Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread John Gardiner Myers via RT
Stephen Henson via RT wrote: >One would be the perl front end CA.pl > Patch attached >Another would be if non-standard scripts initialize the serial number >file either for 'ca' or the 'x509' utility. > > My original patch fixed the -CAcreateserial switch. Not much we can do about scripts no

RSA SSL vs OpenSSL

2004-03-15 Thread Tao Shen
Can some one kindly shed some light on the comparison between the RSA SSL and OpenSSL? Things I am curious about in the order of importance are (I know one is free, the other is not): * Feature set; * Robustness/Vulnerabilities; * Performance; * Foot print (library size); * Robustness/Vulnerabiliti

Re: Regarding crypto/md32_common.h

2004-03-15 Thread Andy Polyakov
> There is a Metrowerks compiler for NetWare. It is actually a > cross-compiler that runs on a Win32 platform and then uses a different > linker to create the libraries. As near as I know, "__NETWARE__" is not > defined when compiling. But is there __rol intrinsic? Can you generate assembler listi

Re: Regarding crypto/md32_common.h

2004-03-15 Thread Verdon Walker
There is a Metrowerks compiler for NetWare. It is actually a cross-compiler that runs on a Win32 platform and then uses a different linker to create the libraries. As near as I know, "__NETWARE__" is not defined when compiling. Hence, we use the "OPENSSL_SYSNAME_NETWARE" that has been set up for us

[openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Stephen Henson via RT
[EMAIL PROTECTED] - Mon Mar 15 18:59:21 2004]: > Stephen Henson via RT wrote: > > > I'm not sure how portable that patch is as it stands. > > What would be the portability problem? The code is already calling > time() in order to calculate the expiration dates. > Oops, sorry. I thought that

Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread John Gardiner Myers via RT
Stephen Henson via RT wrote: > I'm not sure how portable that patch is as it stands. What would be the portability problem? The code is already calling time() in order to calculate the expiration dates. >As a portable alternative we could use a large random number for the >serial number, for

[openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Stephen Henson via RT
[EMAIL PROTECTED] - Mon Mar 15 16:27:44 2004]: > Is the problem that there isn't an atomic "get next serial#" function? > > Turning the serial# into a timestamp narrows the window, but doesn't > close > it, particularly on SMP machines. Using a big random number closes > it, > but will probably

Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Rich Salz via RT
Is the problem that there isn't an atomic "get next serial#" function? Turning the serial# into a timestamp narrows the window, but doesn't close it, particularly on SMP machines. Using a big random number closes it, but will probably inconvenience, confuse, etc., all those who assume the serial

Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Rich Salz
Is the problem that there isn't an atomic "get next serial#" function? Turning the serial# into a timestamp narrows the window, but doesn't close it, particularly on SMP machines. Using a big random number closes it, but will probably inconvenience, confuse, etc., all those who assume the serial#

[openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Stephen Henson via RT
[EMAIL PROTECTED] - Mon Mar 15 13:49:54 2004]: > In message <[EMAIL PROTECTED]> on Mon, 15 Mar > 2004 13:14:40 +0100 (MET), "Stephen Henson via RT" <[EMAIL PROTECTED]> > said: > > rt> I'd be interested to know how people are managing to create > duplicate > rt> serial numbers: that is what comma

Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Richard Levitte - VMS Whacker via RT
In message <[EMAIL PROTECTED]> on Mon, 15 Mar 2004 13:14:40 +0100 (MET), "Stephen Henson via RT" <[EMAIL PROTECTED]> said: rt> I'd be interested to know how people are managing to create duplicate rt> serial numbers: that is what commands and or scripts are being used to rt> do this. Easy: upgr

Re: [openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Richard Levitte - VMS Whacker
In message <[EMAIL PROTECTED]> on Mon, 15 Mar 2004 13:14:40 +0100 (MET), "Stephen Henson via RT" <[EMAIL PROTECTED]> said: rt> I'd be interested to know how people are managing to create duplicate rt> serial numbers: that is what commands and or scripts are being used to rt> do this. Easy: upgra

[openssl.org #842] [PATCH] Reduce probability of duplicate serial numbers

2004-03-15 Thread Stephen Henson via RT
[EMAIL PROTECTED] - Mon Mar 15 08:26:10 2004]: > The attached patch causes serial numbers to default to the current time, > significantly reducing the chance of duplicate serial numbers from a > given issuer. I have filed the necessary TSA notification. > > Mozilla gets a constant stream of p

Re: i2a_ASN1_OBJECT

2004-03-15 Thread Richard Levitte - VMS Whacker
In message <[EMAIL PROTECTED]> on Mon, 15 Mar 2004 03:03:54 -0800 (PST), "S.Mehdi Sheikhalishahi" <[EMAIL PROTECTED]> said: sm_justice> Hi Group sm_justice> I want to use i2a_ASN1_OBJECT function of openssl But sm_justice> when I want to compile my program it say sm_justice> sm_justice> /home/a

i2a_ASN1_OBJECT

2004-03-15 Thread S.Mehdi Sheikhalishahi
Hi Group I want to use i2a_ASN1_OBJECT function of openssl But when I want to compile my program it say /home/alishahi/src/PKI/X509/PKI_Certificate.cpp:291: undefined reference to `i2a_ASN1_OBJECT(bio_st *, asn1_object_st *)' collect2: ld returned 1 exit status that means openssl library have not