Hi,
First I want to preface what I say by the fact that I'm a total SSLeay
newbie. I am inheriting work done by someone else. If someone could point
me to good docs I would really appreciate!
Following your advice, I changed my certificate to be 512 bit instead of
1024 bit. As you figured, I was able to access the server in secure mode
with a 40 bit browser.
My question is how do I add the necessary export ciphers and how do I the
temp key or temp key callback. In ssl_algs.c it seems we add all the
ciphers necessary. I stepped through our server code with the debugger and
we definitely seem to make all the calls.
void SSLeay_add_ssl_algorithms()
{
#ifndef NO_DES
EVP_add_cipher(EVP_des_cbc());
EVP_add_cipher(EVP_des_ede3_cbc());
#endif
#ifndef NO_IDEA
EVP_add_cipher(EVP_idea_cbc());
#endif
#ifndef NO_RC4
EVP_add_cipher(EVP_rc4());
#endif
#ifndef NO_RC2
EVP_add_cipher(EVP_rc2_cbc());
#endif
#ifndef NO_MD2
EVP_add_digest(EVP_md2());
#endif
#ifndef NO_MD5
EVP_add_digest(EVP_md5());
EVP_add_alias(SN_md5,"ssl2-md5");
EVP_add_alias(SN_md5,"ssl3-md5");
#endif
#ifndef NO_SHA1
EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
EVP_add_alias(SN_sha1,"ssl3-sha1");
#endif
#if !defined(NO_SHA1) && !defined(NO_DSA)
EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
#endif
/* If you want support for phased out ciphers, add the following */
#if 0
EVP_add_digest(EVP_sha());
EVP_add_digest(EVP_dss());
#endif
}
Your help would be most appreciated! :-)
Frank Kim
NetCentric Corporation
28 Crosby Drive, Bedford, MA 01730
(781)685-5288
[EMAIL PROTECTED] http://cag-www.lcs.mit.edu/~frankkim
-----Original Message-----
From: Ben Laurie [mailto:[EMAIL PROTECTED]]
Sent: Thursday, February 25, 1999 3:43 AM
To: [EMAIL PROTECTED]
Subject: Re: Problems with my server and 40 bit browsers
Keith Jackson - ITG staff wrote:
>
> the export ciphers don't get added by default. you need to explicitly add
> them. off of the top of my head i don't remember the exact function to
> add cipher suites, but if you poke around the docs a bit you'll find it.
That's sort of half-true. If your cert is more than 512 bit (which it
probably is), you need to add a temp key or a temp key callback to
generate one before the export ciphers can be used.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
