Re: TLS 1.2 support

2011-05-13 Thread Steve Marquess
On 05/13/2011 02:21 PM, John Foley wrote: > It looks like TLS 1.2 is being implemented in recent commits. Is there > an anticipated completion date for when v1.2 will be fully implemented? TLS 1.2 is being implemented in two stages. The first phase will be completed in a few weeks. The schedule

Re: [openssl.org #2466] [PATCH] Fix obscure linkage issue on Linux X86_64

2011-05-13 Thread Rob Austein via RT
I've now tested both Francis Dupont's original patch and Jung-uk Kim's replacement. Both patches work for my test case (make test with the rpki.net Python code), both on FreeBSD 8.2-STABLE (with gcc 4.6 and binutils from ports, to get new enough tools to show the problem with the unpatched code) a

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread The Doctor
On Fri, May 13, 2011 at 12:24:25PM -0400, Steve Marquess wrote: > > What is happening? > > > > No Fips in the Openssl 1.0.1 STABLe. > > > > > > Correct, and you won't be seeing the "FIPS capable" support there for > some time. We're concentrating on the validation of the module (OpenSSL > FIPS Ob

TLS 1.2 support

2011-05-13 Thread John Foley
It looks like TLS 1.2 is being implemented in recent commits. Is there an anticipated completion date for when v1.2 will be fully implemented? __ OpenSSL Project http://www.openssl.org Development M

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread Dr. Stephen Henson
On Fri, May 13, 2011, The Doctor wrote: > What is happening? > > No Fips in the Openssl 1.0.1 STABLe. > It never was in 1.0.1-stable. A bug with the snapshot generation meant that HEAD was incorrectly being tared as 1.0.1 in shapshots in fact it was tared as 1.0.0 and 0.9.8 too. That is fixed n

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread Steve Marquess
> OK, I'm still a bit confused on the version labeling. Is it safe to > assume the next stable label pulled off HEAD (e.g. 1.0.2) will include > support for "make -f Makefile.fips dist". Or to put the question > another way, what stable label should be used to generate the FIPS > Object Model 2.0

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread John Foley
OK, I'm still a bit confused on the version labeling. Is it safe to assume the next stable label pulled off HEAD (e.g. 1.0.2) will include support for "make -f Makefile.fips dist". Or to put the question another way, what stable label should be used to generate the FIPS Object Model 2.0 source co

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread Steve Marquess
> Steve, > > It looks like the FIPS 2.0 code has been going into HEAD. When do you > plan to pull a branch for the FIPS Object Model 2.0? We don't. The source tarball for the eventual validated module will be generated with "make -f Makefile.fips dist" which extracts the relevant subset of code.

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread John Foley
Steve, It looks like the FIPS 2.0 code has been going into HEAD. When do you plan to pull a branch for the FIPS Object Model 2.0? On 05/13/2011 12:24 PM, Steve Marquess wrote: > > What is happening? > > > > > > No Fips in the Openssl 1.0.1 STABLe. > > > > > > > > Correct, and you won't be seei

Re: openssl 1.0.1 and FIPS

2011-05-13 Thread Steve Marquess
> What is happening? > > No Fips in the Openssl 1.0.1 STABLe. > > Correct, and you won't be seeing the "FIPS capable" support there for some time. We're concentrating on the validation of the module (OpenSSL FIPS Object Module 2.0) now. -Steve M. -- Steve Marquess OpenSSL Software Foundation,

openssl 1.0.1 and FIPS

2011-05-13 Thread The Doctor
What is happening? No Fips in the Openssl 1.0.1 STABLe. -- Member - Liberal International This is doc...@nl2k.ab.ca Ici doc...@nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Stop Steph

Re: Unix CAC certificate based authentication

2011-05-13 Thread Douglas E. Engert
On 5/11/2011 4:08 PM, Technical Support wrote: Steve One of our Army clients (USAMITC) is asking if we know of any Unix based SSH client and or server which will support CAC certificate based authentication other then Tectia. Are you aware of any? Have a look at the OpenSC page. http://www.

[openssl.org #2515] patch - add new aes xts modes to lookup table

2011-05-13 Thread Alex Hornung via RT
Attached is a file against today's CVS that adds the new AES XTS modes to the lookup table (OpenSSL_add_all_ciphers). Regards, Alex Hornung Index: crypto/evp/c_allc.c === RCS file: /v/openssl/cvs/openssl/crypto/evp/c_allc.c,v retriev