Re: enabling crypto hardware for NSS

2008-07-22 Thread Nelson B Bolyard
I wrote: > I found the bug that is responsible for the fact that no error message > is displayed, and we could fix it, I filed bug 447563 about this. https://bugzilla.mozilla.org/show_bug.cgi?id=447563 Pleas feel free to add yourself to the CC list of that bug if you're interested in updates. _

Re: Failed to toggle FIPS mode with JSS

2008-07-22 Thread Nelson Bolyard
Wan-Teh Chang wrote: > NSS doesn't allow importing or exporting of *unencrypted* secret > or private keys in FIPS mode. > > This is not an issue for SSL because the incoming premaster secret > from the *client* is encrypted with the server's RSA public key. > > If you really have to import an un

Re: enabling crypto hardware for NSS

2008-07-22 Thread Nelson Bolyard
David Sadler wrote: > > I am trying to enable crypto hardware support on an IBM z/Series system > running Linux. Is this IBM linux? Red Hat Linux? or ? (I ask because I know that Red Hat Linux supports mod_nss in Apache, but I was not aware that it was also being used in any IBM Linux. That wo

Re: Failed to toggle FIPS mode with JSS

2008-07-22 Thread Wan-Teh Chang
On Tue, Jul 22, 2008 at 1:22 PM, Dean <[EMAIL PROTECTED]> wrote: > > I've been reading around about key generation and key material > manipulation and am hearing that key material manipulations is not > allowed in FIPs mode. This seems to be confirmed by my code which > works in non-FIPs mode but

Re: Failed to toggle FIPS mode with JSS

2008-07-22 Thread Dean
Glen, Thanks for the help. I was so sure I had the checksum files in the right place I had them but only with the libraries I thought I was running against, not the ones I was really running against. Whoops. I have to ask for a little more help though. I've been reading around about k

RE: 3rd party ECC module + NSS integration

2008-07-22 Thread David Stutzman
> -Original Message- > From: > [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > la.org] On Behalf Of Wan-Teh Chang > Sent: Friday, July 18, 2008 12:04 AM > To: mozilla's crypto code discussion list > Subject: Re: 3rd party ECC module + NSS integration > Since you need the bug fix in the

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread Justin Dolske
rainer_k wrote: > If this is such a serious concern, why did Microsoft decicde to put > this CA inside the Windows > CA store and even distribute this via automatic update? I don't think "but Microsoft did it" is, in general, a convincing argument when it comes to good security practice. > The

Re: JSS import / remove .p12 user certificate

2008-07-22 Thread Glen Beasley
hi, http://mxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/ google: JSS java applet http://java.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/keystores.html google: firefox java applet http://kb.mozillazine.org/Java -glen joshuaaa wrote: > On Jun 11, 10:04 am, jo

Re: Failed to toggle FIPS mode with JSS

2008-07-22 Thread Glen Beasley
hello, Can you ensure that your installation has the ".chk" files in the same directory as their corresponding "dlls". meaning libfreebl3.chk libsoftokn3.chk need to be with libfreebl3.dll libsoftokn3.dll. http://mxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/ http://mxr.m

RE: Firefox crash issue

2008-07-22 Thread Ruchi Lohani
Thanks Wan-Teh! That helped. -Ruchi -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wan-Teh Chang Sent: Monday, July 21, 2008 12:32 PM To: mozilla's crypto code discussion list Subject: Re: Firefox crash issue 2008/7/21 Ruchi Lohani <[EMAIL PROTECTED]>:

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread Eddy Nigg
[EMAIL PROTECTED]: > Eddy, > > we (T-Systems) appreciate your input, even if we don't agree with all > of your statements. We strongly encourage you to give further feedback > until the end of the first week. We know that you do this in your > spare time to support Mozilla, but changing the CP and

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread Frank Hecker
rainer_k wrote: > If this is such a serious concern, why did Microsoft decicde to put > this CA inside the Windows > CA store and even distribute this via automatic update? > Installment of the Telekom CA into Firefox and putting more > restrictive policies for CAs into action in general > are two

Failed to toggle FIPS mode with JSS

2008-07-22 Thread Dean
Sorry to ask such a simple question, but I have been unable to successfully run JSS in FIPs mode. I am using the binary distribution for: JSS 4.2.5 NSPR 4.6.4 NSS 3.11.4 The following (very) simple Java program import org.mozilla.jss.CryptoManager; public class SimpleTest4 { public st

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread wolfgang . pietrus
Eddy, we (T-Systems) appreciate your input, even if we don't agree with all of your statements. We strongly encourage you to give further feedback until the end of the first week. We know that you do this in your spare time to support Mozilla, but changing the CP and CPS is a serious act and shoul

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread Eddy Nigg
[EMAIL PROTECTED]: > Eddy, Frank, > > See the comments of T-Systems (WP as an Acronym of my Name Wolfgang > Pietrus) in the text below. Hallo Wolfgang, Vielen Dank fuer Ihre Antwort :-) >> >> Nevertheless I read mostly the English version which is easier to >> understand. Similar to Kathleen's

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread Eddy Nigg
rainer_k: > Eddy, > > If this is such a serious concern, why did Microsoft decicde to put > this CA inside the Windows > CA store and even distribute this via automatic update? > Installment of the Telekom CA into Firefox and putting more > restrictive policies for CAs into action in general > are

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread rainer_k
Eddy, If this is such a serious concern, why did Microsoft decicde to put this CA inside the Windows CA store and even distribute this via automatic update? Installment of the Telekom CA into Firefox and putting more restrictive policies for CAs into action in general are two different topics and

Re: Deutsche Telekom/T-Systems CA request

2008-07-22 Thread wolfgang . pietrus
Eddy, Frank, See the comments of T-Systems (WP as an Acronym of my Name Wolfgang Pietrus) in the text below. On Jul 20, 1:37 am, Eddy Nigg <[EMAIL PROTECTED]> wrote: > I started to review this inclusion request by reading parts of the > German version of the CP and CPS, which I understand is the