Abstract Syntax Notation 1. Designed as part of the International
Telecommunications Union's Open Standards Interconnect (OSI)
effort as a description language for the OSI protocols. See also BER and
DER
Basic Input/Output. Used by OpenSSL "to
provide a layer of abstraction for I/O. As long as your object meets
the BIO interface, it doesn't matter what the underlying I/O device
is." --Rescorla, p. 261
Cipher Block Chaining. A symmetric encryption technique used with
block ciphers in which the encryption of each plaintext block depends
on the ciphertext of the previous block.
Common Name. Typically the most specific (?) component of a
Distinguished Name (DN). In certificates for
specific hosts, the CN is generally the fully qualified host
name.
Distinguished Encoding Rules. A process for unambiguously
converting an object specified in ASN.1 into
binary values for storage or transmission on a network. Format is
similar to C structs, except that type definitions are "backwards":
the name is first, followed by the data type. See also BER.
Data Encryption Standard. A symmetric encryption algorithm
designed by IBM in the 1970s and published as a U.S. standard by the
National Institutes of Sciences and Technology. A block cipher
operating on 56-bit blocks.
Distinguished Name (X.500). A hierarchically structured name
capable of providing a unique name for every entity in a network. Some
common components of a DN are Country (C=), Organization (O=),
Organizational Unit (OU=) and Common Name (CN=).
Digital Signature Algorithm. A public-key (assymetric) algorithm
that can be used for digital signatures (but not for
encryption). Published as a U.S. standard by the National Institutes
of Sciences and Technology.
Digital Signature Standard 1. OpenSSL treats DSS1 as a synonym of
SHA1. As an option fo OpenSSL's dgst command, you must refer to SHA1
as -dss1; elsewhere in OpenSSL, use sha1.
Elliptic Curve. "EC ciphers replace the prime integer field of DH
and DSS with a field composed of points on an elliptic curve."
--E. Rescorla, p. 103.
A PC card (with PCM-CIA form factor) designed by the
U.S. government. Originally designed to provide strong cryptography
while allowing the NSA to intercept communications.
Greenwich Mean Time. The prime meridian goes through Greenwich,
England. The world's time zones are described as negative or positive
offsets from GMT. The same as (the more current) UTC.
Hashed Message Authentication Code. (Hashed MAC.) A standardized
approach to using hash algorithms to create message authentication
codes. HMAC is generally a pair of nested digests: the first is a
digest the key and the data; the second is a digest of the key and the
output of the first digest.
HTTP Secure. The first public implementation of HTTP over SSL, released in version 2 of Netscape Navigator in 1995. Finally documented in RFC 2818. Different from SHTTP.
A TCP algorithm designed to reduce tinygrams by delaying
the sending of new data (and continuing to accumulate additional data
in the write buffer) until previously send data has been
acknowledged. The algorithm also delays sending ACKs
(acknowledgements) trying to piggyback it on a data segment that it
will (soon) send out. Nagle's algorithm can cause SSL to perform
badly.
Perfect Forward Secrecy. Used to describe a condition where, even
if a server's private authentication key is known by an attacker, the
attacker cannot attack any session already established and shut down.
Public Key Cryptography. The same as asymetric cryptography,
where encryption and decryption use different keys--one of them
public, the other private.
A value computed by the client during the ClientKeyExchange. It is
a random value (generated on the client), encrypted under the server's
public key, then transmitted to the server.
In the DIGEST-MD5 authentication mechanism, "the name of a
collection of accounts that might include the user's account. This
string should contain at least the name of the host performing the
authentication and might additionally indicate the collection of users
who might have access. An example might be
'registered_users@gotham.news.example.com'." --RFC 2831
RACE Integrity Primitives Evaluation Message Digest 160-bit
hash. (RACE = The Research and Development in Advanced Communication
Technologies in Europe program.) A 160-bit hash (message digest), not
nearly as common as SHA1 (also 160 bits). OpenSSL refers to this
algorithm as rmd160
Rivest, Shamir and Adleman. The most popular public-key algorithm,
invented in 1977 and named after its creators: Ron Rivest, Adi Shamir
and Leonard M. Adleman.
Secure Hash Algorithm 1. A U.S. standard published by the National
Institutes of Sciences and Technology. A stronger hash algorithm
derived from MD4. Has 160-bit out.
Secure Socket Layer Eric A. Young (Eric A. Young's Secure Socket
Layer). OpenSSL is based on Eric's original SSLeay
implementation. The perl implementation of OpenSSL is Net::SSLeay.