RE: FIPS 14-2 vs MD5

2009-08-17 Thread David Schwartz
Roger No-Spam wrote: > When building openssl in FIPS 140-2 mode, the MD5 algorithm is > not available for use. There are, however, several RFCs that mandate > the use of MD5. Would it be possible to partition a system into a > FIPS 140-2 part (more security critical parts, e.g SSL) and one other

FIPS 14-2 vs MD5

2009-08-17 Thread Roger No-Spam
Hello, When building openssl in FIPS 140-2 mode, the MD5 algorithm is not available for use. There are, however, several RFCs that mandate the use of MD5. Would it be possible to partition a system into a FIPS 140-2 part (more security critical parts, e.g SSL) and one other part that can inclu

Re: OpenSSL FIPS Module version 1.2

2009-08-17 Thread Pandit Panburana
Hello Steve, Do you know any fixes in the current 0.9.8k that also applicable to FIPS module or there is none? Thank you, -Pandit From: Dr. Stephen Henson To: openssl-users@openssl.org Sent: Saturday, August 15, 2009 6:39:40 AM Subject: Re: OpenSSL FIP

Fwd: Benachrichtung zum Übermittlungsstatus (Fehlge schlagen)

2009-08-17 Thread Serge Fonville
I'm not sure about you guys, but I find this very annoying 2009/8/17 > Dies ist eine automatisch erstellte Benachrichtigung +APw-ber den > Zustellstatus. > > +ANw-bermittlung an folgende Empf+AOQ-nger fehlgeschlagen. > > c...@next-motion.de > > > > > Final-Recipient: rfc822;c...@next-motio

Re: Creating certificates

2009-08-17 Thread Serge Fonville
What does your openssl.cnf look like, since it is used in the req? On Mon, Aug 17, 2009 at 6:00 PM, Gerald Iakobinyi-Pich wrote: > Hy, > > So my end goal is to have a CA, which I can use to sign certificates. I > have set up a CA, that was not that hard. But now I want to create > certificates si

Re: Creating certificates

2009-08-17 Thread Gerald Iakobinyi-Pich
Hy, So my end goal is to have a CA, which I can use to sign certificates. I have set up a CA, that was not that hard. But now I want to create certificates signed by my CA, and I want to provide the subject from the command line. I don't want it to be read from the openssl.cnf. That is because I h

Re: Creating certificates

2009-08-17 Thread Serge Fonville
Hi, I assume you have done a lot of googling and have read the docs extensively. First, what is your end goal? Since creating a certificate and having it signed by your own CA is not that difficult. What resources have you consulted. What have you already tried. Have you looked at the resulting c

Problem creating certificates

2009-08-17 Thread Gerald Iakobinyi-Pich
Hello, I am trying to create a certificate, on win, and I am having some troubles with OpenSSL. First I generate a key. That's ok. Then I create a request: openssl req -config .\openssl.cnf -subj "/C=DE/L=Munchen/ST=Bayern/O=Org/OU=Dev/CN=Test Certificate" -new -days 365 -key ..\demo_store\priva

Creating certificates

2009-08-17 Thread Gerald Iakobinyi-Pich
Hello, I am trying to create a certificate, on win, and I am having some troubles with OpenSSL. First I generate a key. That's ok. Then I create a request: openssl req -config .\openssl.cnf -subj "/C=DE/L=Munchen/ST=Bayern/O=Org/OU=Dev/CN=Test Certificate" -new -days 365 -key ..\demo_store\priva

Re: OpenSSL FIPS Module version 1.2

2009-08-17 Thread Steve Marquess
Kyle Hamilton wrote: ... There were plans for a "rolling validation", where fixes are rolled into the next validation effort, but I haven't heard anything from the Open Source Software Institute about that. My fear is that they have no funding for such an effort. Correct. At one point w

Re: ecdsa-signed certificates algorithm recognition problems

2009-08-17 Thread Laura Arhire
Just a quick note. openss x509 prints out the correct thing if I use 0.9.8h (the default openssl on my machine is 0.9.7-something). Now just the java part of my problem remains, but I suspect that has something to do with my setup. Sorry for the previous message. Laura Laura Arhire wrote: He

ecdsa-signed certificates algorithm recognition problems

2009-08-17 Thread Laura Arhire
Hello I have successfully managed to create and use certificates which contained and were signed by ecdsa keys in my own prototype program. However, upon attempting to import such a certificate in the java certificate store, I came upon some trouble. It seems there is something wrong with the

Re: UltraSPARC T2 - OpenSSL - PKCS11 ???

2009-08-17 Thread CH-Kami
Thanks for your help everyone ! I've checked T5120 hardware specifications : 8 cores 8 threads/core so I used the multi 64 option : signverifysign/s verify/s rsa 512 bits 0.s 0.s 121283.7 202718.0 rsa 1024 bits 0.s 0.s 30643.1 1158