Re: [openssl.org #3236] support for DNSSEC in openssl

2014-01-13 Thread Daniel Kahn Gillmor
On 01/13/2014 11:26 AM, Elmar Stellnberger via RT wrote: > Webkit browsers and many other openssl based programs like ssh would already > like to make use of DNSSEC. AFAIK DNSSEC has already been standardized and > would therefore be free to be implemented by openssl. DNSSEC could overcome > ma

Re: [PATCH] Makefile.org: enclose CC parameter passing in quotes

2014-01-13 Thread Gustavo Zacarias
On 01/13/2014 03:54 PM, Quanah Gibson-Mount wrote: > Duplicate of [openssl.org #3232] [PATCH] Makefile.org: Fix usage of > CC=gcc -m32 I've seen this in the mailing list archives only now. Any idea why my mail to rt@ with this patch last week didn't get through? It's a bit frustrating to see dup

Re: [PATCH] Makefile.org: enclose CC parameter passing in quotes

2014-01-13 Thread Quanah Gibson-Mount
--On Monday, January 13, 2014 3:41 PM -0300 Gustavo Zacarias wrote: The compiler invocation might contain a space for example when using ccache. Duplicate of [openssl.org #3232] [PATCH] Makefile.org: Fix usage of CC=gcc -m32 --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, In

Re: [openssl.org #3231] default ciphers include insecure export cipher suites

2014-01-13 Thread Jeff Hodges via RT
Adding !LOW:!EXPORT to the DEFAULT setting does seem wise. What would be the rationale to keep IDEA cipher suites in there? I'm not familiar enough with the SEED cipher suites problems. Is it just that they are slow or did I miss a doc on their security? On Mon, Jan 13, 2014 at 10:34 AM, Kurt Ro

[PATCH] Makefile.org: enclose CC parameter passing in quotes

2014-01-13 Thread Gustavo Zacarias
The compiler invocation might contain a space for example when using ccache. Signed-off-by: Gustavo Zacarias --- Makefile.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.org b/Makefile.org index 6873273..52a3d15 100644 --- a/Makefile.org +++ b/Makefile.org @@ -39

Re: [openssl.org #3231] default ciphers include insecure export cipher suites

2014-01-13 Thread Kurt Roeckx via RT
On Mon, Jan 13, 2014 at 05:25:55PM +0100, Jeff Hodges via RT wrote: > We've been testing clients using OpenSSL against > https://howsmyssl.com/a/check and noticed that those using > the OpenSSL_add_all_algorithms() have insecure export cipher suites > included by default. These cipher suites are us

[openssl.org #3236] support for DNSSEC in openssl

2014-01-13 Thread Elmar Stellnberger via RT
Webkit browsers and many other openssl based programs like ssh would already like to make use of DNSSEC. AFAIK DNSSEC has already been standardized and would therefore be free to be implemented by openssl. DNSSEC could overcome many of the weaknesses in the current certificate management workfl

Re: [openssl.org #3213] [PATCH] Fix failure to read default CA file & CA path in s_{client,server,time} (bug #977)

2014-01-13 Thread Reuben Thomas
On 11 January 2014 12:17, Florian Zumbiehl via RT wrote: > Hi, > > > So in that case it should try only the user's option if the user gave a > > -CApath or -CAfile, and otherwise the default option? > > well, I am not an OpenSSL dev, but that's the behaviour I would consider > correct, yeah. > >

[openssl.org #3234] [bug] openssl defaults to using tls compression

2014-01-13 Thread Jeff Hodges via RT
According to [1], TLS compression is still the default configuration of OpenSSL. This opens OpenSSL and all dependent tools (python, ruby, etc.) to the CRIME attack. I've already received push back from some of these tools that "OpenSSL should just fix this" and while I'm working on convincing the

[openssl.org #3233] 'make depend' emits warnings on OSX wth 1.0.1f

2014-01-13 Thread Charles Diza via RT
On OSX, there is no such thing as the program 'makedepend' (unless one installs XQuartz (X11 for mac), which shouldn't be required in order to build openssl). But lets say the user does have XQuartz installed. I suspect the makedepend that's included in XQuartz is buggy. As of 1.0.1f, If I enab

[openssl.org #3232] [PATCH] Makefile.org: Fix usage of CC=gcc -m32

2014-01-13 Thread Pierre Schmitz via RT
Commit 60adefa61025ffd7d56cf7ff8491008f783282bf introduced the use of the CC variable without quoting. This breaks e.g. multilib builds where CC is set to "gcc -m32". Signed-off-by: Pierre Schmitz --- Makefile.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.org b

[openssl.org #3231] default ciphers include insecure export cipher suites

2014-01-13 Thread Jeff Hodges via RT
We've been testing clients using OpenSSL against https://howsmyssl.com/a/check and noticed that those using the OpenSSL_add_all_algorithms() have insecure export cipher suites included by default. These cipher suites are using keys less than the currently recommended 128-bit keys. For instance, cu

[openssl.org #3229] Fwd: Issue with key length

2014-01-13 Thread Stephen Henson via RT
On Sat Jan 11 12:09:51 2014, som...@gmail.com wrote: > > Montavista openssl version : 0.98 > RHEL openssl version : 1.0.0 > > Can anyone please let me know what is the issue? > If this doesn't occur with the standard versions of OpenSSL it's some modification the vendor has introduced and you shou

FIPS openssl version for NIST 800-131A Transitions

2014-01-13 Thread Ranjith Kumar A.
Hi, I'm working on a FIPS compliance product and would like to upgrade its openssl version to support NIST 800-131A Transitions. Can you please let me know the FIPS openssl version which supports requirements stated in NIST 800-131A document(2.0.5 supports ???). Thanks in advance. Thanks, Ranjit