[PHP-DEV] OpenSSL

2004-09-03 Thread Ron Korving
I have nothing to gain from this directly myself, but I did wonder about this: Why is the OpenSSL library used still version 0.9.6c from December 2001 while there have been many more releases since then, with the latest release being from March 2004? Maybe it's time to consider an upgrade? Ron -

[PHP-DEV] OpenSSL integration

2007-01-10 Thread Thomas J. Hruska
I want to access some of the more obscure OpenSSL functions (about 20) from PHP and would like to contribute what I need access to from OpenSSL in PHP back to the community. To that end, I've downloaded the source code for PHP 5.2.0 and started looking at the C source for the OpenSSL portion to h

[PHP-DEV] OpenSSL segfault

2004-08-09 Thread Ron Korving
Hi, I once read (can't remember where) that the OpenSSL segfault problem was a known issue? If not, I'll write a bugreport. In short: I use PHP5.0.0, and I experience a segfault (and if I remember correctly) at random times. I believe it worked most of the time, but regularly would segfault. If

Re: [PHP-DEV] OpenSSL

2004-09-03 Thread George Schlossnagle
PHP use the OpenSSL library on your system. Perhaps it's time for you to consider an upgrade. George On Sep 3, 2004, at 9:54 AM, Ron Korving wrote: I have nothing to gain from this directly myself, but I did wonder about this: Why is the OpenSSL library used still version 0.9.6c from December

Re: [PHP-DEV] OpenSSL

2004-09-03 Thread Zeev Suraski
Maybe he meant the Windows build..? Zeev At 17:27 03/09/2004, George Schlossnagle wrote: PHP use the OpenSSL library on your system. Perhaps it's time for you to consider an upgrade. George On Sep 3, 2004, at 9:54 AM, Ron Korving wrote: I have nothing to gain from this directly myself, but I did

Re: [PHP-DEV] OpenSSL

2004-09-04 Thread Ron Korving
Actually, I was talking about the Linux build, but I wasn't aware of it being used from the system. My mistake. Ron "Zeev Suraski" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > Maybe he meant the Windows build..? > > Zeev > > At 17:27 03/09/2004, George Schlossnagle wrote: > >PHP

[PHP-DEV] OpenSSL ECC Support

2016-03-30 Thread Niklas Keller
Hi, there's an open feature request with a patch since 2012, it's still against SVN: https://bugs.php.net/bug.php?id=61204 Could somebody go ahead, review and merge that patch? Thanks, Niklas

[PHP-DEV] OpenSSL Ini Options

2012-09-25 Thread Ralph Schindler
Hey all, An odd problem has cropped up that I think can be solved at the PHP level. Basically, on Ubuntu (and other distributions), using ssl stream context with verify_peer = true could potentially fail. This is due to the fact that OpenSSL, seemingly, only has a compile-time value for CAp

Re: [PHP-DEV] OpenSSL integration

2007-01-10 Thread Marcus Boerger
Hello Thomas, read all README.* files and the CODING_STANDARDS (php is very picky). For an introduction to writing extensions look here: http://talks.somabo.de There is also an artivel series from Sara Golemon somewhere on the Zend site and she also published a neat book on the topic. However PH

Re: [PHP-DEV] OpenSSL integration

2007-01-12 Thread Wez Furlong
Hi Thomas, I think Marcus gave you all the right pointers. I just wanted to let you know that I have a pending patch for DH kex and some bignum functions, and that Pierre mentioned that he's been working on a few other bits recently. If you think that we'll be overlapping, we can try harder to ei

Re: [PHP-DEV] OpenSSL integration

2007-01-12 Thread Pierre
Hi Thomas, Wez, On 1/13/07, Wez Furlong <[EMAIL PROTECTED]> wrote: Hi Thomas, I think Marcus gave you all the right pointers. I just wanted to let you know that I have a pending patch for DH kex and some bignum functions, and that Pierre mentioned that he's been working on a few other bits rece

Re: [PHP-DEV] OpenSSL integration

2007-01-12 Thread Thomas J. Hruska
Pierre wrote: Hi Thomas, Wez, On 1/13/07, Wez Furlong <[EMAIL PROTECTED]> wrote: Hi Thomas, I think Marcus gave you all the right pointers. I just wanted to let you know that I have a pending patch for DH kex and some bignum functions, and that Pierre mentioned that he's been working on a few

[PHP-DEV] openssl supported algorithms

2009-11-24 Thread Rob Richards
The openssl extension is way to restrictive in the algorithms it supports, i.e. no support for SHA265 which is starting to become the standard algo to use, etc.. Rather than having to always add more constants and additional logic for any new algorithms, I'd like to change the sign and verify f

[PHP-DEV] OpenSSL and Phar

2008-06-22 Thread Steph Fox
Hi Greg, all, It seems we don't use the openssl extension API at all in ext/phar, just the actual OpenSSL headers and libs. That means Phar with OpenSSL support can be both built and run without ext/openssl being built at all, but requires third-party libs (under Windows at least - ssleay32.d

[PHP-DEV] openssl extension maintainer?

2006-04-23 Thread Brandon Fosdick
Is the OpenSSL extension still being maintained? I'm looking at adding some needed functionality and don't know who to talk to about it. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-DEV] OpenSSL - New Defaults

2016-11-03 Thread Scott Arciszewski
Hi, Can we change openssl_public_encrypt() and openssl_private_decrypt() from defaulting to PKCS1v1.5 padding, in favor of defaulting to OAEP? I'll create an RFC for this later. It will just prevent a lot of issues. To wit: - https://framework.zend.com/security/advisory/ZF2015-10 - https://gith

Re: [PHP-DEV] OpenSSL ECC Support

2016-03-30 Thread Jakub Zelenka
There is a PR for that https://github.com/php/php-src/pull/1686 that should land in 7.1 if there are no objections... On Wed, Mar 30, 2016 at 6:46 PM, Niklas Keller wrote: > Hi, > > there's an open feature request with a patch since 2012, it's still against > SVN: https://bugs.php.net/bug.php?id

Re: [PHP-DEV] OpenSSL ECC Support

2016-03-30 Thread Niklas Keller
2016-03-30 21:04 GMT+02:00 Jakub Zelenka : > There is a PR for that https://github.com/php/php-src/pull/1686 that > should land in 7.1 if there are no objections... > > On Wed, Mar 30, 2016 at 6:46 PM, Niklas Keller wrote: > >> Hi, >> >> there's an open feature request with a patch since 2012, it

Re: [PHP-DEV] OpenSSL Ini Options

2012-09-25 Thread Pierre Joye
Hi Ralph, Btw, I added custom capath ini setting for curl already. It allows you to set it and use updated cert db as provided on curl site: http://www.php.net/manual/en/curl.configuration.php#ini.curl.cainfo Something similar could be possible for openssl. Can you open a feature request on bugs

[PHP-DEV] OpenSSL random pseudo bytes

2008-09-02 Thread Scott MacVicar
Hi All, Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte function, at the moment it will return FALSE if the bytes aren't considered cryptographically strong, I am however considering making this parameter controlled. Any objections to me applying this to 5.3? S

Re: [PHP-DEV] openssl supported algorithms

2009-11-24 Thread Rasmus Lerdorf
Seems like a no-brainer for 5.3 and trunk. You will have to discuss with Ilia for 5.2. It seems a bit late in the game for that branch to get this. -Rasmus Rob Richards wrote: > The openssl extension is way to restrictive in the algorithms it > supports, i.e. no support for SHA265 which is star

Re: [PHP-DEV] openssl supported algorithms

2009-11-24 Thread Rob Richards
If I had only checked... Appears its been in trunk (and 5_3) for over 2 years now :) Rob Rasmus Lerdorf wrote: Seems like a no-brainer for 5.3 and trunk. You will have to discuss with Ilia for 5.2. It seems a bit late in the game for that branch to get this. -Rasmus Rob Richards wrote:

Re: [PHP-DEV] openssl supported algorithms

2009-11-24 Thread Ilia Alshanetsky
Heh, I think given that we have 5.3 out there (with the code) there is little reason to introduce new features into a bug fix release which is 5.2. On 2009-11-24, at 4:51 PM, Rob Richards wrote: > If I had only checked... Appears its been in trunk (and 5_3) for over 2 years > now :) > > Rob >

Re: [PHP-DEV] OpenSSL and Phar

2008-06-22 Thread Martin Jansen
On Sun, Jun 22, 2008 at 10:32 PM, Steph Fox <[EMAIL PROTECTED]> wrote: > It seems we don't use the openssl extension API at all in ext/phar, just the > actual OpenSSL headers and libs. That means Phar with OpenSSL support can be > both built and run without ext/openssl being built at all, but requi

Re: [PHP-DEV] OpenSSL and Phar

2008-06-22 Thread Pierre Joye
On Sun, Jun 22, 2008 at 10:32 PM, Steph Fox <[EMAIL PROTECTED]> wrote: > It seems we don't use the openssl extension API at all in ext/phar, just the > actual OpenSSL headers and libs. That means Phar with OpenSSL support can be > both built and run without ext/openssl being built at all, but requ

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
Hi Pierre, --with-openssl is used by ext/openssl and will continue to be used like it is now (I'm thinking of adding --with-openssl-dir for consistency but that's all). This has absolutely no bearing on my question. Perhaps I expressed myself badly. - Steph -- PHP Internals - PHP Runti

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
Hi Martin, Would --with-openssl imply --enable-phar-ssl then? Sounds like a good idea to me. It certainly could... but what about distro builds? - Steph -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
Hi Pierre, OK, I got back to the rest of your email now (caffeine always helps, eh). I'm not sure it makes sense to have the ssl optional features enabled but not ext/openssl. Or to say it better, I don't see the gain. What is the gain besides being able to say: "heh you can use the ssl featur

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Pierre Joye
On Mon, Jun 23, 2008 at 1:28 PM, Steph Fox <[EMAIL PROTECTED]> wrote: > You're missing that Windows users don't tend to roll their own PHP. They > tend to pick and choose their extensions. I still miss your point here, I was only talking about bins releases for windows. > At present, if someone

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
Hey Pierre, --enable-phar-ssl and do (not tested but it gives the idea): if (PHP_PHAR_SSL == "yes") { ADD_EXTENSION_DEP("phar", "openssl", true); } else { Erm... no, you've definitely missed the point. ADD_EXTENSION_DEP() only works in one of the four possible scenarios, and that one

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Pierre Joye
Hi, On Mon, Jun 23, 2008 at 4:38 PM, Steph Fox <[EMAIL PROTECTED]> wrote: > We can sign and verify OpenSSL signatures without ext/openssl if we have the > library dependency. In other words, this (with the module checks in util.c > commented out) works fine: I finally took a look at why phar is

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
Pierre, I finally took a look at why phar is not built shared as all other extension. It seems to force it only to be able to be run with no dep but still uses them if they are lately added (given that phar is now built statically, that makes little sense). But in fact, it does have deps agains

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Pierre Joye
On Mon, Jun 23, 2008 at 5:44 PM, Steph Fox <[EMAIL PROTECTED]> wrote: >> My main question now is why don't you actually reflect the (optional) >> dependencies? bz2 and zlib compression available will not be available >> if bz2 or zlib is not present, same for openssl. > > What do you mean? In conf

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Steph Fox
if (!PHAR_G(has_zlib)) ... Pierre, you'd still need to test for them at runtime whether they were listed as a soft dependency or not! - Steph -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Pierre Joye
On Mon, Jun 23, 2008 at 7:21 PM, Steph Fox <[EMAIL PROTECTED]> wrote: > >> if (!PHAR_G(has_zlib)) ... > > Pierre, you'd still need to test for them at runtime whether they were > listed as a soft dependency or not! No, not if they are not soft dependencies, this is what is done in 99% of the php e

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Greg Beaver
Steph Fox wrote: Hi Pierre, OK, I got back to the rest of your email now (caffeine always helps, eh). I'm not sure it makes sense to have the ssl optional features enabled but not ext/openssl. Or to say it better, I don't see the gain. What is the gain besides being able to say: "heh you can

Re: [PHP-DEV] OpenSSL and Phar

2008-06-23 Thread Greg Beaver
Pierre Joye wrote: As testing has_xxx at runtime looks shiny and powerful, I don't think it is worth the pain. What pain? Greg -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] OpenSSL and Phar

2008-06-24 Thread Steph Fox
Hi Greg, I must be going crazy. Is there an actual problem that needs solving? Yep, solved yesterday. You're saying that a user who improperly installs php_openssl.dll (i.e. does not follow instructions and set up ssleay.dll and libeay.dll) should magically be able to use phar with openss

Re: [PHP-DEV] OpenSSL and Phar

2008-06-24 Thread Pierre Joye
On Tue, Jun 24, 2008 at 2:46 AM, Greg Beaver <[EMAIL PROTECTED]> wrote: > I must be going crazy. Is there an actual problem that needs solving? > You're saying that a user who improperly installs php_openssl.dll (i.e. > does not follow instructions and set up ssleay.dll and libeay.dll) should >

Re: [PHP-DEV] OpenSSL and Phar

2008-06-24 Thread Steph Fox
Pierre, I must be going crazy. Is there an actual problem that needs solving? You're saying that a user who improperly installs php_openssl.dll (i.e. does not follow instructions and set up ssleay.dll and libeay.dll) should magically be able to use phar with openssl? Why? You are not going

Re: [PHP-DEV] OpenSSL and Phar

2008-06-24 Thread Pierre Joye
Hi, Please top to make easy problems an endless pain please. And stop to mix every topics you can think about in every single discussions. Also it would be nice if you get cooler and stop to harass me on every single reply or commit, get a life, do something, whatever helps but stop to harass me.

Re: [PHP-DEV] openssl extension maintainer?

2006-04-23 Thread Hannes Magnusson
Hi Brandon On 4/23/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: > Is the OpenSSL extension still being maintained? I'm looking at adding some > needed functionality and don't know who to talk to about it. > php-src/EXTENSIONS: EXTENSION: openssl PRIMARY MAINTAINER: Wez Furlong <[EMAI

Re: [PHP-DEV] openssl extension maintainer?

2006-04-23 Thread Brandon Fosdick
Hannes Magnusson wrote: Hi Brandon On 4/23/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: Is the OpenSSL extension still being maintained? I'm looking at adding some needed functionality and don't know who to talk to about it. php-src/EXTENSIONS: EXTENSION: openssl PRIMARY MAINTAIN

Re: [PHP-DEV] openssl extension maintainer?

2006-04-23 Thread Wez Furlong
You can reach me at this email address too. --Wez. On 4/23/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: > Hannes Magnusson wrote: > > Hi Brandon > > > > On 4/23/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: > >> Is the OpenSSL extension still being maintained? I'm looking at adding > >> some

Re: [PHP-DEV] openssl extension maintainer?

2006-04-24 Thread Brandon Fosdick
Wez Furlong wrote: You can reach me at this email address too. Which address do you prefer? I need the PKCS12 functions and the ability to extract public keys, so I was thinking I'd add both, but I don't want to step on anybody's toes. I've never played around in the PHP internals before so

Re: [PHP-DEV] openssl extension maintainer?

2006-04-24 Thread Wez Furlong
On 4/24/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: > Wez Furlong wrote: > > You can reach me at this email address too. > > Which address do you prefer? This one for PHP stuff. > I need the PKCS12 functions > and the ability to extract public keys Like this: http://us2.php.net/manual/en/func

Re: [PHP-DEV] openssl extension maintainer?

2006-04-25 Thread Brandon Fosdick
Wez Furlong wrote: Like this: http://us2.php.net/manual/en/function.openssl-pkey-get-public.php or something else? Close, but I need them in PEM format. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] openssl extension maintainer?

2006-04-26 Thread Wez Furlong
Ah yes. http://us3.php.net/manual/en/function.openssl-pkey-export.php almost does what you want... but only works on private keys. I'd welcome a patch for that too. --Wez. On 4/25/06, Brandon Fosdick <[EMAIL PROTECTED]> wrote: > Wez Furlong wrote: > > Like this: > > http://us2.php.net/manual/en/

Re: [PHP-DEV] openssl extension maintainer?

2006-04-26 Thread Brandon Fosdick
Wez Furlong wrote: Ah yes. http://us3.php.net/manual/en/function.openssl-pkey-export.php almost does what you want... but only works on private keys. I'd welcome a patch for that too. Do you want separate patches for PKCS12 and PEM keys or should it be all one patch? Has anything changed tha

Re: [PHP-DEV] openssl extension maintainer?

2006-04-27 Thread Wez Furlong
Just one patch will be fine. We usually accept patches for new features against HEAD of CVS only, but with the unicode development effort that is ongoing in HEAD, you might find it a little bit harder to do that. My suggestion is to make the patch for 5.1.2 and make sure it all works first, and th

[PHP-DEV] OpenSSL 3.0 Alpha1 released

2020-05-12 Thread Christoph M. Becker
Hi all, a few weeks ago OpenSSL 3.0 Alpha1 has been released[1]. It seems to me that we should check what needs to be adapted in php-src to support OpenSSL 3.0 as soon as possible. Even if OpenSSL 3.0 will not be ready by the time PHP 8.0.0 will be released, any potentially required BC breaks fr

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-06 Thread Jakub Zelenka
Hi, On Thu, Nov 3, 2016 at 4:11 PM, Scott Arciszewski wrote: > Hi, > > Can we change openssl_public_encrypt() and openssl_private_decrypt() from > defaulting to PKCS1v1.5 padding, in favor of defaulting to OAEP? > > I'll create an RFC for this later. It will just prevent a lot of issues. > > To

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-06 Thread Niklas Keller
2016-11-06 20:19 GMT+01:00 Jakub Zelenka : > Hi, > > On Thu, Nov 3, 2016 at 4:11 PM, Scott Arciszewski > wrote: > > > Hi, > > > > Can we change openssl_public_encrypt() and openssl_private_decrypt() from > > defaulting to PKCS1v1.5 padding, in favor of defaulting to OAEP? > > > > I'll create an R

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-06 Thread Scott Arciszewski
On Sun, Nov 6, 2016 at 2:19 PM, Jakub Zelenka wrote: > Hi, > > On Thu, Nov 3, 2016 at 4:11 PM, Scott Arciszewski > wrote: >> >> Hi, >> >> Can we change openssl_public_encrypt() and openssl_private_decrypt() from >> defaulting to PKCS1v1.5 padding, in favor of defaulting to OAEP? >> >> I'll create

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-07 Thread Nikita Nefedov
> On 7 Nov 2016, at 03:35, Scott Arciszewski wrote: > >> On Sun, Nov 6, 2016 at 2:19 PM, Jakub Zelenka wrote: >> Hi, >> >> On Thu, Nov 3, 2016 at 4:11 PM, Scott Arciszewski >> wrote: >>> >>> Hi, >>> >>> Can we change openssl_public_encrypt() and openssl_private_decrypt() from >>> defaultin

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-07 Thread Alice Wonder
On 11/07/2016 04:29 AM, Nikita Nefedov wrote: *snip* Hey, It might make even more sense to not provide a default here at all. As history shows that those methods that are considered secure today can become less-than-desirably secure in a couple of years. Which means the same cycle of depr

Re: [PHP-DEV] OpenSSL - New Defaults

2016-11-07 Thread Fleshgrinder
On 11/7/2016 3:41 PM, Alice Wonder wrote: > On 11/07/2016 04:29 AM, Nikita Nefedov wrote: >> It might make even more sense to not provide a default here at all. As >> history shows that those methods that are considered secure today can >> become less-than-desirably secure in a couple of years. Whi

[PHP-DEV] OpenSSL 1.1 test keys

2017-03-22 Thread Anatol Belski
Hi Jakub, While working on the OpenSSL 1.1 integration, I've stumbled over this issue with the sni server test ext/openssl/tests/sni_server.phpt which fails with error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed I debugged through it and in the end it turns o

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-02 Thread David Coallier
2008/9/2 Scott MacVicar <[EMAIL PROTECTED]>: > Hi All, > > Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte > function, at the moment it will return FALSE if the bytes aren't considered > cryptographically strong, I am however considering making this parameter > controlled

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-02 Thread Scott MacVicar
On 3 Sep 2008, at 03:33, David Coallier wrote: 2008/9/2 Scott MacVicar <[EMAIL PROTECTED]>: Hi All, Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte function, at the moment it will return FALSE if the bytes aren't considered cryptographically strong, I am however

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-02 Thread David Coallier
> > This function has been in OpenSSL for 8 years and supported by every version > since 0.9.5. It's literally just exposing the API, it's safe for inclusion > in 5.3 in my opinion. > I didn't express myself very clearly. What I meant is that we should probably add that switch for the return right

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-03 Thread Lukas Kahwe Smith
On 03.09.2008, at 03:08, Scott MacVicar wrote: Hi All, Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte function, at the moment it will return FALSE if the bytes aren't considered cryptographically strong, I am however considering making this parameter controlle

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-03 Thread Pierre Joye
hi Scott, On Wed, Sep 3, 2008 at 3:08 AM, Scott MacVicar <[EMAIL PROTECTED]> wrote: > Hi All, > > Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte > function, at the moment it will return FALSE if the bytes aren't considered > cryptographically strong, I am however consid

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-25 Thread Cristian Rodríguez
Scott MacVicar escribió: > Hi All, > > Attached and uploaded [1] is a patch to add the OpenSSL random pseudo > byte function, at the moment it will return FALSE if the bytes aren't > considered cryptographically strong, I am however considering making > this parameter controlled. > > Any objectio

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-25 Thread Scott MacVicar
On 25 Sep 2008, at 22:59, Cristian Rodríguez <[EMAIL PROTECTED]> wrote: Scott MacVicar escribió: Hi All, Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte function, at the moment it will return FALSE if the bytes aren't considered cryptographically strong, I am ho

Re: [PHP-DEV] OpenSSL random pseudo bytes

2008-09-25 Thread Cristian Rodríguez
Scott MacVicar escribió: > If you don't care don't pass a parameter. ohh.. right, I misinterpreted it .. sorry ;) -- "A computer is like an Old Testament god, with a lot of rules and no mercy. " Cristian Rodríguez R. Platform/OpenSUSE - Core Services SUSE LINUX Products GmbH Research & Deve

[PHP-DEV] OpenSSL bug in 5.4.33 and 5.5.17

2014-09-19 Thread Daniel Lowrey
Hi folks! I know this isn't the kind of fun stuff people want to deal with on Friday but ... In an effort to fix a very old (seven years old) DoS vulnerability involving encrypted streams I created a regression where feof() notifications on encrypted sockets are broken. This is present in both th

[PHP-DEV] [OpenSSL] Support for ECC public key generation

2016-06-14 Thread Dominic Luechinger
This is a short introduction of a feature I've been working on. Summary --- The current OpenSSL extension only supports generating RSA key pairs. The PR [1] adds support for ECC (Elliptic curve cryptography) key generation. The corresponding bug is 61204 [2]. --- Motivation -- Why

Re: [PHP-DEV] OpenSSL bug in 5.4.33 and 5.5.17

2014-09-19 Thread Remi Collet
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Le 19/09/2014 17:30, Daniel Lowrey a écrit : > In an effort to fix a very old (seven years old) DoS vulnerability > involving encrypted streams I created a regression where feof() > notifications on encrypted sockets are broken. This is present in >

[PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-01-31 Thread Leigh
Hi list, A couple of bug reports have highlighted the fact that our openssl_encrypt and openssl_decrupt functions have no way of getting or setting tags required for authenticated cipher modes (i.e. GCM, CCM, OCB (not sure if this is available in OpenSSL)). https://bugs.php.net/bug.php?id=68962 h

[PHP-DEV] OpenSSL min and max proto version options

2018-06-22 Thread Jakub Zelenka
Hi, I just created a PR [1] to add two new options for ssl/tls streams: - min_proto_version - max_proto_version that can be set to one of the new constants: - STREAM_CRYPTO_PROTO_SSLv3 - STREAM_CRYPTO_PROTO_TLSv1_0 - STREAM_CRYPTO_PROTO_TLSv1_1 - STREAM_CRYPTO_PROTO_TLSv1_2 It is basically a ran

[PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-03-20 Thread Jakub Zelenka
Hi, I just wanted to send a quick update about my recent work on openssl ext in case someone else wanted to start something similar so we don't have a wasted effort on that. :) 1. Error queueing I'm more or less done with a patch for error storing and clearing OpenSSL error queue: https://githu

Re: [PHP-DEV] [OpenSSL] Support for ECC public key generation

2016-06-14 Thread Scott Arciszewski
On Tue, Jun 14, 2016 at 8:04 PM, Dominic Luechinger wrote: > This is a short introduction of a feature I've been working on. > > Summary > --- > The current OpenSSL extension only supports generating RSA key pairs. > The PR [1] adds support for ECC (Elliptic curve cryptography) key > generati

Re: [PHP-DEV] [OpenSSL] Support for ECC public key generation

2016-06-16 Thread Dominic Luechinger
On 15/06/16 03:51, Scott Arciszewski wrote: > While we're at it, can we also add a function to generate (ephemeral) > Elliptic Curve Diffie-Hellman keys, and then use openssl_dh_compute_key() > with ECDH keys? Because that would be a lot saner than having to > shell_exec() to the OpenSSL binary in

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-01-31 Thread Jason Gerfen
On Sat, Jan 31, 2015 at 8:53 AM, Leigh wrote: > Hi list, > > A couple of bug reports have highlighted the fact that our > openssl_encrypt and openssl_decrupt functions have no way of getting > or setting tags required for authenticated cipher modes (i.e. GCM, > CCM, OCB (not sure if this is avail

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-01-31 Thread Leigh
On 31 January 2015 at 16:13, Jason Gerfen wrote: > On Sat, Jan 31, 2015 at 8:53 AM, Leigh wrote: >> At the very basic end of the spectrum, we could have openssl_get_tag >> and openssl_set_tag, or add an extra parameter to the end of >> openssl_encrypt and openssl_decrypt (pass by ref for encrypt,

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-01 Thread Jakub Zelenka
Hey On Sat, Jan 31, 2015 at 4:21 PM, Leigh wrote: > On 31 January 2015 at 16:13, Jason Gerfen wrote: > > On Sat, Jan 31, 2015 at 8:53 AM, Leigh wrote: > >> At the very basic end of the spectrum, we could have openssl_get_tag > >> and openssl_set_tag, or add an extra parameter to the end of > >

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-02 Thread Leigh
On 1 February 2015 at 17:57, Jakub Zelenka wrote: > Hey, > > I have already implemented all of this in crypto ext ( > https://github.com/bukka/php-crypto ) and also added support for streams > (e.g. > https://github.com/bukka/php-crypto/blob/master/tests/stream_filters_cipher_gcm_dec_read.phpt > )

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-02 Thread Leigh
On 2 February 2015 at 10:57, Leigh wrote: > length (not sure how of Not sure how often tag lengths aside from 16 are used. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-02 Thread Jason Gerfen
On Mon, Feb 2, 2015 at 3:58 AM, Leigh wrote: > On 2 February 2015 at 10:57, Leigh wrote: > > length (not sure how of > > Not sure how often tag lengths aside from 16 are used. > ​ According to documentation provided about the OCB mode of AES it says the following: Section 3: The scheme > The

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-02 Thread Leigh
On 2 February 2015 at 11:46, Jason Gerfen wrote: > According to documentation provided about the OCB mode of AES it says the > following: > > Section 3: The scheme >> >> The tag length is an integer τ ∈ [0 .. n]. ... As for the tag length, a >> suggested default of τ = 64 is reasonable. Tags of 32

Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.

2015-02-02 Thread Jakub Zelenka
On Mon, Feb 2, 2015 at 12:03 PM, Leigh wrote: > > In Rogaway's own OCB FAQ it states: > > The number τ, the tag length of the scheme, is, like the blockcipher > E, a parameter of the mode. It’s a number 0 ≤ τ ≤ 128. > > http://web.cs.ucdavis.edu/~rogaway/ocb/ocb-faq.htm > The OCB is just in open

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-03-20 Thread David Zuelke
On 20.03.2016, at 20:50, Jakub Zelenka wrote: > > Hi, > > I just wanted to send a quick update about my recent work on openssl ext in > case someone else wanted to start something similar so we don't have a > wasted effort on that. :) > > 1. Error queueing > > I'm more or less done with a patc

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-03-20 Thread Niklas Keller
> > > I have got a port of the extension to work on OpenSSL 1.1. There has been > > quite a bit of changes mainly due to the fact that most structures are > now > > opaque (but also some other changes) > > I assume 1.0.whatever-is-in-ubuntu will remain usable? Or do we plan on > requiring 1.1 in, s

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-03-21 Thread Jakub Zelenka
Hi David On Sun, Mar 20, 2016 at 9:08 PM, David Zuelke wrote: > On 20.03.2016, at 20:50, Jakub Zelenka wrote: > > > > Hi, > > > > I just wanted to send a quick update about my recent work on openssl ext > in > > case someone else wanted to start something similar so we don't have a > > wasted e

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-10-11 Thread Remi Collet
Le 20/03/2016 à 20:50, Jakub Zelenka a écrit : > Hi, > > I just wanted to send a quick update about my recent work on openssl ext in Can you please update the state of openssl 1.1.0 compatibility ? I see most work done in master ? Not in 7.0 or 7.1 ? Remi. P.S. openssl 1.1.0b just hit Fedor

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-10-11 Thread Remi Collet
Le 11/10/2016 à 12:56, Remi Collet a écrit : > Le 20/03/2016 à 20:50, Jakub Zelenka a écrit : >> Hi, >> >> I just wanted to send a quick update about my recent work on openssl ext in > > Can you please update the state of openssl 1.1.0 compatibility ? > > I see most work done in master ? > Not in

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-10-11 Thread Davey Shafik
Remi, I'm glad this was followed up on, it is likely the source of a reported issue! 7.1 no longer supports LibreSSL due to the usage of some new openssl changes, you can find the errors http://awel.domblogger. net/7/php7/ssl_error.txt and a patch by the reporter here: http://awel.domblogger.net/

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-10-11 Thread Jakub Zelenka
On 11 Oct 2016 11:57, "Remi Collet" wrote: > > Le 20/03/2016 à 20:50, Jakub Zelenka a écrit : > > Hi, > > > > I just wanted to send a quick update about my recent work on openssl ext in > > Can you please update the state of openssl 1.1.0 compatibility ? > > I see most work done in master ? > Not

Re: [PHP-DEV] OpenSSL ext status including port to OpenSSL 1.1

2016-10-23 Thread Jakub Zelenka
Hey On Tue, Oct 11, 2016 at 6:01 PM, Davey Shafik wrote: > > 7.1 no longer supports LibreSSL due to the usage of some new openssl > changes, you can find the errors http://awel.domblogger. > net/7/php7/ssl_error.txt and a patch by the reporter here: > http://awel.domblogger.net/7/php7/php-7.1.0RC