Re: Prevent "proxyfying" PKCS#11

2015-09-28 Thread Erwann Abalea
(This is off-topic, no further answer from me on this subject) Bonsoir, Le samedi 26 septembre 2015 01:17:49 UTC+2, Julien Pierre a écrit : > What are the replacement plug-in API mechanisms following the > deprecation of NPAPI ? PPAPI. > Can't they be used to write another Java plug-in ? I do

Re: Prevent "proxyfying" PKCS#11

2015-09-25 Thread Erwann Abalea
Le vendredi 25 septembre 2015 14:39:04 UTC+2, helpcrypto helpcrypto a écrit : > On Fri, Sep 25, 2015 at 11:52 AM, Erwann Abalea wrote: [...] > Although it won't solve my problem, this will make possible to kill > signature applets forever, which indeed it's my real objective.

Re: Prevent "proxyfying" PKCS#11

2015-09-25 Thread Erwann Abalea
Bonjour, Le vendredi 25 septembre 2015 10:36:53 UTC+2, helpcrypto helpcrypto a écrit : > I hope you can find a solution for my problem, cause I can't. (And perhaps > it's impossible) > > Based on my knowledge of PKCS#11 standard, the spec is exposed to a MITM > attack that steals the PIN when an

Re: Remove Legacy TLS Ciphersuites from Initial Handshake by Default

2015-03-16 Thread Erwann Abalea
Le lundi 16 mars 2015 19:47:30 UTC+1, Ryan Sleevi a écrit : > On Mon, March 16, 2015 10:24 am, Erwann Abalea wrote: > > Le lundi 16 mars 2015 10:29:08 UTC+1, Kurt Roeckx a écrit : > > > On 2015-03-14 01:23, kim@safe-mail.net wrote: > > > > Is there an agreed t

Re: Remove Legacy TLS Ciphersuites from Initial Handshake by Default

2015-03-16 Thread Erwann Abalea
Le lundi 16 mars 2015 10:29:08 UTC+1, Kurt Roeckx a écrit : > On 2015-03-14 01:23, kim@safe-mail.net wrote: > > Is there an agreed timeline for deprecation of the technologies listed in > > the initial posting? We should be proactive in this field. > > > > For example, last month a plan to dep

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-10-17 Thread Erwann Abalea
Le jeudi 16 octobre 2014 22:04:59 UTC+2, treb...@gmail.com a écrit : [...] > YOU F**KTARDS.. SOMETIMES WE HAVE ABSOLUTELY ZERO F**KING CONTROL OVER THE > SSL CERT PRESENTED.. WE **know** IT SHOULD BE TRUSTED BECAUSE ITS AN INTERNAL > F**KING DEVICE, AND DON'T GIVE ONE FLYING F**K IF THE CERT IS

Re: Other ECC Curves

2014-06-11 Thread Erwann Abalea
Le mercredi 11 juin 2014 11:58:24 UTC+2, cod3 ang3l a écrit : > On Tue, 2014-06-10 at 18:47 +0200, Kurt Roeckx wrote: > > > I would also like to see Ed25519, but there is no standard on how > > to do that yet. > > I added patch for Curve25519 to > https://bugzilla.mozilla.org/show_bug.cgi?id=9571

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-04-28 Thread Erwann Abalea
Bonjour Kyle, Le mardi 29 avril 2014 01:10:19 UTC+2, Kyle Hamilton a écrit : > On Fri, Apr 25, 2014 at 6:59 AM, Erwann Abalea wrote: > > Le vendredi 25 avril 2014 13:46:51 UTC+2, Martin Paljak a écrit : > >> On Thu, Apr 24, 2014 at 9:07 PM, Kathleen Wilson > wrote: &g

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-04-28 Thread Erwann Abalea
Bonjour, Le lundi 28 avril 2014 18:11:30 UTC+2, David Keeler a écrit : > On 04/26/2014 01:44 AM, Erwann Abalea wrote: > > > Took a quick look at the code, it looks like KU/EKU checks is ok, > > BasicConstraints checks are weirdly done, NameConstraints checks are h

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-04-26 Thread Erwann Abalea
Le vendredi 25 avril 2014 21:09:58 UTC+2, Martin Paljak a écrit : > On Fri, Apr 25, 2014 at 4:59 PM, Erwann Abalea wrote: > > AKI is only a helper for certificate path building. > > It's mandatory for CAs to issue certificates with matching keyIdentifiers > >

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-04-25 Thread Erwann Abalea
Le vendredi 25 avril 2014 13:46:51 UTC+2, Martin Paljak a écrit : > On Thu, Apr 24, 2014 at 9:07 PM, Kathleen Wilson wrote: > > Also, we added a section to the wiki page to list some behavior changes that > > could cause a website certificate to no longer validate with Firefox 31. > > https://wiki

Re: SSL objects and NSS code communicating with PKCS#11 module

2014-03-05 Thread Erwann Abalea
Bonjour, Le lundi 3 mars 2014 13:31:20 UTC+1, Raad Bahmani a écrit : > I need to implement a PKCS11-library which simulates a smart-card and > responds to login attempts with SSL certificates. Your simulated smartcard won't do any login with SSL cert (it won't go that high). When the Mozilla pro

Re: id-ce-nameConstraints (2.5.29.30) in the real world

2013-11-02 Thread Erwann Abalea
Le samedi 2 novembre 2013 08:39:53 UTC+1, Kaspar Brand a écrit : > 11 hours ago, a new certificate was given birth to which I would > like to share with this list for edification purposes. I think that the > audience here should be able to fully appreciate what marvellous > real-world example we ar

Re: [ANNOUNCE] NSS 3.15.1 Release

2013-07-10 Thread Erwann Abalea
Le mardi 2 juillet 2013 19:51:05 UTC+2, Kai Engert a écrit : > The NSS team has released Network Security Services (NSS) 3.15.1, which is > a minor release. > > The HG tag is NSS_3_15_1_RTM. NSS 3.15.1 requires NSPR 4.10 or newer. > > Detailed release notes are available at > https://developer.mo

Re: eSTREAM ciphers on NSS

2013-01-17 Thread Erwann Abalea
Le jeudi 17 janvier 2013 15:16:52 UTC+1, Lucas Vella a écrit : > Would be of interest to have the eSTREAM selected ciphers (Profile 1, > Software) implemented on NSS? > > There is at least one SSL package, cyaSSL, having two of them four shipped as > extensions, Rabbit and HC-128: > TLS_RSA_WITH

Re: Certificate Distrust / Removal via Extension

2012-07-31 Thread Erwann Abalea
Le lundi 30 juillet 2012 21:37:56 UTC+2, Ridley a écrit : > I'm looking for a way to eliminate troublesome cross-certificates from > Firefox or Thunderbird, via an extension. I'm quite familiar with > successfully adding certificates, but having some difficulty in using the > APIs to remove and

Re: Is there an ETA yet for when Firefox will use libpkix by default?

2012-06-09 Thread Erwann Abalea
Le vendredi 8 juin 2012 22:55:33 UTC+2, Rob Stradling a écrit : [...] > Might there be a Firefox 13.x point-release that will enable libpkix by > default? > Will Firefox 14 enable libpkix by default? > Or can you say that enabling libpkix by default will definitely not > happen until Firefox 15 o

Re: Google about to fix the CRL download mechanism in Chrome

2012-02-10 Thread Erwann Abalea
Le vendredi 10 février 2012 13:44:20 UTC+1, Ondrej Mikle a écrit : [...] > UI of TLS clients could be different for specific revocation reasons. > It's really a corner case (just for the sole purpose of an example). Please, not another UI change. We have a green bar that's not displayed the same

Re: Google about to fix the CRL download mechanism in Chrome

2012-02-10 Thread Erwann Abalea
Le mercredi 8 février 2012 21:57:09 UTC+1, Kai Engert a écrit : > My criticism: > > (a) > I don't like it that the amount of CRLs will be a subset of all CRLs. > What about all the revoked certificates that aren't included in the list? > > With a dynamic mechanism like OCSP (and in the future OC

Re: Google about to fix the CRL download mechanism in Chrome

2012-02-10 Thread Erwann Abalea
Le vendredi 10 février 2012 01:32:47 UTC+1, Ondrej Mikle a écrit : [...] > A quote from Lucky Green > (http://lists.randombit.net/pipermail/cryptography/2011-December/001918.html): > > > Most (but not all) of the CAs that I worked with over the years did not > > have anybody on the operations side

Re: Thunderbird encrypted mail using certificate (on smartcard) isnt able to C_Decrypt the message. Why?

2012-01-25 Thread Erwann Abalea
Le mardi 24 janvier 2012 16:29:05 UTC+1, helpcrypto helpcrypto a écrit : > Ok guys, just to let you know, now its working. (Again, this list > deserves my love) > > 2 things were happenning: > > 1-As Rob Relyea (thx) pointed me, i was doing something wrong: My > C_Decrypt function was returning 1

Re : Error when using AES_ECB_PAD

2011-09-05 Thread Erwann Abalea
Le lundi 5 septembre 2011 16:14:31 UTC+2, florent ainardi a écrit : > hi > i have this error when i try to use the algorythm CKM_AES_ECB_PAD > > => error : 'CKM_AES_ECB_PAD' undeclared ( first use in this function ) > > if i use CKM_AES_ECB it works !!! > > do you know if the AES_ECB_PAD is impl