Re: [openssl-dev] [openssl-users] Is there openssl API to verify certificate content is DER or PEM format ?

2015-06-09 Thread Viktor Dukhovni
On Wed, Jun 10, 2015 at 08:48:41AM +0530, Nayna Jain wrote: > I think I will try with PEM_read_xxx and d2i_, then probably do not have > to read throu first character as 0x30. That works, provided you rewind or re-open the file. > Are all d2i_xxx type of APIs for DER format. Yes, they decode bi

[openssl-dev] X509_STORE_free() and X509_LOOKUP_free() also frees the X509 certificates inside it

2015-06-09 Thread Nayna Jain
Hi all, I am using X509_STORE and X509_LOOKUP to verify the certificate and its chain. But at the end when I do X509_STORE_free(store) and X509_LOOKUP_free (lookup), it is also doing free of the X509* certificate which I added. But I don't want that, because after that when I immediately try to

Re: [openssl-dev] [openssl-users] Is there openssl API to verify certificate content is DER or PEM format ?

2015-06-09 Thread Nayna Jain
Thanks.. I think I will try with X509_read_xxx and d2i_, then probably do not have to read throu first character as 0x30. I had few more questions. Are all d2i_xxx type of APIs for DER format. And if I have to operate on DER formatted certs, do I need to first convert it to PEM and then user P

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Blumenthal, Uri - 0553 - MITLL
Bill, I agree. Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network. From: Bill Cox Sent: Tuesday, June 9, 2015 18:00 To: openssl-dev@openssl.org Reply To: openssl-dev@openssl.org Subject: Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Bill Cox
On Tue, Jun 9, 2015 at 11:13 AM, Zooko Wilcox-OHearn < zo...@leastauthority.com> wrote: > > All of these are good options in my opinion: > > > > BLAKE2b — widely used, very efficient on modern 64-bit Intel CPUs and > > on ARM chips with NEON, simpler than the "p" versions > > > > BLAKE2s — more ef

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Zooko Wilcox-OHearn
> All of these are good options in my opinion: > > BLAKE2b — widely used, very efficient on modern 64-bit Intel CPUs and > on ARM chips with NEON, simpler than the "p" versions > > BLAKE2s — more efficient on 32-bit chips (e.g. ARMs) which do *not* have NEON > > BLAKE2sp, multithreaded — fastest op

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Zooko Wilcox-OHearn
Dear Kurt: Another option is to include BLAKE2sp but use the single-threaded reference implementation of BLAKE2sp. (Thanks to Samuel Neves for reminding me about this.) That way the hash values produced would be compatible with other people's implementations, or possible future implementations, t

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Jean-Philippe Aumasson
Hi Bill, First of all, it's spelled "BLAKE", with capitals :-) BLAKE-256 is the 256-bit version of BLAKE. Calling BLAKE2 BLAKE would be confusing. What about B2-256 and B2-512? ccing other B2 codesigners On Tue 9 Jun 2015 at 19:20 Bill Cox wrote: > On Tue, Jun 9, 2015 at 9:57 AM, Rainer Jung

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Rainer Jung
Am 09.06.2015 um 18:43 schrieb Bill Cox: On Tue, Jun 9, 2015 at 9:38 AM, Salz, Rich mailto:rs...@akamai.com>> wrote: > Zooko only asked for supporting Blake2 as an MD5 replacement, but he's being too modest. I can't stress enough how important the speed of Blake2 The problem is that

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Kurt Roeckx
On Fri, Jun 05, 2015 at 04:39:36PM +, Zooko Wilcox-OHearn via RT wrote: > We, the BLAKE2 maintainers, offer both reference C code and optimized > implementations: https://blake2.net/#dl . There are also other > implementations with various virtues available: https://blake2.net/#sw So it's my u

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Salz, Rich
> I agree.  How about Blake256 and Blake512, and leave out the parallel > versions?  That's not confusing.  My original proposal :) I don't think supporting some of the Blake family is in any doubt. ___ openssl-dev mailing list To unsubscribe: https://

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Salz, Rich
> Zooko only asked for supporting Blake2 as an MD5 replacement, but he's being > too modest.  I can't stress enough how important the speed of Blake2 The problem is that when you say "Blake2" everyone (yes, everyone in the entire world:) thinks it's one digest. What's really meant is a family

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Kurt Roeckx via RT
On Tue, Jun 09, 2015 at 12:19:56AM +, Zooko Wilcox-OHearn wrote: > > I'd support adding 2b and 2s, in spite of the fact that the names are > > really really bad. I'm less interested in seeing the parallel variants > > added. FWIW. > > Well, the reason I'm here is that the GNU coreutils mai

Re: [openssl-dev] [openssl.org #3897] request: add BLAKE2 hash function (let's kill md5sum!)

2015-06-09 Thread Kurt Roeckx
On Tue, Jun 09, 2015 at 12:19:56AM +, Zooko Wilcox-OHearn wrote: > > I'd support adding 2b and 2s, in spite of the fact that the names are > > really really bad. I'm less interested in seeing the parallel variants > > added. FWIW. > > Well, the reason I'm here is that the GNU coreutils mai

Re: [openssl-dev] ssl_sess.c : compilation error

2015-06-09 Thread Salz, Rich
> The only mentions of SSL_CTX_sess_get_new_cb are packages that bundle > or replicate OpenSSL code: It's not surprising; code that sets the callback should first get and store the old callback so that they can explicitly chain them. But that's not well-explained, fragile with dynamic librarie

Re: [openssl-dev] Simple program to print openssl library version

2015-06-09 Thread Dhiraj Bhor
Thanks. And yes i will keep in mind about openssl-users mailing list. dhiraj On Tue, Jun 9, 2015 at 12:42 PM, Matt Caswell wrote: > > > On 09/06/15 06:08, Dhiraj Bhor wrote: > > Hi, > > > > I am writing an application which will configure, make and copy > > libssl.so to custom location. Since t

Re: [openssl-dev] Simple program to print openssl library version

2015-06-09 Thread Matt Caswell
On 09/06/15 06:08, Dhiraj Bhor wrote: > Hi, > > I am writing an application which will configure, make and copy > libssl.so to custom location. Since tester does not know which version > of openssl he is testing, i wanted to know that is there any api which > will be used through C code to print