RE: [openssl.org #1204] bug report - 0.9.8 and bad record mac because of wrong SSL_OP_TLS_BLOCK_PADDING_BUG handling

2006-01-09 Thread [EMAIL PROTECTED] via RT
Hmm, I want to use this for an multi usable web service independent of apache and no restrictions (or so) for the users or user scenarios about openssl usage ... If the caller has an certificate generated by an not-restricted openssl using whatever he want to to ... how can I=web service

RE: [openssl.org #1204]: bad record mac because of wrong SSL_OP_TLS_BLOCK_PADDING_BUG handling

2006-01-09 Thread [EMAIL PROTECTED] via RT
I have found that there might be a different length computing in zlib V1.2.3 (or may be even in 1.2.2). In my opinion the length field set by zlib is ok. But openssl changes this length field in the SSL_OP_TLS_BLOCK_PADDING_BUG handling = ERROR (I traced the problem in openssl and zlib under

[openssl.org #1267]

2006-01-09 Thread via RT
__ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]

RE: Problems Identified in Static Source Analysis

2006-01-09 Thread David Hartman
Hi Andy, It turns out there was no easy way to give you the Coverity test results directly. For the runs to be useful, you really need a viewer, and we are limited by the licenses as to who can use the viewer. We have a copy of 0.9.8a in our source tree, and I made the changes to our copy of

RE: Contribution: doc/HOWTO/key-management.txt

2006-01-09 Thread David Holmes
Hey that's pretty neat. Question: Who is the target audience and what level of technical ability should they be assumed to have? If they are reading this list or looking through the openssl source code I would guess its higher than the one that appears to be targetted by this fine document.

Re: Contribution: doc/HOWTO/key-management.txt

2006-01-09 Thread Kyle Hamilton
This is aimed at the manager of a technical team, primarily, but also at people getting into the field of cryptography and its application via Apache. I tried to write it approximating the tone of Schneier's Applied Cryptography, but it probably came out sounding much more low-brow. There should

RE: Problems Identified in Static Source Analysis

2006-01-09 Thread Yair Elharrar
Hi David, To generate a static report from Coverity, run cov-format-errors. This command generates a set of HTML pages which contain all the issues found in the last run. Yair -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Hartman Sent: