Re: Building openssl without RSA,DSA,DH errors

2010-07-27 Thread Markus Hofer
@Steve: Yeah you are right; But for net-snmp version 5.4.2.1 the only thing I need is just HMAC,SHA and MD5; Is there much difference in the compiled libaries anyway? When i did some comparison the difference was in the 100kB area. Thats not to much; BTW: I found a link to what seems to be a

RE: Man in the middle proxy - Not working

2010-07-27 Thread Alexey Drozdov
Hi! When your setup proxy setting for browsers, they using HTTP CONNECT method for establish pure tcp-connection via proxy (not for local resources). It's seems like: Client send HTTP-request to proxy CONNECT remotehost:port HTTP/1.1 Host: remotehost:port And begin wait

RE: Man in the middle proxy - Not working

2010-07-27 Thread David Schwartz
Alexey Drozdov wrote: Hi! When your setup proxy setting for browsers, they using HTTP CONNECT method for establish pure tcp-connection via proxy (not for local resources). It's seems like: Client send HTTP-request to proxy CONNECT remotehost:port HTTP/1.1 Host:

Using external engine to achieve physical security

2010-07-27 Thread Steve Strobel
I am working on a project for which we plan to use the FIPS object module and AES 256. While I expect that a software-only implementation will work fine, I would like to know the feasibility of using an external device through the engine interface to satisfy the FIPS 140-2 Level 3 physical

RE: Man in the middle proxy - Not working

2010-07-27 Thread Rene Hollan
Oh! I totally misunderstood this. I thought OP wanted to MITM SSL sessions (which is possible, if (a) the traffic is decrypted, (b) certs are reissued and resigned, and (c) the client TRUSTS the modified cert chain (typically its root cert)). This is just HTTPS Proxy. In which case other

RE: Man in the middle proxy - Not working

2010-07-27 Thread David Schwartz
Rene Hollan: Oh! I totally misunderstood this. I thought OP wanted to MITM SSL sessions (which is possible, if (a) the traffic is decrypted, (b) certs are reissued and resigned, and (c) the client TRUSTS the modified cert chain (typically its root cert)). This is just HTTPS Proxy. In

Re: Slow crypto initialization.

2010-07-27 Thread Jake Goulding
Thanks for the information about the rt address. We sent the explanation and patch as you suggested, and can now see the issue on the tracker list. However, no one has commented on it. Are there additional steps we can take to further the process of accepting the patch? Thanks! Jake Goulding |

Re: Slow crypto initialization.

2010-07-27 Thread Kyle Hamilton
The OpenSSL development team typically don't comment on a request until they've fixed it. (I believe this is poor customer service, but I also believe that I'm not entitled to good customer service until I've paid for it.) What appears to happen is this: 1) bug submitter sends an email to

Re: Man in the middle proxy - Not working

2010-07-27 Thread Raj
Hi All Thank you so much for all the response. I have one more doubt. If we do normal proxying on https connection, is it possible to read the https content data, at least the URL Thanks, Raj Rajmohan SK - Original Message - From: David Schwartz dav...@webmaster.com To: