I fail to see how it is not wrong to get 17 bytes instead of 16 you
requested in the certificate?
--
Regards,
Igor
On 01.09.2014. 23:21, Rich Salz via RT wrote:
This is not wrong. Serial numbers are unsigned, and the leading zero byte is to
avoid confusing the high-bit with a sign bit.
--
Rich
It is wrong because the 16 bytes wil be interpreted as a negative number and
that's not allowed so you have to put a leading 0 byte there.
--
Principal Security Engineer
Akamai Technologies, Cambridge MA
IM: rs...@jabber.me Twitter: RichSalz
I fail to see how it is not wrong to get 17 bytes instead of 16 you
requested in the certificate?
--
Regards,
Igor
On 01.09.2014. 23:21, Rich Salz via RT wrote:
> This is not wrong. Serial numbers are unsigned, and the leading zero byte is
> to
> avoid confusing the high-bit with a sign bit.
> -
The s_server accepts a very long name because all it is doing is comparing the
name you specify on the command-line to whatever the client sends.
I am more worried about jerks DoS'ing a server by sending 65K of SNI name, than
I am worried about someone having a valid reason for more than 256 bytes
This is not wrong. Serial numbers are unsigned, and the leading zero byte is to
avoid confusing the high-bit with a sign bit.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org
__
OpenSSL Project htt
2014-09-01 15:42 GMT+02:00 Salz, Rich :
> The size of your UDP packet depends on the MTU supported by everyone along
> the path. (BTW, that's what heartbeat was created.)
Yes, it is understood now. But, given that DTLS provides reliability
and message order, it makes sense IMHO that SSL_write(lo
> Of no less importance is to emphasise that it adds additional "keyform"
> parameter to functions defined in ts.c and utilized by "-reply" function, that
> will *break* compatibility with any previously existing code.
How does it break? We don't care about source-level compatibility within the
If Frank doesn't want SSLv2 then he needs to disable it in the SSL_CTX first,
no?
The mechanism to say what ciphers you want is orthogonal to the mechanism to
say what protcols you want. That's unfortunate and a source of confusion, but
is unlikely to change any time soon.
--
Principal Secu
My point is that since stunnel has a different goal of wrapping almost any
protocol, that might be a better place for it, rather than going down the
slippery slope of putting a binary hack into s_client which wouldn't let you
actually USE the protocol.
__
On 08/29/2014 08:16 AM, Tomas Mraz wrote:
> On Pá, 2014-08-29 at 16:19 +0200, Frank Meier wrote:
>> While testing different ciphersuites I found a quite drastic change in
>> the behavior between openssl version 1.0.1h to 1.0.1i. While using a
>> cipherlist like "ECDHE-RSA-AES128-SHA256:RC4" with
On Mon, Sep 01, 2014 at 09:40:55AM -0400, Salz, Rich wrote:
> What about usoing stunnel?
Stunnel's STARTTLS support does not include LDAP as the initial
protocol.
--
Viktor.
__
OpenSSL Project
You can't use partial writes.
The size of your UDP packet depends on the MTU supported by everyone along the
path. (BTW, that's what heartbeat was created.)
I suggest you get your program working "properly" for your definition of what
properly means, without DTLS. Then add DTLS.
And have you
What about usoing stunnel?
- Original Message -
> From: "Rich Salz via RT"
> To: r...@king7.com
> Cc: openssl-dev@openssl.org
> Sent: Wednesday, August 27, 2014 5:39:33 AM
> Subject: [openssl.org #2665] s_client support for starttls ldap
>
> s_client is really for text-based protocols only.
It still would be usefu
Dear Dev team,
Regarding "engine" support in timestamping (ts) app, I find it has
compatibility issues with the rest of OpenSSL.
That is why I took some patches that were applicable to o.9.8 version and
adapted them to the current git-head.
I'm not the only contributor to this patch, there are
SSL in DTLS mode. SSL_CTX with SSL_MODE_ENABLE_PARTIAL_WRITE option
enabled so SSL_write() may return less than the given data length.
It does not work. I call SSL_write() by passing a very long data
(65536) and it still returns -1. So, in case I want to write a big
data over a DTLS UDP connection
On 29/08/14 17:12, Viktor Dukhovni wrote:
I retestet with "-no_ssl2" option and then the ECDHE ciphers are used
again.
Applications should these days employ "SSL_OP_NO_SSLv2",
I agree, but then openssl should set this option by default also.
_
17 matches
Mail list logo
