[openssl.org #2029] Fix openssl dgst -dss1

2009-09-01 Thread Tomas Mraz via RT
In the openssl-1.0.0-beta3 the command openssl dgst -dss1 -verify fails with error: Error setting context 139832466196296:error:0A07806A:dsa routines:PKEY_DSA_CTRL:invalid digest type:dsa_pmeth.c:192: See https://bugzilla.redhat.com/show_bug.cgi?id=520152 for detailed test case. I've patched the

Re: Delivering two version of libcrypto - fips and non-fips

2009-09-01 Thread Mark Phalan
On Sat, 2009-08-29 at 17:34 -0400, Steve Marquess wrote: Mark Phalan wrote: ... Due to the way the FIPS Capable OpenSSL is built it ends up with older implementations of ciphers (all the ones that fipscanister.o implements). These cipher implementations are used regardless of being

Re: Delivering two version of libcrypto - fips and non-fips

2009-09-01 Thread Mark Phalan
On Sun, 2009-08-30 at 09:13 -0700, Kyle Hamilton wrote: You forgot: ./config fipscanisterbuild asm Appendix A of the Security Policy (v1.2) lists the allowed command sets. ./config fipscanisterbuild asm isn't one of them. The asm will be pulled in anyway as for solaris64-x86_64-gcc config

[openssl.org #2030] bug report: bn_rand function

2009-09-01 Thread Dipti via RT
Hi, I am using bn_rand function which is taking more than 10 seconds to execute. OS: Windows XP SP3 OS Locale: Swidish I am not able to reproduce issue on other machine. Can you please guide me on what can reason behind BN_Rand taking so long? Any help is appreciated. Thank you Have a nice

IPv6 compliance of certificate fields...

2009-09-01 Thread Vineet Kumar
Hi, I am using 0.9.7m and discovered that using a certificate having IPv6 addresses in subjectAltName did not work with my test server. Is there a patch I can apply to fix this? I notice that there are other certificate-related fields (enumerated below)hitting the same error. Thanks in advance,

Re: Delivering two version of libcrypto - fips and non-fips

2009-09-01 Thread Kyle Hamilton
It goes without saying that any changes you have to make to the FIPS module would be quite welcome if you passed them along upstream, along with any information about the Priesthood of the CMVP that you're dealing with which required the change, and why. Then again, I don't know if there's an NDA

[openssl.org #2027] [PATCH] OpenSSL 1.0.0b3

2009-09-01 Thread Stephen Henson via RT
[openssl-...@openssl.org - Mon Aug 31 17:04:13 2009]: Hi, we downloaded the latest version of OpenSSL (1.0.0b3) and noticed some problems writing an extension nameConstraints containing a RID value. Reading the code we noticed that a break was missing in line 468 of file v3_alt.c

[openssl.org #2027] Resolved: [PATCH] OpenSSL 1.0.0b3

2009-09-01 Thread Stephen Henson via RT
According to our records, your request has been resolved. If you have any further questions or concerns, please respond to this message. __ OpenSSL Project http://www.openssl.org Development Mailing

getting/setting challenge bits from Client Hello?

2009-09-01 Thread Rene Hollan
Hi, all. I have a need to retrieve the challenge bits from a Client Hello message I receive and set them in a Client Hello message I send. Why? I have an (intentional) MITM SSL proxy where two sessions (client-proxy and proxy-server) are set up so that traffic can be decrypted and examined

RE: getting/setting challenge bits from Client Hello?

2009-09-01 Thread Rene Hollan
I think I found the state callbacks and structure members I need. Sorry for the spam. From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On Behalf Of Rene Hollan Sent: Tuesday, September 01, 2009 2:59 PM To: openssl-dev@openssl.org Subject: getting/setting challenge