5.18 Using Variable Key-Length Ciphers in OpenSSL

5.18.1 Problem

You're using a cipher with an adjustable key length, yet OpenSSL provides no default cipher configuration for your desired key length.

5.18.2 Solution

Initialize the cipher without a key, call EVP_CIPHER_CTX_set_key_length( ) to set the appropriate key length, then set the key.

5.18.3 Discussion

Many of the ciphers supported by OpenSSL support variable key lengths. Whereas some, such as AES, have an available call for each possible key length, others (in particular, RC4) allow for nearly arbitrary byte-aligned keys. Table 5-7 lists ciphers supported by OpenSSL, and the varying key lengths those ciphers can support.

Table 5-7. Variable key sizes

Cipher

OpenSSL-supported key sizes

Algorithm's possible key sizes

AES

128, 192, and 256 bits

128, 192, and 256 bits

Blowfish

Up to 256 bits

Up to 448 bits

CAST5

40-128 bits

40-128 bits

RC2

Up to 256 bits

Up to 1,024 bits

RC4

Up to 256 bits

Up to 2,048 bits

RC5

Up to 256 bits

Up to 2,040 bits

While RC2, RC4, and RC5 support absurdly high key lengths, it really is overkill to use more than a 256-bit symmetric key. There is not likely to be any greater security, only less efficiency. Therefore, OpenSSL puts a hard limit of 256 bits on key sizes.

When calling the OpenSSL cipher initialization functions, you can set to NULL any value you do not want to provide immediately. If the cipher requires data you have not yet provided, clearly encryption will not work properly.

Therefore, we can choose a cipher using EVP_EncryptInit_ex( ) without specifying a key, then set the key size using EVP_CIPHER_CTX_set_key_length( ), which takes two arguments: the first is the context initialized by the call to EVP_EncryptInit_ex( ), and the second is the new key length in bytes.

Finally, we can set the key by calling EVP_EncryptInit_ex( ) again, passing in the context and any new data, along with NULL for any parameters we've already set. For example, the following code would set up a 256-bit version of Blowfish in CBC mode:

#include <openssl/evp.h>     EVP_CIPHER_CTX *blowfish_256_cbc_setup(char *key, char *iv) {   EVP_CIPHER_CTX *ctx;       if (!(ctx = (EVP_CIPHER_CTX *)malloc(sizeof(EVP_CIPHER_CTX)))) return 0;   EVP_CIPHER_CTX_init(ctx);       /* Uses 128-bit keys by default. We pass in NULLs for the parameters that we'll    * fill in after properly setting the key length.    */   EVP_EncryptInit_ex(ctx, EVP_bf_cbc(  ), 0, 0, 0);   EVP_CIPHER_CTX_set_key_length(ctx, 32);   EVP_EncryptInit_ex(ctx, 0, 0, key, iv);   return ctx; }


Secure Programming Cookbook for C and C++
Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Input Validation & More
ISBN: 0596003943
EAN: 2147483647
Year: 2005
Pages: 266

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net