RE: Generating sect163k1 key pairs

2009-10-23 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jeffrey Walton Sent: Wednesday, 21 October, 2009 18:09 Just a few small tweaks: First, generate the domain parameters: openssl ecparam -genkey -name secp160k1 -out c:\key.pem Next, strip the PBE: openssl ec -in c:\key.pem -out

Does s_client support HTTP proxy?

2009-10-23 Thread Bo Xie
According to http://openssl.org/docs/apps/s_client.html, s_client does not support HTTP proxy. Is there any plan for s_client to support HTTP proxy so that we can use s_client inside firewall? __ OpenSSL Project

Does openssl s_client support HTTP proxy?

2009-10-23 Thread Bo Xie
I check http://openssl.org/docs/apps/s_client.html, and it does not support HTTP proxy right now. Is there any plan for s_client to support HTTP proxy? Thank you! -Bo __ OpenSSL Project

Does openSSL s_client support HTTP proxy?

2009-10-23 Thread Bo Xie
According to http://openssl.org/docs/apps/s_client.html, s_client does not support HTTP proxy right now. Is there any plan for s_client to support HTTP proxy? __ OpenSSL Project

RE: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread David Schwartz
Darryl Miles wrote: But this flag (while documented to the contrary) does nothing inside libssl. So yes the documentation says you should set it, prove to me that OpenSSL behaves in a different way because you set it. One of the biggest downsides of open source software is that encourages

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Darryl Miles
David Schwartz wrote: Darryl Miles wrote: But this flag (while documented to the contrary) does nothing inside libssl. So yes the documentation says you should set it, prove to me that OpenSSL behaves in a different way because you set it. One of the biggest downsides of open source

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Darryl Miles
David Schwartz wrote: Darryl Miles wrote: This is how everything else works, it's odd to say it's somehow a limitation of OpenSSL that it works the same way everything else works. Try to read to a string in one thread while you write to it from another. The general rule of thread

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Victor Duchovni
On Fri, Oct 23, 2009 at 03:47:51PM +0100, Darryl Miles wrote: I advocate that some users would find it useful to be able to invoke SSL_read() and SSL_write() from exactly two threads on the same 'SSL *' simultaneously. There is merit in this and as things stands OpenSSL does not allow it

Re: Revival of ERR_free_state_table / alt solution

2009-10-23 Thread Thomas Harning Jr.
On Wed, Oct 7, 2009 at 11:05 AM, Thomas Harning Jr. thomas.harn...@trustbearer.com wrote: I'm writing a browser and a library that use OpenSSL for cryptography (correction - browser plugin) support.  I want to best be able to fully cleanup state when my plugin/library is unloaded, however it

RE: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Jason Pettiss
Now the next question you might want to ask, is it allowed for exactly two threads to operate specifically the SSL_read() and SSL_write() on the _SAME_ 'SSL *' instance at the same time ? My understanding would be that the answer is NO. This is a limitation in the OpenSSL

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Victor Duchovni
On Fri, Oct 23, 2009 at 08:50:38AM -0700, Jason Pettiss wrote: However, it's clearly alright to read a socket from one thread while writing a socket from another: indeed, this is the purpose of a socket. That OpenSSL doesn't allow this usage seems like a limitation of the library. (Although

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Jason Pettiss
I advocate that some users would find it useful to be able to invoke SSL_read() and SSL_write() from exactly two threads on the same 'SSL *' simultaneously.  There is merit in this and as things stands OpenSSL does not allow it due to a design choice (aka design limitation). You

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Victor Duchovni
On Fri, Oct 23, 2009 at 09:15:35AM -0700, Jason Pettiss wrote: We could take turns sending discrete pieces of each file but that's silly and slow. Assuming we can load these gigantic files into memory to make the example simpler, we could both do this to write: It is possible to use

Creating private key pem file from exponent and modulus

2009-10-23 Thread Bizhan Gholikhamseh (bgholikh)
Hi All, Working with legacy code, a RSA private key's modulus and exponent are saved to a file (i.e. two array of c-structures). Is there anyway I can create pem format of the Private key its modulus and exponent parts? Many thanks in advance, --B

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Jason Pettiss
It is possible to use non-blocking SSL_read() SSL_write() calls that are interleaved, but not without a mutex or a separate thread that owns all SSL I/O that consumes requests to read/write. It is simpler to use two SSL connections. SSL is a state-machine, not a pipe. Awesome the former

Re: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread Victor Duchovni
On Fri, Oct 23, 2009 at 09:34:22AM -0700, Jason Pettiss wrote: It is possible to use non-blocking SSL_read() SSL_write() calls that are interleaved, but not without a mutex or a separate thread that owns all SSL I/O that consumes requests to read/write. It is simpler to use two SSL

RE: Is full-duplex socket use possible with OpenSSL?

2009-10-23 Thread David Schwartz
Darryl Miles wrote: Kernel objects are the exception, only because we cannot allow a program (broken or valid) to screw up kernel objects. So the kernel has no choice but to overserialize. FYI modern kernel's do not need to serialize (let alone overserialize, whatever that means,

Timeout on SSL_connect

2009-10-23 Thread John Chmelicek
Hello, please, can you direct me to some documentation which explains how to set timeout on client's SSL_connect(SSL *session). I tried select() but was not able to make it work. SSL Client is on UNIX HP11.11 uses openssl-0.9.8k Server is Apache 1.3.41 on UNIX HP11.11 OpenSSL 0.9.8e.

Re: your mail

2009-10-23 Thread Dr. Stephen Henson
On Fri, Oct 23, 2009, Dr. Stephen Henson wrote: On Wed, Oct 21, 2009, Adam Rosenstein wrote: I'm using v1.0.0 Beta 3. Hmm... there seems to be an SKID/AKID issue here: There is also a bug in the verification code which means it was expecting to find a CRL for the CRL signing