512-bit RSA key offer aren't even on the table.

This article was written years ago

Oh! It really should have [2017] in the title, then.

Re: The sorry state of OpenSSL usability (2017)

#59

My question is: Why are you trying to use RSA at all? It's 2019! I can't think of anyone who seriously recommends RSA anymore. Switch to elliptic curve cryptography, where footbullets like a 512-bit RSA key offer aren't even on the table.

> Why are you trying to use RSA at all? Probably because you have to use something , and it's not obvious which things have footbullets and which don't.

https://latacora.micro.blog/2018/04/03/cryptographic-right-a...

https://paragonie.com/blog/2017/06/libsodium-quick-reference...

https://libsodium.gitbook.io/doc/bindings_for_other_language...

It's a lot easier in 2019 than it was years ago.

Re: The sorry state of OpenSSL usability (2017)

#60
post #40

Just tried openssl genrsa on my Mac: openssl genrsa Generating RSA private key, 2048 bit long modulus openssl version LibreSSL 2.6.5 So maybe install Mac updates?

As pointed out in this discussion elsewhere, this is an article written in 2017 and never updated.

* https://github.com/jameshfisher/jameshfisher.com/commits/mas...

Post reply on HN