[openssl.org #2456] EV API only supports CBC mode, please enhance to support *_ctr()

2011-02-23 Thread Micah Anderson via RT
Until other cipher modes are supported by OpenSSL's EV , Ruby's cipher mode support is limited to the weakened CBC cipher modes (see http://redmine.ruby-lang.org/issues/show/4408). Having only CBC mode available leads to an attack that can recover up to 32bits of plaintext from an arbitrary

[openssl.org #2456] EV API only supports CBC mode, please enhance to support *_ctr()

2011-02-23 Thread Stephen Henson via RT
[mi...@riseup.net - Wed Feb 23 11:16:46 2011]: Until other cipher modes are supported by OpenSSL's EV , Ruby's cipher mode support is limited to the weakened CBC cipher modes (see http://redmine.ruby-lang.org/issues/show/4408). Having only CBC mode available leads to an attack that can

Re: DTLS and FIPS

2011-02-23 Thread Dr. Stephen Henson
On Tue, Feb 22, 2011, Nilesh Vaghela wrote: Hi, I have asked this question in earlier post also and I would repeat. can I know that DTLS in 1.0.1 supports FIPS ? If not, do we have plans to support FIPS in future and if possible timeframe ? We are working with one custmomer who

help:how do uninstall the openssl from the source?

2011-02-23 Thread guoji Ma
dear sir: I install the openssl from the source with the default configure, but I don't uninstall it by the command make uninstall; how do I do it? thanks

[openssl.org #2457] [PATCH] DTLS Reassembly Bitmask

2011-02-23 Thread Robin Seggelmann via RT
With patch #2230 a DTLS reassembly bitmask array should have been changed. Unfortunately this change was lost, so there is still a bug. Fragmented messages with lengths of multiples of 8 may not be handled correctly, because the highest byte of the bitmask will be compared to 0x00 instead of

[openssl.org #2458] [PATCH] DTLS state changed while listening may cause infinite loop

2011-02-23 Thread Robin Seggelmann via RT
While listening for incoming connections, DTLS should answer every ClientHello with a HelloVerifyRequest without changing its state. However, this is not the case since the handshake sequence numbers are still incremented with every incoming message. After receiving an initial ClientHello (seq

[openssl.org #2459] ecdsa_method declaration prevents use in implementing a dynamic engine

2011-02-23 Thread Kent Yoder via RT
Hi, It appears that the way ECDSA_METHOD was defined prevents it from being used unless the internal header ecs_locl.h is included. This prevents it from being used for example to implement a stand-alone dynamic engine for ECDSA, since the internal header is not available. If possible i

RE: [openssl.org #2449] [BUG] openssl 1.0.0d warnings during build and ACCVIO on OpenVMS

2011-02-23 Thread Green, Paul
Steven M. Schweda wrote: What seems (to me) to be needed in these cases is some macro or typedef which is an integer whose size is reliably the same as that of a pointer, which size_t is not. Hi Steve, Please take a look at your copy of stdint.h. See if you have a definition for the

Re: [openssl.org #2459] ecdsa_method declaration prevents use in implementing a dynamic engine

2011-02-23 Thread Douglas E. Engert
On 2/23/2011 12:31 PM, Kent Yoder via RT wrote: Hi, It appears that the way ECDSA_METHOD was defined prevents it from being used unless the internal header ecs_locl.h is included. This prevents it from being used for example to implement a stand-alone dynamic engine for ECDSA, since the

Re: [openssl.org #2449] [BUG] openssl 1.0.0d warnings during build and ACCVIO on OpenVMS

2011-02-23 Thread Steven M. Schweda
From: Green, Paul paul.gr...@stratus.com What seems (to me) to be needed in these cases is some macro or typedef which is an integer whose size is reliably the same as that of a pointer, which size_t is not. =20 Hi Steve, Please take a look at your copy of stdint.h. See if you have a

Re: [openssl.org #2449] [BUG] openssl 1.0.0d warnings during build and ACCVIO on OpenVMS

2011-02-23 Thread Steven M. Schweda
From: Steven M. Schweda sms@antinode-info On a different point, a closer look at the 64-bit-pointer test results shows a problem on Alpha (but not on IA64) somewhere in the CMS = PKCS#7 compatibility test sequence. Perhaps some file I/O thing? The perl script doesn't seem to handle an