On Mon, Oct 01, 2012, Thulasi wrote: > Hello all, > > I've a problem with TLS 1.2 client authentication where client has 512-bit > RSA key and certificate and signature hash is of sha512. > This is reproducible with openssl-1.0.1c and many prior versions which > support TLS 1.2 client authentication. > While calculating CCV (client cert verify data), I fail to calculate RSA > signature over verify data which is greater than 53 (64-11) bytes as sha512 > verify data is of 64 bytes. > I understand that 512 bit certificates are too weak to be used in > real-time. But in theory, is there any alternative to solve this problem? >
You could in theory modify OpenSSL to use a smaller digest if the key is too small. But as you say the key is too weak and the correct solution is to use a larger key. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
