Re: Openssl 0.9.7e-dev on BSD/OS 5 backfires
Whooopsie... I'll fix that in a few hours :-) In message [EMAIL PROTECTED] on Tue, 29 Jun 2004 06:31:10 -0600, The Doctor [EMAIL PROTECTED] said: doctor We get the BSD/Os 4.3.1 working but 5.x backfires doctor doctor Script started on Tue Jun 29 05:58:11 2004 doctor gallifrey.nk.ca//usr/source/openssl-0.9.7-stable-SNAP-20040629$ make doctor making all in crypto... doctor making all in crypto/objects... doctor making all in crypto/md2... doctor making all in crypto/md4... doctor making all in crypto/md5... doctor making all in crypto/sha... doctor making all in crypto/mdc2... doctor making all in crypto/hmac... doctor making all in crypto/ripemd... doctor making all in crypto/des... doctor making all in crypto/rc2... doctor making all in crypto/rc4... doctor making all in crypto/rc5... doctor making all in crypto/idea... doctor making all in crypto/bf... doctor making all in crypto/cast... doctor making all in crypto/bn... doctor making all in crypto/ec... doctor making all in crypto/rsa... doctor making all in crypto/dsa... doctor making all in crypto/dh... doctor making all in crypto/dso... doctor making all in crypto/engine... doctor making all in crypto/aes... doctor making all in crypto/buffer... doctor making all in crypto/bio... doctor making all in crypto/stack... doctor making all in crypto/lhash... doctor making all in crypto/rand... doctor making all in crypto/err... doctor making all in crypto/evp... doctor making all in crypto/asn1... doctor making all in crypto/pem... doctor making all in crypto/x509... doctor making all in crypto/x509v3... doctor making all in crypto/conf... doctor making all in crypto/txt_db... doctor making all in crypto/pkcs7... doctor making all in crypto/pkcs12... doctor making all in crypto/comp... doctor making all in crypto/ocsp... doctor making all in crypto/ui... doctor making all in crypto/krb5... doctor if [ -n libcrypto.so.0.9.7 libssl.so.0.9.7 ]; then (cd ..; make libcrypto.so.0.9.7); fi doctor `libcrypto.so.0.9.7' is up to date. doctor making all in fips... doctor making all in fips/sha1... doctor TOP=`pwd`/../.. ../fips_check_sha1 standalone.sha1 fips_sha1dgst.c fips_sha1_selftest.c asm/sx86-elf.s fips_standalone_sha1.c fips_sha_locl.h fips_md32_common.h doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_sha1dgst.c fips_sha1_selftest.c asm/sx86-elf.s fips_sha_locl.h fips_md32_common.h doctor making all in fips/rand... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_rand.c fips_rand.h doctor making all in fips/des... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_des_enc.c asm/fips-dx86-elf.s fips_des_selftest.c fips_set_key.c fips_des_locl.h doctor making all in fips/aes... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_aes_core.c fips_aes_selftest.c fips_aes_locl.h doctor making all in fips/dsa... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_dsa_ossl.c fips_dsa_gen.c fips_dsa_selftest.c doctor making all in fips/rsa... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_rsa_eay.c fips_rsa_gen.c fips_rsa_selftest.c doctor making all in fips/dh... doctor TOP=`pwd`/../.. ../fips_check_sha1 fingerprint.sha1 fips_dh_check.c fips_dh_gen.c fips_dh_key.c doctor 1,3c1,3 doctor HMAC-SHA1(fips_dh_check.c)= 5657cf7c136f6d9608df40d0699fe1d61d0ad5b5 doctor HMAC-SHA1(fips_dh_gen.c)= e3626ccd5124942cb19ca962470d2c3704d265bb doctor HMAC-SHA1(fips_dh_key.c)= 88c882a9063c0b7e5f46de1a7bfa82f71e0a918e doctor --- doctor HMAC-SHA1(fips_dh_check.c)= 63347e2007e224381d4a7b6d871633889de72cf3 doctor HMAC-SHA1(fips_dh_gen.c)= 6aaf18dab32bf9a5fb4b7449ac4cbe559040adb4 doctor HMAC-SHA1(fips_dh_key.c)= 7bf23b329a776953bbe7c30ebd7f9faf5249ddbe doctor doctor *** Your source code does not match the FIPS certified source *** doctor doctor *** Error code 1 doctor doctor Stop. doctor *** Error code 1 doctor doctor Stop. doctor *** Error code 1 doctor doctor Stop. doctor gallifrey.nk.ca//usr/source/openssl-0.9.7-stable-SNAP-20040629$ make test doctor testing... doctor (cd ..; make DIRS=crypto all) doctor making all in crypto... doctor making all in crypto/objects... doctor making all in crypto/md2... doctor making all in crypto/md4... doctor making all in crypto/md5... doctor making all in crypto/sha... doctor making all in crypto/mdc2... doctor making all in crypto/hmac... doctor making all in crypto/ripemd... doctor making all in crypto/des... doctor making all in crypto/rc2... doctor making all in crypto/rc4... doctor making all in crypto/rc5... doctor making all in crypto/idea... doctor making all in crypto/bf... doctor making all in crypto/cast... doctor making all in crypto/bn... doctor making all in crypto/ec... doctor making all in crypto/rsa... doctor making all in crypto/dsa... doctor making all in crypto/dh... doctor making all in crypto/dso... doctor making all in crypto/engine... doctor making all in crypto/aes... doctor making all in crypto/buffer... doctor
Re: unique code
Well, I was confused about how you were confused. I guess you're saying the HMAC makes 32 printable characters, and this would be because it is being translated fron binary into hex. What I was trying to say is that if the hash makes k binary output bits, it is easy to fold them together with something like XOR to get k/2, k/4, k/8 bits, etc. But what I did not fully appreciate is that this needs to be done BEFORE the translation from binary to printable happens. If you cannot get the HMAC function to return the binary, you could always convert BACK from hex to binary, do the XOR, then convert the resulting shorter string forward to hex again. Hope this makes some sense. BTW all David's suggestions are good ones. The time stamp occured to me after I initially answered you. I didn't think about the IP address, and I guess I assumed you weren't up to putting up a central server. I didn't think of the software serial number, but it now occurs to me that you could use a CPU serial number if it is available, or the burned-in hardware Ethernet MAC address of an Ethernet interface (if you have one) since those are also supposed to be globally unique. Sorry, I don't trust the 512 bit random number approach, not because I doubt David's statistical maturity, but because I think generating a REALLY random number is a LOT more difficult than it sounds. You might be suprised at the success penetration workers have had by PREDICTING the next random number that the machine is going to base its security on... Michal Hlavac wrote: Charles B Cranston wrote: You could split into two 16-character pieces and then XOR the two pieces against each other. hmmm... but result of substr(hmac, 0, 16) ^ substr(hmac, 16, 16) is not human readable code... Do you think, that xor is right way??? for example hmac: 750c783e6ab0b503eaa86e310a5db738 $result = 750c783e6ab0b503 ^ eaa86e310a5db738; $result contains chr(0) characters... thanx... -- Charles B (Ben) Cranston mailto: [EMAIL PROTECTED] http://www.wam.umd.edu/~zben __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
How to change cipher negotiation sequence?
Hello all, Netscape browsers fail on our site if the DHE-RSA-AES128-SHA cipher is enabled on the browser. I have tried for many hours to use the openssl ciphers command on the web server to push this cipher to the end of the list, without any luck. Am I attacking the problem correctly, or am I way off base? What really confuses me is our test server has the exact same version of openssl and works fine. Redhat 9 Sun Java j2sdk1.4.2_02 jakarta-tomcat-4.1.29 OpenSSL 0.9.7a Thanks, Jim O. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
SSL server setup with CRL
Hi, (B (BI am writing a SSL server program with OpenSSL 0.9.7d and (Btrying to use a CRL file for client revocation. (B (BI was not able to find an easy way of doing that, so I wrote (Bthe following code: (B (B ... (B SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, NULL); (B SSL_CTX_load_verify_locations(ctx, "ca.crt", 0); (B ... (B (B X509_STORE *store = SSL_CTX_get_cert_store(ctx); (B X509_LOOKUP *lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); (B X509_load_crl_file(lookup, "ca.crl", X509_FILETYPE_PEM); (B (BHowever, the code above does not work as I expect. All (Bclients successfully connect to the server even if they (Bare on the CRL. (B (BWhat is the correct way of activating CRL? Should I write (Bmy own verify callback? (B (BThanks in advance. (B (BBest regards, (BKeisuke Nishida (B (B__ (BOpenSSL Project http://www.openssl.org (BUser Support Mailing List[EMAIL PROTECTED] (BAutomated List Manager [EMAIL PROTECTED]
Re: OT: problems with crypto and ASCII
Good mornig,
the problem is that i'm dealing with the extended ASCII code, 8 bits, 'cause
I need characters as à è ò ù and so on. Do you know if there is a function I
can use for I\O of which I can handle this situation? I can't find the
definition of getc, I've checked STDIO.H.
I use char c=getc(file)
Could you give me some suggestions?Obviously I can't add a massive overhead
to the message.To solve this problem I could use 7 bits Ascii but I must use
the accented chars.Maybe I could print the char to the file as int but it
would do a big overhead!!!
Thanks for your time ,best regards!
- Original Message -
From: Richard Levitte - VMS Whacker [EMAIL PROTECTED]
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Monday, June 28, 2004 6:00 PM
Subject: Re: OT: problems with crypto and ASCII
In message [EMAIL PROTECTED] on Mon, 28 Jun 2004
17:45:23 +0200, [EMAIL PROTECTED] said:
deck80 Hi everybody...sorry if it's not a question strictly involving
deck80 openssl but I hope someone can help me.
deck80 I'm writing a simple program that encode a file with a LFSR
deck80 and a clock controlled shift register. Basically there is a
deck80 char m, I create a char of worms x and I make cipher c=m^x
deck80 in output. The problem is that the output can be every kind of
deck80 256-ASCII code so also one of the first 31. So when it reads
deck80 the encoded file it reads also the special chars.It seems it
deck80 stops when it finds the char
deck80 ÿ
deck80
deck80 which is probably the end of file. So the output is usually
deck80 a little part of the input. How can I do to solve this? I've
deck80 tried to read the file char by char and also without the
deck80 control if I'm reading an EOF
deck80 while(c=getchar(ifile)/*!=EOF*/)
deck80 {...
deck80 }
deck80 but it understands the file is finished this way either.
deck80 I've tried to append 10 EOF at the end, trying to recognize it
deck80 as a different EOF sequence but it doesn't work.
deck80 I could try to use a sequence of 10 zeros before the end but
deck80 it doesn't seem to be a smart solution(as the former with the
deck80 10 EOF;))
What is the type of c? If it's a 'char', try changing it to 'int'.
This is really a C language question :-).
-
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.
--
Richard Levitte \ Tunnlandsvägen 52 \ [EMAIL PROTECTED]
[EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-708-26 53 44
\ SWEDEN \
Procurator Odiosus Ex Infernis-- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Unsolicited commercial email is subject to an archival fee of $400.
See http://www.stacken.kth.se/~levitte/mail/ for more info.
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
Unable to load private key
Hello
I'm newbie to openSSL. I'm trying to create a
pkcs12 file with Win32 OpenSSL 0.97d.
I've generated a CSR with keytool. I got my cert
file generated by a CA and a private key file (generated by
keytool).
The following command :
OpenSSL pkcs12 -export -inkey domain.key -in
domain.crt -out domain.pkcs12
make the following error :
Loading 'screen' into random state - doneunable
to load private keyerror in pkcs12
Most posts i've read about this error talk about
0.96 bug. But i'm in 0.97 ...
I've not found in openssl.cnf definition of private
key location ... but i think it must be in same directory that crt file ? (
{openssl-install-dir}/bin exactly ...)
Can it come from a bad private key format
?
Thanks for your help ...
Pierre
pkcs12 -name and -caname don't allow spaces anymore?
I have a system converting PEM files into P12 via pkcs12. e..g openssl pkcs12 -export -in test.pem -inkey test.key -out test.p12 -name Joe Shmoo's certificate This works fine under Fedora Core2 (openssl-0.9.7a-35), but the downloaded openssl-0.9.7d I just compiled up from scratch errors out showing the usage or help error. The problem appears to be that 0.9.7d doesn't allow spaces in -caname or -name compared with 0.9.7a. Is that the case, and is there any way of stopping that error? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Problem with certificate request...
ohaya wrote: Hi, I'm having a problem getting one particular certificate request for a server certificate accepted by a CA. The CA is using Netscape Certificate Manager, I believe, and I'm submitting my request by pasting my request into a browser. The error that I'm getting back is: Sorry, your request has been rejected. The reason is Request Rejected - Subject Name Not Matched C=US,ST=VA,L=Testtown,O=TestCo,OU=TestDept,CN=test.foo.com I've been looking at some other (client) cert requests that I sent previously, and the only difference that I can detect is that the ones that work have the CN=... at the beginning of the Subject Name, vs. being at the end. I'm somewhat new at all of this, but would that (the location of the CN= in the Subject Name) cause the error I'm seeing? Thanks, Jim Hi, No one has responded to the above message, but, just in case anyone ever runs across this problem and is trying to work with NS CMS 6.2: I've been able to confirm that my guess above was right, and it looks like CMS will reject cert requests if the information in the SubjectName is in an order which it doesn't expect. The only way that I was able to get around this was to create a new profile that didn't include the checking for the CN=. Jim __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Random number with engine
Hello, Does anybody know if it is possible toassociate an engine to generate a random number in openssl? Any help would be apreciated. Thanks in advance, Mateus. smime.p7s Description: S/MIME cryptographic signature
Re: SSL server setup with CRL
Hi, In message [EMAIL PROTECTED], `Keisuke Nishida [EMAIL PROTECTED]' wrote: X509_STORE *store = SSL_CTX_get_cert_store(ctx); X509_LOOKUP *lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); X509_load_crl_file(lookup, ca.crl, X509_FILETYPE_PEM); How about trying this? X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); If you want to check authority revocation lists, use X509_V_FLAG_CRL_CHECK_ALL instead. -- gotoyuzo __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: unique code generator
ok, sorry for my strictness... I need create some codes with fixed lenght with deny of ability of other people to create such identifiers... Something similar to phone cards with ID, which I must enter into phone before I dial phone number and going to talk... The code should be i.e. 16 or less characters long. But all codes with fix lenght. You can do no better than to make all the codes truly random. This, of course, requires a central database to validate the codes. If this is unacceptable, you can split the code in half. The first half is a sequence, the second half a checksum. The checksum is computed by a hash on the sequence along with a secret key. You can then validate the code by concatenating the sequence with the secret key, computing the checksum, and comparing to the second half. If it's like a phone card, you need the central database anyway. Otherwise how do you know if the card has already been used or used up? Again, if this doesn't meet your requirements, you'll have to do a better job of telling us what they are. DS __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Invalid CA cert?
Hi Guys, I've created my own CA, when asking users to install the CA's public certificate into their trusted root's list some users experience an error reading This file is invalid: security certificate. This error is being generated from a user, using Internet Explorer. The user is normally very up to date when it comes to $MS security patches and updates. The site that I ask my users to install the SSL Cert from is here: http://securitycertificate.liveserver5.com/ Any suggestions would be greatly appreciated. Thanks Warrick FitzGerald __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
