Re: do i need a dedicated ip address for https?
Richard Levitte wrote: In message 54015.92296...@web121406.mail.ne1.yahoo.com on Tue, 21 Dec 2010 22:53:07 -0800 (PST), S Mathias smathias1...@yahoo.com said: smathias1972 http://help.godaddy.com/article/1054 smathias1972 smathias1972 # Set up SSL protection on your website. smathias1972 smathias1972 is it an inescapable requirement to have a dedicated smathias1972 [not fix] ip address, when i want to use ssl on my smathias1972 domain? Idealy, there's no need to have a dedicated IP address. As Mike mentioned, it's possible to have a wildcard certificate. The other alternative is a multivalued subjectAltName, but most cert vendors do not support that as far as I'm informed. JFTR: By chance i saw some time ago that TrustCenter supports up to three subjectAltNames for free (http://www.trustcenter.de/en/products/tc_trust_ssl.htm). A further (very quick) survey shows that Thawte too supports additional subjectAltNames, but here it comes with a price (http://www.thawte.com/ssl/index.html). A more intensive survey will probably show up further CAs supporting multiple subjectAltNames. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Technology Solutions GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: [Q] Tutorial or Explanation how to use OpenSSL library functions?
JongAm Park wrote: Hello, I am just a beginner at using OpenSSL library. I write in C/C++ and Objective-C. After looking up the OpenSSL web site, I found out that there was no document for studying how to use it. Is there any good source like sample codes, tutorial and so on? http://oreilly.com/catalog/9780596002701/ It's a little bit outdated (based mainly on OpenSSL 0.9.7 (or older, iirc)), but otherwise still a useful tutorial. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Technology Solutions GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: X509 certificates through API
Kenneth Goldman wrote: Is there sample code anywhere for how to construct X509 certificates programmatically, through the API, not the command line? The documentation includes the serialization API's, but? little else. I assume, since it can be done from the command line, that the code exists and is just not documented. Could I be wrong? Well, the code implementing the x509 subcommand of the openssl command line tool can be found in apps/x509.c. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, IP SW SO 12 Phone/Fax: +49-89-636-47852 / 48332 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: aes128 code??
Lidia Fernández wrote:
Butwhe i type the command 'openssl enc -a -aes128 -in file.txt -out
file.enc -pass pass:1234567'
i don't specify the ivand in the sample code there is:
unsigned char iv[] = {1,2,3,4,5,6,7,8};
EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), NULL, key, iv);
I have to do the same that the command do.
How can i do this???
As the enc man page says, when a password is used and the -iv option is
not specified, the iv is generated from the password. For details you
should look into the enc source (apps/enc.c, near the call of
EVP_BytesToKey).
Ciao,
Richard
--
Dr. Richard W. Könning
Fujitsu Siemens Computers GmbH
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
Re: Questions about Ciphers and disabling sslv2
Rick King wrote: Hello List! I have a client that is using openssl version, 0.9.7a Feb 19 2003. Recently, he ran a security audit on his machine, and the report came back stated the following: Vulnerability -- imaps (993/tcp) - 21643Synopsis : The remote service supports the use of weak SSL ciphers Vulnerability -- pop3s (995/tcp) - 21643Synopsis : The remote service supports the use of weak SSL ciphers The ciphers that he is using is this: SSL_RSA_WITH_RC4_128_MD5\ ,SSL_RSA_WITH_RC4_128_SHA\ ,TLS_RSA_WITH_AES_128_CBC_SHA\ ,TLS_DHE_RSA_WITH_AES_128_CBC_SHA\ ,TLS_DHE_DSS_WITH_AES_128_CBC_SHA\ ,SSL_RSA_WITH_3DES_EDE_CBC_SHA\ ,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA\ ,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA\ ,SSL_RSA_WITH_DES_CBC_SHA\ ,SSL_DHE_RSA_WITH_DES_CBC_SHA\ ,SSL_DHE_DSS_WITH_DES_CBC_SHA\ ,SSL_RSA_EXPORT_WITH_RC4_40_MD5\ ,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA\ ,SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA\ ,SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA Questions 1) I believe these are sslv3 ciphers, but is there a way to verify the above string is sslv3 compliant? See http://www.openssl.org/docs/apps/ciphers.html#, but a 40 bit cipher is weak regardless whether it is an SSLv2 or a TLSv1/SSLv3 cipher. 2) Is there a way to *turn off* sslv2 in openssl? Yes, but that doesn't remove weak 40 bit ciphers. How to remove weak ciphers and protocols depends on the application, when it doesn't provide a means to transport the wishes of the user to OpenSSL, you are lost (at least when you haven't the source and can't convince the application author). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: books about ssl handshake?
[EMAIL PROTECTED] wrote: You have two good books: Eric Rescorla, SSL and TLS, Designing and Building Secure Systems, Addison Wesley, 2001. This one explains the things the OP asked explicitly for. John Viega, Matt Messier, Pravir Chandra Network Security with OpenSSL Cryptography for Secure Communications This one doesn't explain the general SSL/TLS framework, but refers for this to Rescorla's book. So the OP should buy first the first book and when after reading it, OpenSSL specific questions are still open he should buy the second one too. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: How to fallback from TLS to SSLV3?
ravi shankar wrote: We have a SSL client and we are having issues while connecting to some oracle application servers which does not support TLS. By default, our client tries TLS and the server sends an alert message for the client hello instead of sending server hello. If we disable TLS and use SSLV3, the connection goes fine. Is there any SSL_CTX option or api to tell that try TLS, if it does not work, fallback to SSLV3? We do not want to completely disable TLS by setting the option SSL_OP_NO_TLSv1 in SSL_CTX_set_options. Use sslv23_method (see e.g. Lutz' message ([EMAIL PROTECTED]) from 2007-08-23). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: sshd crashes
Bhagya Prasad wrote: Hi I am using the following version of openssl - openssl-0.9.8b-8.3.tlsext in the CentOS 5 environment. Whenever non-local user logs into the box [ not a system created user ] and logs out sshd segfaults with the following message in /var/log/messages. sshd[9250]: segfault at d7bcbc6c rip 2ce1a664 rsp 7fff5b1c0918 error 4 I don't see where the message indicates an OpenSSL problem, probably you get from an OpenSSH mailing list more help. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Saving (and restoring) cipher context
Jim Wong wrote: I'm developing an application in which we're using AES to encrypt files as they're transferred from another system and saved to disk. We'd like to provide the ability for the application to resume a transfer that was interrupted mid-stream, but the encryption throws a bit of a wrench into things because of the state associated with the encryption context. Is there a safe, supported way to stash the context somewhere on disk so that encryption can be resumed where it left off when the file transfer starts up again? We're currently looking at the EVP functions; would we have to drop down to the lower-level, algorithm-specific routines to do this right? If you use the CBC or the CFB cipher mode, you can use the last cipher block written to the disk as IV (that means, before the restart point) for a call to EVP_EncryptInit at the restart of data transmission. Another possibility would be to implement counter mode on top of ECB, here should a restart also be simple. Ciao, Richard Könning -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Some wird OpenSSL perfomance slowdown
Darryl Miles wrote: Sergey S. Levin wrote: 1. If i use FileZilla and SSL connection - it works on 100% of speed. I dont know what FileZilla is, but which SSL implementations is used and what key exchange protocol and what symmetric cipher did it choose ? FileZilla uses also OpenSSL. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Some wird OpenSSL perfomance slowdown
Sergey S. Levin wrote: I dont see any timing code in the middle to separate the timings for the SSL cryptographic setup phase from the application data transfer phase. I think you are doing a piggybacked connection setup so your first application data write is performing the SSL connection setup implicitly. Does this mean that the OpenSSL lib each BIO_write makes the handshake? No. But which cpu types/frequencies are involved on both sides of the connection and which cipher suite do you use? Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Some wird OpenSSL perfomance slowdown
Sergey S. Levin wrote: But which cpu types/frequencies are involved on both sides of the connection and which cipher suite do you use? Server - Celeron 2GHz, Cient - Intel PIV 2GHz. As to the second question - I'm not changing the defaul values in the sources code. I had taken the saccept.c and sconnect.c as the base. 1. Which command changes it? 2. Which cipher suite should I use to increase the perfomance? As Vi(c|k)tor already said, with the above mentioned CPUs there should be no speed problem created by the symmetric encryption. Something else what strikes me: Is the BIO_ctrl(out, BIO_CTRL_FLUSH, 0, NULL) call really necessary? Maybe the flushing has a negative influence on the LAN performance? Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Archives of this mailing-list?
Olivier Mascia wrote: Are there searchable archives of this mailing-list? I'd like to look them up before posting questions. See http://www.openssl.org/support/ at the bottom. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Seeding the OpenSSL PRNG (continued ...)
Erik Leunissen wrote: Is there a uniform way to detect that the OpenSSL PRNG has not been seeded? Uniform is uniform over the various platforms because I want Call RAND_status() (see http://www.openssl.org/docs/crypto/RAND_add.html#). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: license question
David Schwartz wrote: To the extent that there is no affirmative act of agreement to the EULA, Microsoft will have a hard time enforcing it. I have seen laptops that, on first customer boot, require you to accept a Microsoft EULA. I think Microsoft would have hard time enforcing their EULA if there was no positive act of assent to it. In Germany even the click on I agree has no legal consequences when the user was not able to read the EULA *before* the purchase: If the EULA is not printed on the outside of the cardboard box (or the user can read the EULA in any other way before the purchase), the EULA is not applicable. And when the installation process completes only when you click on the I agree button, then you can do this without legal consequences, your rights to use the software are then determined by german copyright law, not by the EULA. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: related license question
Ted Mittelstaedt wrote: - Original Message - From: David Schwartz [EMAIL PROTECTED] To: openssl-users@openssl.org Sent: Tuesday, August 22, 2006 2:04 PM Subject: RE: related license question Certainly. Nothing in the OpenSSL licenses requires you to allow redistribution of any derivative works you create. Wrong. See the following: ...The licence and distribution terms for any publically available version ^^ The question is, what this word means. or derivative of this code cannot be changed... http://www.openssl.org/source/license.html Yes, the OpenSSL does not explicitly require you to allow redistribution of any derivitave works you create. However, it explicitly requires you to not change the distribution terms of the derivitave work that you create, and since the redistribution terms are open, that forces you to also use open redistribution terms. If someone adds *own* code to OpenSSL and forbids redistribution of *his* code, the resulting package is imho no longer publically available and therefore the sentence cited above would no longer apply. Am i wrong? If i am wrong, the OpenSSL license would be infectious like the GPL, and my impression is, that the sentence cited above has been added to the license for preventing such infectiousity, but i may be wrong. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: license question
Ryan Shon wrote: In particular, we are unclear as to what redistribution rights the OpenSSL license would grant to customers who purchase our OpenSSL variant. Would they be allowed to redistribute our optimized library? The license enumerates the conditions which have to be met for redistribution. I think the discussion can be shortened when you explain which point of the license is unclear to you. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: license question
Ryan Shon wrote: My boss hopes to sell this OpenSSL variant as a product. Because of this, he would not want customers who buy this product to be free to redistribute it on their own. If we were only to modify existing OpenSSL, then I assume our entire product would be subject to free redistribution by customers under the license. Is this correct? My first answer would have been plain no, but then i read the last sentences at http://www.openssl.org/source/license.html. I think (IANAL) that the answer depends on whether your product is regarded a derivative of OpenSSL. If you can put the main part of your code into a separate module and only modify OpenSSL to call your code then i assume that you can forbid the redistribution of *your* module. Whether you are allowed to forbid the redistribution of the modified OpenSSL may be questionable, but without your module this OpenSSL version is useless anyway. However, if the cryptographic library in our OpenSSL variant were written from scratch, using no OpenSSL code (while the SSL library still used OpenSSL code), would we have the right to forbid redistribution of our cryptographic library and its source? Yes (but you know, IANAL ;-)). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Problem to start an SSL session
Frank Büttner wrote: So I found out that SSL don't take teh data from the socket:( The Qt buffer will grow and grow, but SSL don't read the data:( It seems to me that you have an architecture problem. As i understand your descriptions you have OpenSSL and Qt accessing a socket in *parallel*, so whichever comes first, gets the data. What you really want is probably that one is layered onto the other (probably Qt on OpenSSL). For this you must get Qt to calling OpenSSL instead of the sockets directly. I do know almost nothing about Qt, so i can't say, whether this is possible without modifying Qt. On the other hand Google says that there is already something named QTsslSocket, which may fulfill your needs. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Problem to start an SSL session
Frank Büttner wrote: Non blocking is not possible because Qt returns only an non blocking fd. What is the problem? What do you mean with the select() function. In the openSSL doc I can't found something like that. select() is the standard Sockets select() function. Maybe this is in your case wrapped into some Qt function. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: SSL v2/3 and TLS.. How to be flexible?
Lee Dilkie wrote: Perhaps I'm getting confused with what's reported. I just noticed that SSLv3 gets reported even when I specify TLS methods on the client and server. ie. cipher spec=AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Is this really SSLv3 or is it TLS? Afaik the supported cipher suites are the same for SSLv3 and TLS, so OpenSSL probably prints SSLv3 in any case. When you want to know the used protocol version, use e.g. ssldump. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: SSL v2/3 and TLS.. How to be flexible?
William A. Rowe, Jr. wrote: TLSv1_server_methods() do not speak the crufty old SSLv2 garbage, you can't connect to it using a multi-protocol handshake. For maxiumum portability use SSLv23_server_methods() On the client side it doesn't matter, if you want a TLSv1 connection only, then by all means use TLSv1_client_methods(). Another possibility is to use SSLv23_client_method and restrict the protocol usage with SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Can I have SSL for peer authentication only? (and not for data encryption)
Bernhard Froehlich wrote: Maybe this would be possible using the NULL cipher combined with DH authentication... (The official NULL cipher suites use RSA authentication.) The answer to the first question of the OP is yes, use a NULL cipher suite. But if your problem is only performance I don't think it's worthwhile to worry about bulk encryption. [...] I agree to this. Anyway, it is not much effort to make the cipher suite used by the application configurable; comparing a NULL cipher suite with an e.g. AES-128 cipher suite gives in short time the answer to the OP's second question. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Speed tests
Bards1888 wrote: I've searched the archives and couldn't find anything related, so I'm posting here for some help/advice; [...] timing function used: getrusage The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes256 bytes 1024 bytes 8192 bytes aes-256-cbc 52599.29k56488.64k58105.31k58512.93k 58630.37k I have a few questions regarding the test; 1) Does the part that states numbers are in 1000s of bytes per second mean that the figures below have still to be translated in to 'human readable' quantities ? or has that already been performed. I'm guessing it has already been performed mainly due to the 'k' on the end, however I could be very wrong. It means what it says: 1000s of bytes per second processed. 2) This seems, to the novice in me, to be a fairly well balance cipher to use on this kit as the rate seems to be close regardless of block size. Does the blocksize roughly equate to network packets in an SSL VPN scenario ? The SSL record size (upper limit for the used block size) is ~ 16k, the size of your data packets in an SSL VPN probably depends on the applications transfering data over the VPN. I also have a 2ghz amd athlon 64 3200+ which happens to have a hifn crypto PCI card in it, exact same Openbsd 3.8 OS; # dmesg |grep hifn hifn0 at pci0 dev 9 function 0 Hifn 7955/7954 rev 0x00: LZS 3DES ARC4 MD5 SHA1 RNG AES PK, 32KB dram, irq 11 So I thought I'd run the same test on it to see how much faster the hifn card is; # openssl speed -evp aes-256-cbc To get the most accurate results, try to run this program when this computer is idle. Doing aes-256-cbc for 3s on 16 size blocks: 40467 aes-256-cbc's in 0.02s Doing aes-256-cbc for 3s on 64 size blocks: 40014 aes-256-cbc's in 0.00s Doing aes-256-cbc for 3s on 256 size blocks: 38356 aes-256-cbc's in 0.00s Doing aes-256-cbc for 3s on 1024 size blocks: 29925 aes-256-cbc's in 0.02s Doing aes-256-cbc for 3s on 8192 size blocks: 9659 aes-256-cbc's in 0.00s OpenSSL 0.9.7g 11 Apr 2005 built on: date not available options:bn(64,64) md2(int) rc4(ptr,int) des(ptr,risc2,4,int) aes(partial) blowfish(idx) compiler: information not available available timing options: USE_TOD HZ=100 [sysconf value] timing function used: getrusage The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes256 bytes 1024 bytes 8192 bytes aes-256-cbc 41438.21k 2560896.00k 9819136.00k 1961164.80k 79126528.00k Questions; 1) why does it mention that it is running for 3 seconds but then state a fraction of that in the last colum (elapsed time ?) ? The last colum is *not* the elapsed time, but the used cpu time. If you want the elapsed time (what you should do in this case), you have to use the option -elapsed with openssl speed. The values you got are more or less the max. possible rates (because of the overhead for accessing the crypto card) for an crypto card with infinite speed. 2) notice that the non-accelated box processed ~ 21000 8kb blocks in 3 seconds yet the accelerated box reckons in did 9659 of the same size blocks in 0.00 seconds. Can I force the speed test to run for 3 seconds ? The tests already ran for 3 seconds (elapsed). As said above, use the -elapsed option for getting numbers related to the elapsed time. Using the crypto card actually slows down your box, especially for small block sizes (e.g. by a factor of 240 for 16 byte blocks!). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: OpenSSL Random Number Generator
Hagai Yaffe wrote: I am looking for some documentation regarding OpenSSL Random Number Generator, I have looked on the net and could not find what I need. I mainly need some compression between OpenSSL Random Number Generator and other Random Generation algorithms (Blum-Blum-Shub, FIPS 186, RPK). I am using OpenSSL and I am looking into the ICSA labs certification, the mentioned Random Generation algorithms are the ones adopted by ICSA and I would like to know where I stand if I am using OpenSSL Random Number Generator. Is there any relevant documentation on this subject? Have you already looked into Peter Gutmann's paper http://www.cypherpunks.to/~peter/06_random.pdf, which compares some RNGs? Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Export-version ?
Anders Björnerstedt (AS/EAB) wrote: When downloading from the tarballs list, is it the case that the first choice on each version Is the export version ? and the other three (MD5) (SHA1) (PGP sign) are restricted ? It should be the MD5 sum, SHA1 sum and PGP signature respectively of the corresponding zipped tarball, so you can check whether your download is correct. (Currently i'm not able to download the sums/signatures, because the browser claims the files aren't readable). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: problem using FTP over SSL
ELLERT Alexandre wrote: I installed openssl-0.9.8 on my linux FTP server and I also compiled vsftpd-2.0.3 under RedHat 9 with SSL support (without any errors). And when I try to connect with FileZilla v2.2.16 under Windows XP I get some errors: Commande : AUTH TLS Réponse : 234 Proceed with negotiation. Erreur : Internal error: m_pSslLayer not initialized This seems imho to be an internal error of FileZilla. Erreur : Impossible de se connecter ! But the connection is still established and i can download and upload anyway ! You can use ssldump (http://www.rtfm.com/ssldump/) for checking whether any SSL handshake is started. Can you please tell me what’s going wrong with my config and what I should do to resolve that problem ? Check the FileZilla configuration for SSL specific options and use ssldump. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Problems with SSL Sessions
Lerchenfeld, David W. wrote: Has anyone seen this problem I have been fighting it for some time and cannot get it resolved: I have (specs below) Apache running on an HPUX11i server and everytime and activate SSL for a server Apache keeps launching child stacks instead of using the existing stacks. It will eventually get to Maxstacks and freeze. It looks like a lock is set but never reset or session caching is not working. Apache works fine when not using SSL, ANY help would be greatly appreciated... APACHE ERROR LOGFILE: [Tue Aug 23 21:31:44 2005] [info] Client requested a 'session-resume' but we have no such session. [Tue Aug 23 21:31:45 2005] [info] Initial (No.1) HTTPS request received for child 0 (server netman2.mk.unisys.com:4433) [...] I don't see what this has to do with OpenSSL. Try asking the mod_ssl people. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Recommended SSL Books...
Tyler Durden wrote: This book is good, but the openSSL version that use, I think that is the 0.96, so the documentation is slightly old. It's based on 0.9.6 but it gives some prospect on 0.9.7, so it's not so outdated as one might think. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP SW TP AIS Phone/Fax: +49-89-636-47852 / 48332 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Beginner Question
Ragnar Paulson wrote: I'm looking for a pointer to more documentation of how to use the openssl API, I don't really want to read the source or learn the internals. I have found the following two references: SSL and TLS: Designing and Building Secure Systems by Eric Rescorla Network Security with OpenSSL: Cryptography for Secure Communications by John Viega, Matt Messier, and Pravir Chandra Which of these should I buy, or is there a more recommened alternative. Both, because the latter book doesn't explain the details of the SSL/TLS protocol, but recommends reading the first book. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Announce list for releases ?
Enrico Weigelt wrote: is there an announce mailing list or something similare where notifications on new releases are posted ? Look at http://www.openssl.org/support/ Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Handshaking issue with 97d?
James Goddard wrote: We are using openssl in an application with an embeded GoAhead webserver. When using 97c everything works fine. When we switch to 97d everything still works fine on HPUX and Windows platforms, however on Linux we are unable to connect to the webserver via SSL. [...] Any hints? Try ssldump for getting more information. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: no shared cipher driving me batty
Mike Marshall wrote: so when a connection is accepted, here are the calls: 1) ssl = SSL_new(ctx) 2) BIO_new_socket 3) SSL_set_bio - called with the results of number 2 4) SSL_accept(ssl) -- this line fails with a code of -1 5) SSL_get_error returns error code 1 6) ERR_peek_error 7) ERR_error_string_n - this function reveals my dreaded error: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher This error means that the server doesn't accept any of the cipher suites proposed by the client. Look for the cipher suites the client uses and the server accepts, e.g. look for calls of SSL_CTX_set_cipher_list or inspect the configuration options of your software. Additionally ssldump (http://www.rtfm.com) may be helpful. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: SSL WANT READ ERROR
Madhuri Rambhatla wrote: I am a brand new user of OpenSSL. I have installed version 0.9.7d on my Win 2000 Server. My compiler is Visual Studio .NET for C++. When I try to perform a SSL_write(.) I get an error SSL_WANT_READ_ERROR. Please tell me how to rectify this. See for example http://www.openssl.org/docs/ssl/SSL_write.html# Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: TLS wrong version number problem, the correct lib for openssl ?
Lara Adianto wrote: What's the correct libraries for openssl ? Is this okay: [EMAIL PROTECTED] local]# ldd /usr/bin/openssl libdl.so.2 = /lib/libdl.so.2 (0x4001b000) libc.so.6 = /lib/i686/libc.so.6 (0x4001f000) /lib/ld-linux.so.2 = /lib/ld-linux.so.2 (0x4000) no libcrypto and libssl ? The ldd ouput on an linux box here with an old linux version looks alike. I tried to build openssl on this machine with shared libraries, but this wasn't successful. On a box with a newer linux version ldd shows libcrypto and libssl and there are shared libs libssl.so.0 and libcrypto.so.0. So your ldd output seems to be ok for openssl build with static libs. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: compilation of openssl-0.9.6b and TLS wrong version number problem
Lara Adianto wrote: I actually used openssl-0.9.6i, it compiled perfectly and can link with openldap properly. But when I tested the TLS connection with the server, it threw me : - TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A daemon: select: listen=6 active_threads=0 tvp=NULL daemon: select: listen=7 active_threads=0 tvp=NULL daemon: activity on 1 descriptors daemon: activity on: 10r daemon: read activity on 10 connection_get(10): got connid=1 connection_read(10): checking for input on id=1 TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS: can't accept. TLS: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number s3_pkt.c:297 The last two lines say (after a look into s3_pkt.c at line 297) that the major version number in the SSL record is unequal to '3'. It may be that the client speaks only SSLv2, check therefore the client configuration. It may be helpful if you trace the handshake with ssldump (see http://www.rtfm.com). connection_read(10): TLS accept error error=-1 id=1, closing connection_closing: readying conn=1 sd=10 for close connection_close: conn=1 sd=10 - I posted this problem to this list, but nobody replied...so I thought that I have to use the same version of ssl in the server and the clientis this true ? I would be surprised if using the same version of OpenSSL helps ;-). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbHm __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: TLS protocol question
Frederic Evrard wrote: Ok thanks, and this HMACs keys are used to forge TLS Record Layer : Hanshake Protocol : Encrypted Hanshake Message HMACs(shared secret+DAta). Is it used to control integrity of the TLS Handshake packet ? Not for ensuring the integrity of the TLS Handshake packets, but for ensuring the integrity of the application data exchanged after the handshake: All TLS cipher suites which can be negotiated, even the ones with no data encryption, use HMACs. The suite TLS_NULL_WITH_NULL_NULL without HMACs, which is the inital state at the first handshake, can't be negotiated: see RFC 2246, p.54. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: TLS protocol question
Frederic Evrard wrote: I'm using open-ssl to do EAP-TLS authentication, then I've a question about something strange for me. When you want to use TLS to mount an uncrypted tunnel, you need a session key, but in authentication you only need certificate checking ?? Why generate pre-master-key, master-key, etc... if datas aren't crypted after authentication. Is it just to respect the protocol ? For computing the HMACs keys are needed, therefore you need the pre-master-key etc. in any case. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: STunnel \ OpenSSL Crashes
Warrick FitzGerald wrote: Hi All, Im running STunnel in a production web server environment. I have recently been experiencing crashes which Im not sure to attribute to STunnel or OpenSSL, as I am not that savvy as to where the two cross lines. I have posted similar question on the STunnel groups before and the developers were under the impression that it was an OpenSSL issue. See e.g. my posting with the subject [PATCH] Missing loop end check in crypto/engine/eng_table.c and Geoff Thorpe's answer in openssl-dev. Geoff has made a more generally patch in crypto/stack/stack.c (see the latest CVS snapshots). Probably any of this patches will remedy your problem. Ciao, Richard -- Dr. Richard W. Knning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: SSL with dynamic IP
Jochen Schaefer wrote: does anybody know how to accept a SSL certificate where only the certificate date and the company which issued it have to be valid? I want to establish a SSL connection between 2 tomcat web server where both have the possibility to access each other. One has a static ip the other one a dynamic ip. I don't see your problem. Normally a certificate contains a host name, not an ip address. So long as the servers are addressed via unchanging host names, you can check whether the certificates contain the right host names. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: default cipher suit in open ssl
rajesh nair wrote: I saw all the cipher names but i want to know the default cipher suit supported by openssl lib. if i write a program using openssl , with out using SSL_CTX_set_cipher_list() function what will bw the default cipher set ? (that is i am not choosing a cipher suit from the list ) Why won't you use SSL_CTX_set_cipher_list()? Using it you get any default you like and don't have to depend on a more or less arbitrary OpenSSL default. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Regarding all the spam...
Boyle Owen wrote: -Original Message- From: Scott Lamb [mailto:[EMAIL PROTECTED] The spammer who zapped the mod_ssl list (see http://marc.theaimsgroup.com/?l=apache-modsslr=1b=200403w=2) has now moved onto this list (see content-free mail apparently from rse...) Can someone with admin powers block these spams? This is no spam, but, according to our mail virus scanner, a worm named WORM_NETSKY.B. Btw, how can a content-free mail be spam? ;-) Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Memory BIO_pairs and SSL
Chris Rowe wrote: Where's a good example that shows doing an SSL handshake with a memory BIO_pair? I want to do overlapped IO on sockets and pipes without going through the SSL_connect(), SSL_write(), etc. functions, but I'm not sure how to go about doing the handshake mechanics to perform the certificate exchange. Have a look at the function doit in test/ssltest.c. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: The crypto library and it's usage
Chris Nolan wrote: 1. Using a certificate that contains the client's public encryption key, send a PKCS7 message to the client. 2. Get the client to send me a hash of the decrypted content. The problem is, wrapping my head around what to call and in what order on the server side. The man pages are good, but don't really give me much insight as to the structure of the API. Can anyone point me in the direction of some examples on how to do this? The reason I want to use PKCS7 is because the library on the client side is already setup to do this with a single C function call. It seems to me that for step 1 you just have to call PKCS7_encrypt and PKCS7_sign in the right order. For step 2 it should be PKCS7_decrypt and PKCS7_verify. For all four functions exists a man page. If you need examples you can find some in the OpenSSL book from John Viega et al. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Hardware crypto speed anyone?
Markus Lorch wrote: Marton, I think your card is simply slow. I've done similar test (RSA only) using an IBM 2058 eServer Cryptographic Accelerator (ICA), which has 5 ultracyper crypto processors on it. The machine is a dual xeon 2.4 box running Linux 2.4.20 I used openssl 0.9.7b with IBM's ibmca engine and libica, threading activated, both CPU's at 100% with the hardware engine deactivated, minimal main CPU usage with the engine activated. For 2048bits the ICA could do almost 70 times as many signing operations than the two main CPUs could handle. No, it's only a factor 1.5, see below. /opt/src/openssl-0.9.7b/apps # ./openssl speed rsa Doing 512 bit private rsa's for 10s: 11089 512 bit private RSA's in 9.99s Doing 512 bit public rsa's for 10s: 120057 512 bit public RSA's in 10.00s Doing 1024 bit private rsa's for 10s: 2124 1024 bit private RSA's in 10.00s Doing 1024 bit public rsa's for 10s: 40108 1024 bit public RSA's in 10.00s Doing 2048 bit private rsa's for 10s: 347 2048 bit private RSA's in 10.02s Doing 2048 bit public rsa's for 10s: 11800 2048 bit public RSA's in 9.99s Doing 4096 bit private rsa's for 10s: 52 4096 bit private RSA's in 10.14s Doing 4096 bit public rsa's for 10s: 3321 4096 bit public RSA's in 9.99s OpenSSL 0.9.7b 10 Apr 2003 built on: Thu Sep 25 17:47:01 EDT 2003 options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -DSHA1_ASM -DMD5_ASM -DRMD160_ASM available timing options: TIMES TIMEB HZ=100 [sysconf value] timing function used: times signverifysign/s verify/s rsa 512 bits 0.0009s 0.0001s 1110.0 12005.7 rsa 1024 bits 0.0047s 0.0002s212.4 4010.8 rsa 2048 bits 0.0289s 0.0008s 34.6 1181.2 rsa 4096 bits 0.1950s 0.0030s 5.1332.4 The following run of the speed program measures RSA operations per host cpu time, not per elapsed time; in other words it gives the performance of an hypothetical system using an accelerator card with infinitely high speed. /opt/src/openssl-0.9.7b/apps # ./openssl speed -engine ibmca rsa engine ibmca set. Doing 512 bit private rsa's for 10s: 6942 512 bit private RSA's in 0.43s ^^ This is host CPU time, the elapsed time is 10s +/-. Doing 512 bit public rsa's for 10s: 30522 512 bit public RSA's in 0.50s Doing 1024 bit private rsa's for 10s: 2139 1024 bit private RSA's in 0.32s Doing 1024 bit public rsa's for 10s: 19278 1024 bit public RSA's in 0.55s Doing 2048 bit private rsa's for 10s: 529 2048 bit private RSA's in 0.23s Doing 2048 bit public rsa's for 10s: 6651 2048 bit public RSA's in 0.14s RSA sign failure. No RSA sign will be done. 31561:error:8606706E:ibmca engine:IBMCA_MOD_EXP:mexp length to large:hw_ibmca.c:1051: RSA verify failure. No RSA verify will be done. 31561:error:04077077:rsa routines:RSA_verify:wrong signature length:rsa_sign.c:154: OpenSSL 0.9.7b 10 Apr 2003 built on: Thu Sep 25 17:47:01 EDT 2003 options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -DSHA1_ASM -DMD5_ASM -DRMD160_ASM available timing options: TIMES TIMEB HZ=100 [sysconf value] timing function used: times signverifysign/s verify/s rsa 512 bits 0.0001s 0.s 16144.2 61044.0 rsa 1024 bits 0.0001s 0.s 6684.4 35050.9 rsa 2048 bits 0.0004s 0.s 2300.0 47507.1 Relating the measured numbers to 10 sec elapsed time gives following results: sign/s verify/s rsa 512 bits 694 3052 rsa 1024 bits 214 1928 rsa 2048 bits 53665 Redo the measurement with the -elapsed option, it should reproduce the just given results. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Generating a symmetric key
Ashutosh Jaiswal wrote: My problem is generating an individual symmetric key which can be used as a session key. I looked at all symmetric crypto functions, but didn't seem to find one that could generate a key on its own. Maybe I overlooked something. Anyone have any suggestions? Normally a symmetric key is just a random string of appropriate length. DES and 3DES keys are an exception, because some bits of the keys are defined as parity bits similar to the parity bit at RS232-Interfaces. Second, DES is known to have some weak and semi-weak keys, which one should avoid. On the other hand there are afaik only 4 weak and 12 semi-weak keys, so the chance to get such a key randomly is minimal. Iirc has OpenSSL functions to set the parity bits of DES keys and test for key weakness, look out for the documentation of the DES functions. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: CRL text output on OS390 gives: Bad time value
Gerrit v d Hul wrote:
Hi list,
I've build OpenSSL version 0.9.7b on OS390 (zOS) with 'Configure OS390-Unix'
I want to check/read a CRL, but this gives a problem: the time values are not
given.
The command 'openssl crl -noout -text -in 5a5d2711.r0' gives:
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: /C=
Last Update: Bad time value
Next Update: Bad time value
CRL extensions:
[...]
The command 'Make test' also gives bad results (but I'm not sure this problem is
related to the 'Bad time value'-problem):
./md4test
test 1 ok
error calculating MD4 on 'a'
got 9d16e62335fbfc2946dd98546d5ca3e6 instead of bde52cb31de33e46245e05fbdbd6fb24
[...]
I have tried to compile OpenSSL with the -0 option (no optimizations), but this
gives the same bad results.
Any ideas?
Both problems are probably due to missing ASCII-EBCDIC conversions. I
attach the EBCDIC patches which i have made so far for 0.9.7b. For the
test programs i don't have a patch, but it should suffice to convert the
appropriate text strings from EBCDIC to ASCII before computing the digests.
Please report whether the attached patches solve your first problem (i
haven't tried them with CRLs).
Ciao,
Richard
--
Dr. Richard W. Könning
Fujitsu Siemens Computers GmbH
--- /home2/openssl/tmp/openssl-0.9.7a/apps/ca.c Thu Jan 30 18:37:35 2003
+++ apps/ca.c Thu Mar 27 21:19:44 2003
@@ -3203,13 +3203,22 @@
p=(char *)str-data;
for (j=str-length; j0; j--)
{
+#ifdef CHARSET_EBCDIC
+ if ((*p = 0x20) (*p = 0x7e))
+ BIO_printf(bp,%c,os_toebcdic[*p]);
+#else
if ((*p = ' ') (*p = '~'))
BIO_printf(bp,%c,*p);
+#endif
else if (*p 0x80)
BIO_printf(bp,\\0x%02X,*p);
else if ((unsigned char)*p == 0xf7)
BIO_printf(bp,^?);
+#ifdef CHARSET_EBCDIC
+ elseBIO_printf(bp,^%c,os_toebcdic[*p+0x40]);
+#else
elseBIO_printf(bp,^%c,*p+'@');
+#endif
p++;
}
BIO_printf(bp,'\n);
--- /home2/openssl/tmp/openssl-0.9.7a/crypto/asn1/a_print.c Fri Dec 8 20:06:56
2000
+++ crypto/asn1/a_print.c Thu Mar 27 21:23:47 2003
@@ -72,27 +72,18 @@
while ((*s) (len-- != 0))
{
c= *(s++);
-#ifndef CHARSET_EBCDIC
- if (!( ((c = 'a') (c = 'z')) ||
- ((c = 'A') (c = 'Z')) ||
- (c == ' ') ||
- ((c = '0') (c = '9')) ||
- (c == ' ') || (c == '\'') ||
- (c == '(') || (c == ')') ||
- (c == '+') || (c == ',') ||
- (c == '-') || (c == '.') ||
- (c == '/') || (c == ':') ||
- (c == '=') || (c == '?')))
- ia5=1;
if (c0x80)
+ {
t61=1;
-#else
- if (!isalnum(c) (c != ' ')
- strchr('()+,-./:=?, c) == NULL)
+ break;
+ }
+ if (!( ((c 0x40) (c 0x5b)) || /* AZ */
+ ((c 0x60) (c 0x7b)) || /* az */
+ ((c 0x2a) (c 0x3b)) || /* +,-./09: */
+ (c == 0x20) || (c == 0x27) || /* SPC, ' */
+ (c == 0x28) || (c == 0x29) || /* () */
+ (c == 0x3d) || (c == 0x3f)))/* =? */
ia5=1;
- if (os_toascii[c] 0x80)
- t61=1;
-#endif
}
if (t61) return(V_ASN1_T61STRING);
if (ia5) return(V_ASN1_IA5STRING);
--- /home2/openssl/tmp/openssl-0.9.7a/crypto/asn1/a_gentm.c Fri Sep 28 02:44:44
2001
+++ crypto/asn1/a_gentm.c Tue Apr 1 19:51:52 2003
@@ -121,10 +121,18 @@
static int max[9]={99, 99,12,31,23,59,59,12,59};
char *a;
int n,i,l,o;
+#ifdef CHARSET_EBCDIC
+
char a_e[17];
+#endif
if (d-type != V_ASN1_GENERALIZEDTIME) return(0);
l=d-length;
+#ifdef CHARSET_EBCDIC
+ ascii2ebcdic(a_e, d-data, l 17 ? l : 17);
+ a = a_e[0];
+#else
a=(char *)d-data;
+#endif
o=0;
/* GENERALIZEDTIME is similar to UTCTIME except the year is
* represented as . This stuff treats everything as a two digit
@@ -195,6 +203,10 @@
ASN1_STRING_set((ASN1_STRING *)s,
(unsigned char *)str,t.length);
s-type=V_ASN1_GENERALIZEDTIME;
+#ifdef CHARSET_EBCDIC
+/* Assume that str is an EBCDIC string. */
+ ebcdic2ascii(s-data, s-data, s-length);
+#endif
}
return(1);
}
@@ -232,7 +244,7 @@
Re: FQDN
Jue (Jacky) Shu wrote: Yes, Lutz. That's why I want to check peer's FQDN against which on its certificate. Look at Lutz' list. You get already in step 1 the FQDN from the *user*, so there is no need for further actions to find out the peer's FQDN. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: FQDN
Jue (Jacky) Shu wrote: Sorry, Richard. Maybe I didn't put it clearly. There r two names, one is from the certificate, another one is from DNS. They must match. The other one is *not* from DNS, but from the *user* (step 1 from Lutz' list). The user wants to connect to a specific site, and the system has to ensure that it does, what the *user* wants. Therefore, get the FQDN from the *user* and ensure that the name from the certificate agrees with the FQDN from the *user*. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: FQDN
Jue (Jacky) Shu wrote: Yes, that's what I want to do. But I have to use SSL_accept instead of accept, and peer's ip address is dynamic. Can I get peer's ip address from SSL connection? Normally one makes first an accept and then an SSL_accept. After the accept you can proceed as described by Christopher. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Question on Record Layer.
Shashank Khanvilkar wrote: Hi, I don't know how to exactly describe my problem, but I will try my best with the help of a packet trace. Below is a trace of an SSL session. As seen from this, when the handshake is complete, and i send an applicaion data of 128 bytes, why do i get two record layer packet, instead of just one. In other wiords, I know how the 152 bytes packet comes, but I have no idea as to why the client sends an additional 24 byte record layer packet. If you have access to the private RSA key, than you can get ssldump to decrypt the application data, see the ssldump man page for more information. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Question on Record Layer.
Shashank Khanvilkar wrote: Yes.. i did use SSLdump, with the private RSA key to capture the trace. Below is the command that i used. /usr/local/sbin/ssldump -i eth0 -A -d -X -k $HOME/certificates/client.pem port I think ssldump has no option to dump the application data in hex.. but I will check. The option -X should be the right option for printing the data in hex, but i have the impression, that the value for the -k option is wrong: the file specified here must contain the *private* key of the *server*, not the client certificate. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: error codes help
At 13:07 28.03.2003 +0530, you wrote: Hi, Can anyone tell me how can I get to understand the meaning of error codes ,alert numbers and other stuff I#8217;m getting the following error on my server : error:140943E8:SSL routines:SSL3_READ_BYTES:reason(1000):s3_pkt.c:985:SSL alert number 0 I cant figure out what does the above statement mean. Is there any documentation on such codes? RFC 2246, p. 24 ff. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: Installation problem with OpenSSL
At 10:54 28.03.2003 -0500, you wrote: Thanks! I did that and it worked thanks. But now it complains about ld:ERROR: fatal error: library not found: -lthread Replace in Saju's answer socket with thread and repeat the procedure. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Export regulations
At 07:54 28.03.2003 -0800, Neil Nelson wrote: Martin Witzel wrote: The basic question amounts to: Is there an exportable version of OpenSSL? U.S. Export home page for encryption can be found at From Martin's E-Mail address i presume that he is an employee of the german subsidiary of an U.S. company. As long as he doesn't say from which country he will be exporting, no specific advice can be given. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Documentation in HTML
At 10:15 11.10.2002 +0100, you wrote: Could someone consider whether the documentation for OpenSSL should be shipped in HTML format as well as POD please? I use Windows 2000 and my current ActiveWare version of Perl only contains POD2TEXT which is somewhat limiting. My ActiveWare version of Perl contains a pod2html. Throw another look or update your Perl. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: Is OCSP client (or server) support available in openssl?
At 13:00 30.08.2002 -0400, you wrote: http://www.openssl.org/docs/apps/ocsp.html describes the openssl ocsp command, but openssl-0.9.6g command line doesn't recognize the ocsp command and I don't see it anywhere in the sources. Can anyone tell me if ocsp is available and, if so, where? Iirc this is available in openssl-0.9.7. Ciao, Richard Könning -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: random seed
At 18:10 01.07.2002 +0200, you wrote: does anyone knows how to obtain a big random seed in systems that doesn't provide /dev/urandom? Get and port for example PRNGD. (http://www.aet.TU-Cottbus.DE/personen/jaenicke/postfix_tls/prngd.html) may be i could initialize RAND_seed with current time, and then generate random numbers and provide them as the new random seed. is this a good choice? No! This way you get no more entropy than the amount contained in current time which is far too less for cryptographic purposes. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: (forgot to add subj. last time) SSL Telnet servers
At 16:26 01.07.2002 -0700, you wrote: I am trying to download ftp://ftp.runestig.com/pub/starttls/start_tls-telnet.current.tar.gz I tried using MSIE 5.5 and a regular FTP client (anonymous connection) I tried with Netscape (which works normally with this site) and got the same error. This seems to be a server problem. Wait a day and try again or mail an error report to Peter 'Luna' Runestig [EMAIL PROTECTED]. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: SSL and persistent HTTP connections
At 12:01 24.05.2002 +0100, you wrote: When a browser connects to a https site, does it include some sort of token in the header to enable the server to equate two or more requests to the same ssl session? Some thing to hash on ... See RFC 2246, p. 31. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: FTP with SSL
At 01:55 05.04.2002 +0200, you wrote: heh, i didn't mean to insult anyone of the great ppl who put a lot of effort into the ftp-tls specs. i'm currently working on a client-side implemenation myself. i spent lots of time to get the command data encryption to work. it was pretty hard for me because of the fact that it's not that common yet, i found few documents/sources which i could use, so I just wanted to state that ftp-tls isn't really as widespread and easy-to-use as shttp or secure mail is. ftp-tls is a great thing, tho and i hope it will be established soon (same with ssl-irc, btw). Have a look at the client and server implementations at ftp://ftp.runestig.com/pub/ I found these very helpful for me. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: OpenSSL Key Generation GUI for Windows
At 12:55 27.01.2002 +, you wrote: I'm thinking of writing a small GUI application that implements just the 2 following functions of: *Create a self-signed certificate *Create a private key First, is there such an application already around (I can't find any), and secondly, would a random seed made from the current time (date, hour, minutes, seconds, ms) be okay (this would be running under Windows)? No! (regarding the random seed) Netscape has (afaik) used such a seeding (time and process id) in early versions of their browsers. The resulting keys were broken in just one or two hours with a simple PC (today it would probably just minutes). Look into the OpenSSL sources, in crypto/rand is some code for gathering entropy material under windows (iirc). Ciao, Richard Könning -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: OpenSSL Key Generation GUI for Windows
At 09:09 28.01.2002 -0500, you wrote: I was under the impression that on windows OpenSSL uses RAND_screen which will obtain random data from the screen and mouse events? Shouldn't you use that? Exactly this function (in crypto/rand/rand_win.c) i had on my mind, but i was too lazy to lookup the name. Jeffrey has already described in more detail how this function gathers entropy. Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: FTP over SSL
At 10:27 24.10.2001 +1300, you wrote: On Wed 23 Oct 2001, Scott Klement wrote: For a MS-Windows client that can connect using FTP over SSL, go here: http://www.wsftp.org/ Thanks Scott. Much appreciated. I do not especially want to write my own ssl/ftp client so I'll go with the above links. But be warned that WS FTP uses only 40 bit export ciphers, at least the versions which i checked (V6.6 and V7.0-Tryout). Another possibility is CuteFTP, which uses strong encryption. A possible drawback with both clients is that it is not possible to encrypt only the control connection (in case when you only want to protect the password with SSL). This may have a severe impact on the transfer rate. The third Windows-Client known to me is Igloo FTP, which allows to encrypt only the control connection, but is restricted to weak 40 bit export ciphers too. A further drawback of WS FTP and Cute FTP is, that they use for the data connection a new SSL session (no resumption of the SSL session of the control connection). This leads to an unnecessary high load on the FTP server. Some server may therefore even disallow the use of a separate session for the data connection. All in all there is IMHO no Windows FTP client, which could be currently recommended unrestricted. (CuteFTP: www.globalscape.com, Igloo FTP: www.iglooftp.com). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: FTP over SSL
At 09:19 24.10.2001 EDT, you wrote: The implementation of AUTH SSL/TLS in the FTP client support that comes with Kermit 95 and C-Kermit 8.0 http://www.kermit-project.org/ftpd.html supports all ciphers supported by OpenSSL; reuses the session for the data connections; and properly performs ver I have tried to get the trial version of the secure variant of K95 with no success (i am directed to the URL http://www.cryptography.org/freecryp.htm which seems to be non-existant), probably because i am living/working outside USA/Canada. All in all there is IMHO no Windows FTP client, which could be currently recommended unrestricted. Well, i should have written Windows FTP client with a GUI ;-). Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: openssl engine?
At 20:33 12.10.2001 +0200, Helmut Heilig wrote: can anybody tell me the difference between openssl and openssl-engine. Couldn't find anything about that in the FAQ. See: http://www.openssl.org/support/faq.html [MISC] 6. What is an 'engine' version? Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: engine and without engine
At 14:56 10.10.2001 +0800, you wrote: Does anyone know what the different between OpenSSL 0.9.6b and OpenSSL 0.9.6b - engine? See: http://www.openssl.org/support/faq.html [MISC] 6. What is an 'engine' version? Ciao, Richard -- Dr. Richard W. Könning Fujitsu Siemens Computers GmbH, EP LP COM 5 Phone/Fax: +49-89-636-47852 / 47655 E-Mail: [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
