Re: [openssl-dev] about enc 'magic' data and salt handling

2017-01-13 Thread Tom Francis
> On Jan 13, 2017, at 6:34 PM, Michel wrote: > > Hi, > > FWIW, just sharing my opinion : > > Thanks to the team, OpenSSL comes with lots of powerful tools. > They are not always easy to use, but some have no equivalent and are very > helpful to test, debug, experiment, learn … all things th

Re: [openssl-dev] [openssl.org #3713] Bug: openssl-1.0.1l, FIPS, HP-UX ia64, Duplicate Symbol "AES_Te" and "AES_Td"

2016-02-03 Thread Tom Francis via RT
Use an older version of OpenSSL for your FIPS-enabled OpenSSL? Yes, it might have security problems, but it you’re using the FIPS module! It’s got worse security problems, so you shouldn’t worry. :) I can say for sure the FIPS 2.0 module compiled and worked at the time the Security Policy was

Re: [openssl.org #3620] bug report ASN1_item_d2i causes memory leak

2014-12-02 Thread Tom Francis
Not a bug; this is documented behavior. See https://www.openssl.org/support/faq.html#PROG3 for more information on how to use the _d2i and _i2d functions. > On Dec 2, 2014, at 4:50 PM, Luis Garcia via RT wrote: > > Hi, > > The bug list server of openssl is very slow to access, so I am not s

Re: Openssl build errors on zLinux and HP-ita

2014-09-23 Thread Tom Francis
On Sep 22, 2014, at 6:19 AM, Mrunal Nerpawar wrote: > > > On Mon, Sep 22, 2014 at 3:45 PM, Mrunal Nerpawar wrote: > > > On Sat, Sep 20, 2014 at 7:28 AM, Tom Francis wrote: > > On Sep 19, 2014, at 7:55 AM, Mrunal Nerpawar wrote: > > > > > &g

Re: Openssl build errors on zLinux and HP-ita

2014-09-21 Thread Tom Francis
On Sep 19, 2014, at 7:55 AM, Mrunal Nerpawar wrote: > > > On Fri, Sep 19, 2014 at 3:05 PM, Andy Polyakov wrote: > > I could not get this working even on a 11.23 machine having latest (last > > one released in December 2007). > > ... latest what? I mean it appears that you missed something. B

Re: Openssl build errors on zLinux and HP-ita

2014-09-04 Thread Tom Francis
On Sep 3, 2014, at 11:41 AM, Andy Polyakov wrote: >> In the ld man page, I could find help for option +nosectionmerge. >> +nosectionmerge >> With the -r option, allow procedures to be >> positioned independently. The default is to merg

Re: Openssl build errors on zLinux and HP-ita

2014-09-02 Thread Tom Francis
For HP-UX, be sure to install the latest linker patches. +sectionmerge has been around for a long while, so you’ve probably got a lot of patches to install. :) TOM On Sep 2, 2014, at 5:45 AM, Mrunal Nerpawar wrote: > Hi > > zLinux: > 1) ./config > Configured for linux64-s390x. > 2) make

Re: Single-Makefile Build Experiment report

2014-08-15 Thread Tom Francis
On Aug 14, 2014, at 9:20 PM, Salz, Rich wrote: >> Just a comment. the OpenSSL build already depends on Perl and Perl already >> has a "Make" of it's own . > > Ooh, that could be interesting. What's the perl make thing called? A web > search for "perl make" was too voluminous… AFAIK, there’s

Re: [openssl.org #3316] Wrong trust chain with new version of openssl

2014-04-22 Thread Tom Francis
It’s a lack of features in Apple’s code, and it’s very well-known among Apple developers. Search Apple’s developer forums (both iOS & MacOS) as well as their public bug database (IIRC, you have to be a registered Apple developer to search those). Apple’s not going to change it, though, as the

Re: Thunderbird decrypt issue

2014-03-14 Thread Tom Francis
On Mar 14, 2014, at 5:33 AM, Leon Brits wrote: > Hi, > > I have a problem with Thunderbird which works via the cryptoki to our device > which makes use of OpenSSL. > > Thunderbird passes ciphertext which falls exactly on the blocksize boundary. > I translate the cryptoki DecryptUpdate() ca

Re: FIPS mode

2013-03-08 Thread Tom Francis
I strongly recommend reading the user guide, as it'll help a lot. You need to do more than simply link your application with libcrypto and libssl. There's a sample shell script, fipsld, that's also provided in the distribution that shows the necessary actions (and can even be called in place o

Re: Linking with fipsld

2013-02-02 Thread Tom Francis
Modify fipsld such that it uses gcc to compile the .c file (which you're not allowed to modify), and links your application with g++. The changes are pretty straight-forward, and don't affect what you can say about your application and FIPS 140. You could also leave fipsld alone and modify you