Re: [OpenCA-Devel] Getting RedHat 9 to build better

2004-01-15 Thread Rob Thorne
Michael, I think the enclosed patch takes care of your concerns. This version makes openssl_prefix prevail over pkg_config where there are differences. Other changes in this version: * I've updated to CVS as of a few minutes ago. * I've made pkg_config test both for OpenSSL and also for

Re: [OpenCA-Devel] security issue in crypto-utils.lib

2004-01-15 Thread Alexandru Matei
Michael Bell wrote: Alexandru Matei wrote: I already tested with the line if( $tmpCert->getTXT() ne $sigCert->getTXT() ) but also the form with ->getPEM() should work ok Do you really mean "ne"!? I hope that you mean "eq". Sure, eq. Sorry for incorrect copy&paste Alex Michael ---

Re: [OpenCA-Devel] security issue in crypto-utils.lib

2004-01-15 Thread Michael Bell
Alexandru Matei wrote: I already tested with the line if( $tmpCert->getTXT() ne $sigCert->getTXT() ) but also the form with ->getPEM() should work ok Do you really mean "ne"!? I hope that you mean "eq". Michael -- --- Michael Bell

Re: [OpenCA-Devel] security issue in crypto-utils.lib

2004-01-15 Thread Michael Bell
Alexandru Matei wrote: Sorry to ask, but i'm a bit lazy now. It seems to me that in crypto-utils.lib, the function loops through the certificates-chain contained in the signature. Nobody can prevent me to send an valid certificate-chain from another CA. Is the first issuer (the CA cert ) ver

Re: [OpenCA-Devel] security issue in crypto-utils.lib

2004-01-15 Thread Alexandru Matei
Michael Bell wrote: Alexandru Matei wrote: Hi all, I just watch in crypto-utils.lib and I noticed that the actual verification function (sub libCheckSignature ) only checks these: 1/ if you get an valid signature object 2/get signer certificate according to serial of the certificate 3/loop t

Re: [OpenCA-Devel] security issue in crypto-utils.lib

2004-01-15 Thread Alexandru Matei
I already tested with the line if( $tmpCert->getTXT() ne $sigCert->getTXT() ) but also the form with ->getPEM() should work ok Alex Michael Bell wrote: Alexandru Matei wrote: Hi all, I just watch in crypto-utils.lib and I noticed that the actual verification function (sub libCheckSignature )