Encryption on Rietta Cybersecurity

Generate OpenSSL Elliptic Curve Key Pair from the Command Line

Tue, 18 Aug 2026 00:00:00 +0000

Back in 2012, I wrote Generate OpenSSL RSA Key Pair from the Command Line, which has gone on to become the single most-visited post on this entire blog. Fourteen years is a long run for a command-line tutorial, and RSA hasn’t gone anywhere. But if you’re generating a new key pair in 2026, I’d point you toward elliptic curve cryptography (ECC) instead of a bigger RSA key.

Shorter SSL/TLS Lifetimes: Business Impact of Monthly Certificate Renewals

Tue, 22 Apr 2025 08:00:00 +0000

The CA/Browser forum has reportedly approved a measure to reduce the allowed time for certificate validity from 398 to 47 days by March 15, 2029. This change will require users to renew certificates on a nearly monthly basis. This is a manual process that will now have to be done up to 10 times per year, instead of just once. This change will not be evident to most Internet users and businesses.

Americans' Access to Strong Encryption is at Risk, an Open Letter to Congress

Wed, 03 May 2017 19:34:59 -0400

Dear Honorable Members of the United States Congress:

I work in application security in the cybersecurity field to make software more secure from attack. The cybersecurity threats that face our nation are very important to my wife and me. As Americans, our private data is in great jeopardy because of increased cybersecurity threats. Our infrastructure is prone to being hacked, and major data breaches of both private and government networks are routinely in the news. The best way to prevent these breaches is to increase the use of strong encryption with no backdoors.

The track record of data breaches demonstrates an uncomfortable truth: when sophisticated adversaries want to hack a network, they will ultimately win. Among the few tools known to computer science that can prevent a data breach is strong encryption. This means that there is no backdoor and no backup key. Either the original user needs to enter the password, or the data is un-retrievable.

Calls to Ban Effective Encryption Continue Despite Data Breach Crisis

Fri, 22 Apr 2016 09:00:00 -0400

The continued calls for the U.S. Congress to ban effective encryption despite the current computer security crisis in which data breaches are regular news is dangerous, shortsighted, and destined to harm all Americans. The two most effective tools that we have capable of helping prevent data breaches are encryption and reducing the attack surface of computer systems that handle sensitive or private data. Under the proposed legal framework, both will be sacrificed for a false sense of safety.

The latest installment of Congressional hearings was held by the Energy and Commerce Committee on April 19, 2016, and was titled Deciphering the Debate Over Encryption: Industry and Law Enforcement Perspectives. The calls for Congress to ban effective encryption are repeated with little variance from the past. Some Members of Congress are expressing frustration that the debate is repeating itself without law enforcement suggesting any particular middle ground that would be workable for the tech community. But what is most chilling is that those in law enforcement continue to demand exceptional access despite years of back and forth and the parade of high profile data breaches both within government and the private sector. We’re losing the cybersecurity battle and the government is calling for a ban on one of the most effective tools that computer science has at its disposal.

U.S. Senate Bill Seeks to Ban Effective Encryption, Making Security Illegal

Fri, 08 Apr 2016 10:11:33 -0400

The anticipated Feinstein-Burr Compliance with Court Orders Act, an anti-security bill, would require the provision of data in an intelligible format to a government pursuant to a court order (scribd.com). A draft copy was uploaded by The Hill reporter Cory Bennett, though whether it has been submitted officially within the Senate is not yet clear (vice.com).

This bill essentially says you can not have any conversation or data exchange that the government can not access if it wants to. It is the legal culmination of what the FBI has been lobbying Congress for years. If Feinstein-Burr becomes law, it will be illegal to deploy strong encryption without key escrow maintained by each company. Cryptographers and computer scientists near-unanimously assert key backup systems are insecure at scale.

It is not just one iPhone, the FBI wants a future where it is impractical to deploy strong encryption without key escrow

Wed, 16 Mar 2016 09:01:11 -0400

Crypto War II, the first crypto war having taken place in the 90s with the clipper chip, is in full swing with hostilities started back up a few years ago when FBI Director James Comey and others started lobbying congress and giving public speeches about how being unable to unlock some devices and communications makes it hard to do their job. It has been an unrelenting full public relations assault on practical strong encryption.

Ultimately FBI Director James Comey wants a future where it is illegal or impractical to deploy strong encryption without key escrow, which is a key backup system that the great consensus of cryptographers and computer scientists assert is insecure at scale. As a statesman he never comes out and says this directly, but it is the only conceivable outcome to what he is demanding of tech companies before congress and the actions that the FBI has taken in court.

How To Protect Against the POODLE SSLv3 Vulnerability

Thu, 16 Oct 2014 09:21:22 -0400

The POODLE SSL vulnerability marks the third major security flaw discovered this year that impacts the security of millions of websites.

The attack works by forcing the connection to downgrade from the newer TLS protocol to the 18 year old SSL 3 protocol, which is obsolete and insecure, and then utilizing a weakness to calculate small strings of data from the encrypted communication, such as session cookies.

Raspberry Pi crypto key management project!

Thu, 02 Oct 2014 21:20:16 -0400

A few months ago I bought a Raspberry Pi B to experiment with, but sadly my day job as a Ruby developer keep me busy enough that it just sat on the shelf unused until this last weekend. For those not yet in the know, the Raspberry Pi is an excellent little complete computer system on a small circuit board that uses very low power and looks like this:

Introduction to OpenPGP: Decrypt this Message

Mon, 07 Jul 2014 00:00:00 +0000

If you have been following the news in light of the revelations of the NSA domestic surveillance program, which is probably unconstitutional in the United States but in practice is being permitted by the courts, then you should know something about the encrypt everything movement and Google’s End-to-End project, which is to add OpenPGP to the Chrome web browser. If this is new to you, this fun challenge will help you get started with what you need to decrypt a message with GnuPG!

Secure Passwords & Passphrases

Mon, 25 Nov 2013 17:40:00 +0000

Sometimes when someone sees me type my long password to log into my laptop, I get asked about why I use such a long password. I always sigh a little. Deep down inside, I reflect on how there is not a concise, easy, actionable answer that will help that person practice better password security. My laptop password is better than most, but even it would be potentially susceptible to long, sustained offline attacks.

OpenSSL: Encrypt Data with an RSA Key with PHP

Thu, 13 Jun 2013 00:00:00 +0000

Web application security is built upon a series of interconnected building blocks. This post is part of Rietta’s ongoing coverage of encryption. Browse the Encryption tag for the rest of the series. Last year, I wrote about how Generating an RSA Key from the Command Line in OpenSSL could support encrypting or validating data in an unattended manner (where the password is not required to encrypt). A few weeks before that, I posted about how to Encrypt a File with a Password from the Command Line using OpenSSL.

What is Protected Personally Identifiable Information? Do I really have to hash users' passwords?

Thu, 05 Apr 2012 00:00:00 +0000

This post is part of Rietta’s ongoing coverage of encryption. Browse the Encryption tag for the rest of the series. The Short Answer The legal answer depends on which Federal, State, and local laws apply to your company. And I am not a lawyer. However, for companies whose nexus is in Georgia, where my company is located, the Georgia General Assembly has given some guidance in the data breach law.

Generate OpenSSL RSA Key Pair from the Command Line

Fri, 27 Jan 2012 00:00:00 +0000

While Encrypting a File with a Password from the Command Line using OpenSSL is very useful in its own right, the real power of the OpenSSL library is its ability to support public key cryptography: encrypting or validating data in an unattended manner, where the password protecting the private key is never needed by the process doing the encrypting or validating.

OpenSSL: Encrypt a File with a Password from the Command Line

Mon, 09 Jan 2012 00:00:00 +0000

Do you know how to use OpenSSL to protect sensitive information in storage instead of just in transit across the network? In fact, your can use the OpenSSL command line too to encrypt a file on your Mac OS X, Linux, or FreeBSD based computer. Support for the library are included by default in PHP and Ruby. So there is no reason not to use it to add additional security to your web applications.

Authentication Without Encryption for Ham Radio

Mon, 17 Aug 2009 00:00:00 +0000

In April 2004, I gave a talk for the Atlanta Radio Club about the possibilities for authenticated digital communication for amateur radio applications. I published the document on my Georgia Tech website at that time. Since I no longer have an account at Georgia Tech, I am re-posting the document here. Authenticating on a Ham Internet The FCC regulations for amateur radio, part 97, rule that encryption cannot be used to obscure the meaning of communications.