Why doesn't openssl from Homebrew include aes-256-gcm cipher support?

907th

1/3/23, 10:09 AM

I have installed latest openssl via Homebrew on my Mac (macOS Big Sur 11.5.2). But it doesn't support aes-256-gcm cipher suddenly.

$ /usr/local/opt/[email protected]/bin/openssl enc -ciphers | grep aes-
-aes-128-cbc               -aes-128-cfb               -aes-128-cfb1
-aes-128-cfb8              -aes-128-ctr               -aes-128-ecb
-aes-128-ofb               -aes-192-cbc               -aes-192-cfb
-aes-192-cfb1              -aes-192-cfb8              -aes-192-ctr
-aes-192-ecb               -aes-192-ofb               -aes-256-cbc
-aes-256-cfb               -aes-256-cfb1              -aes-256-cfb8
-aes-256-ctr               -aes-256-ecb               -aes-256-ofb

$ /usr/local/opt/[email protected]/bin/openssl version
OpenSSL 1.1.1l  24 Aug 2021

How can I enable the cipher? And why isn't it included in the package?

227

1 + 1

openssl

Michael Hampton

1/3/23, 12:26 PM

This question appears to be off topic: We do not provide end user support. You may be able to get help on one of our sister sites such as [apple.se], [unix.se] or [su].

Score:1

Server

907th

1/3/23, 10:29 AM

I've found the reason of my issue. It is described in the openssl docs.

This command does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. This is due to having to begin streaming output (e.g., to standard output when -out is not used) before the authentication tag could be validated. When this command is used in a pipeline, the receiving end will not be able to roll back upon authentication failure. The AEAD modes currently in common use also suffer from catastrophic failure of confidentiality and/or integrity upon reuse of key/iv/nonce, and since openssl enc places the entire burden of key/iv/nonce management upon the user, the risk of exposing AEAD modes is too great to allow. These key/iv/nonce management issues also affect other modes currently exposed in this command, but the failure modes are less extreme in these cases, and the functionality cannot be removed with a stable release branch.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why doesn't openssl from Homebrew include aes-256-gcm cipher support?

TH: เหตุใด opensl จาก Homebrew จึงไม่รองรับ aes-256-gcm cipher

RO: De ce openssl de la Homebrew nu include suport pentru cifrul aes-256-gcm?

RU: Почему openssl от Homebrew не включает поддержку шифрования aes-256-gcm?

VI: Tại sao openssl từ Homebrew không bao gồm hỗ trợ mật mã aes-256-gcm?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.