Re: indirectCRLs

2006-10-20 Thread Dr. Stephen Henson
On Fri, Oct 20, 2006, Karsten Ohme wrote: > > I have created a CA and want to generate CRLs for another CA, i.e. an > indirectCRL. How can this be done with the command line? I also want to > add a CRL extensions to it. How is the syntax for the > IssuingDistributionPoint extension in openssl.cnf

Re: Source for entropy on Windows platforms with CryptoAPI installed

2006-10-20 Thread Andy Polyakov
It just occurred to me that the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed (type REG_BINARY) contains the latest seeded value from everything that CryptoAPI takes into account when generating its random seed. CryptoAPI permutes it with RC4 to come up with a pseudo-ran

Re: BN_bin2bn problem

2006-10-20 Thread Nils Larsch
Olga Kornievskaia wrote: ... Ok. Thanks. I was hoping that a leading zero was the answer to my real problem which is. I'm using the above "p" and a generator "g" = 2 (both are well-known group 2 DH parameters described in the RFC 2412). I initialize the DH structure with them and the then cal

Re: TLS Client Helo, cipher suites

2006-10-20 Thread Arno Garrels
Lutz Jaenicke wrote: > Please have a look into SSL_OP_CIPHER_SERVER_PREFERENCE available > via SSL_CTX_set_options(). Thank you very much! Arno Garrels __ OpenSSL Project http://www.openssl.org Use

Re: TLS Client Helo, cipher suites

2006-10-20 Thread Lutz Jaenicke
On Fri, Oct 20, 2006 at 08:44:25PM +0200, Arno Garrels wrote: > Hello, > > How to force negotiation of AES256-SHA without disabling the > AES128-SHA at the server-side when a client sends AES128-SHA > as its first preference and AES256-SHA as second? Please have a look into SSL_OP_CIPHER_SERVER_P

TLS Client Helo, cipher suites

2006-10-20 Thread Arno Garrels
Hello, How to force negotiation of AES256-SHA without disabling the AES128-SHA at the server-side when a client sends AES128-SHA as its first preference and AES256-SHA as second? Thanks, Arno Garrels __ OpenSSL Project

Re: HP-UX installation (was: Solaris installation: Text relocation remains...)

2006-10-20 Thread Marc Girod
Hello 'ViSolve Security', ViSolve Security Consulting Group <[EMAIL PROTECTED]> writes: > Try OpenSSL compilation with the following configure options. > > # ./Configure --prefix=/vob/tools_HP-UX zlib shared hpux-parisc2-cc Thanks for your reply, and sorry for not following up faster. Your sug

SSL_CTX_set_quiet_shutdown func OpenSSL only?

2006-10-20 Thread Perry L. Jones
Please don't get upset because this is kinda a Java question. Does anyone know if SSL_CTX_set_quiet_shutdown can only be done using the OpenSSL API or can it be done using Java? I have a OpenSSL server and a Java client. The server is not expecting to see the shutdown but the Java client sen

indirectCRLs

2006-10-20 Thread Karsten Ohme
Hello, I have created a CA and want to generate CRLs for another CA, i.e. an indirectCRL. How can this be done with the command line? I also want to add a CRL extensions to it. How is the syntax for the IssuingDistributionPoint extension in openssl.cnf? Regards, Karsten __

Re: RE: Multithreading problem

2006-10-20 Thread kalikali
> I am very, very new to openssl. There is a good example (Example 5-16, > Network Security with Openssl book)) for using nonblocking openssl. It > is easy to understand. It uses one thread to handle 2 nonblocking > socket. You may have to modify it to handle multithread. At least, you > have examp

Re: RE: Multithreading problem

2006-10-20 Thread kalikali
First... sorry for trash in my post's subjects. I'm using www interface on my email provider site for sending emails and there is no option to change this. (I don't known if this is my mailbox or this mailing list server problem). > Actually, it's extremely complicated. For example, what do yo

RE: Multithreading problem

2006-10-20 Thread Dinh, Thao V CIV B32-Branch
I am very, very new to openssl. There is a good example (Example 5-16, Network Security with Openssl book)) for using nonblocking openssl. It is easy to understand. It uses one thread to handle 2 nonblocking socket. You may have to modify it to handle multithread. At least, you have example to foll

Re: openssl-valgrind-errors...

2006-10-20 Thread Bruce Stephens
Anand Vasudevan <[EMAIL PROTECTED]> writes: > Hi, am using libcurl(ver 7.15.4) which uses openssl libraries. When I > ran my application with valgrind-3.1.0 in Fedora core 5, I observed > some valgrind errors coming from open ssl library..any inputs? pls > find the attached for the errors.. You

Re: PKCS1_MGF1 bad implementation?

2006-10-20 Thread Jiyong Xu
Sorry, I should take more time on code reading. The implementation is perfect.On 10/20/06, Jiyong Xu <[EMAIL PROTECTED] > wrote:Hi,PKCS#1 v2.1 document showed the steps needed to implement a MGF1 on the section B.2.1.I don't think that 'PKCS1_MGF1' function in the rsa_oaep.c was properly implement

PKCS1_MGF1 bad implementation?

2006-10-20 Thread Jiyong Xu
Hi,PKCS#1 v2.1 document showed the steps needed to implement a MGF1 on the section B.2.1.I don't think that 'PKCS1_MGF1' function in the rsa_oaep.c was properly implemented.The step #3 on the section said 'For counter from 0 to \lceil{l / hLen}\rceil-1, do the following...' But in 'PKCS1_MGF1', the