Decrypting SSL packets with the keys retrieved from openssl

2010-12-20 Thread Yigit
Hello all, I have seen one or two related previous subjects but they didn't solve my problem. So I am posting a new one. There is an application on my computer which connects to a server using openssl. I have to see their traffic which means either I decrypt all sniffed packets or I print all

Substitute for openssl command

2010-12-20 Thread Rui Francisco
Hi, I'm trying to implement the following code to substitute the following openssl command openssl dgst -sha1 -sign myKey.pem something.txt | openssl enc -base64 I'm using Delphi and the Opensll lib developed by Marco Ferrante (http://www.disi.unige.it/person/FerranteM/delphiopenssl/)

Re: Decrypting SSL packets with the keys retrieved from openssl

2010-12-20 Thread Michael S. Zick
On Mon December 20 2010, Yigit wrote: Hello all, I have seen one or two related previous subjects but they didn't solve my problem. So I am posting a new one. There is an application on my computer which connects to a server using openssl. I have to see their traffic which means either I

Re: Decrypting SSL packets with the keys retrieved from openssl

2010-12-20 Thread Yigit
I don't think Wireshark will be able to decrypt any packet without the appropriate keys. I can already capture packets using wireshark or with any application that uses winpcap, but the problem is decrypting them in order to see what the application is really talking to the server. And the keys I

SSL cert chain validation timestamp issues

2010-12-20 Thread travis+ml-openssl
So a friend ran into this lately; libnss, at least on Linux, checks that the signing cert (chain) is valid at the time of signature - as opposed to present time. (It may check present time as well - not sure on that) This makes for problems if you renew the cert, since the new cert will have a

Re: SSL cert chain validation timestamp issues

2010-12-20 Thread Victor Duchovni
On Mon, Dec 20, 2010 at 10:49:57AM -0800, travis+ml-open...@subspacefield.org wrote: libnss, at least on Linux, checks that the signing cert (chain) is valid at the time of signature - as opposed to present time. (It may check present time as well - not sure on that) This makes for

RE: Substitute for openssl command

2010-12-20 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Rui Francisco Sent: Monday, 20 December, 2010 10:07 (Also on -dev, answering -users only, this is not a -dev question.) I'm trying to implement the following code to substitute the following openssl command openssl dgst -sha1 -sign

FIPS 1.2.2 out range of signed 32bit displacement

2010-12-20 Thread S.M. Protsman
I just grabbed the openssl-fips-1.2.2 archive from the site and ran into an error. System: cat /etc/SuSE-release SUSE Linux Enterprise Desktop 11 (x86_64) VERSION = 11 PATCHLEVEL = 1  ./config fipscanisterbuild make snip gcc -I.. -I../.. -I../../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS

ifdef OPENSSL_NO_COMP

2010-12-20 Thread Bhola Ray
I have noticed the above flag in our openssl code in several c and h files. If I use #define OPENSSL_NO_COMP 1 in the right include file, and build the libcrypto.a and libssl.a then in that build there would be No Compression. Is it correct, can anyone comment on that...thanks in

Re: ifdef OPENSSL_NO_COMP

2010-12-20 Thread Dr. Stephen Henson
On Mon, Dec 20, 2010, Bhola Ray wrote: I have noticed the above flag in our openssl code in several c and h files. If I use #define OPENSSL_NO_COMP 1 in the right include file, and build the libcrypto.a and libssl.a then in that build there would be No Compression. Is

Re: Pls some basic c code to generate key pair using openssl

2010-12-20 Thread Mounir IDRASSI
Hi, Here are the basic calls needed to generate an ECC key (this example uses NSA Suite B curve P-256) : int curveId = OBJ_sn2nid(prime256v1); EC_GROUP* pGroup = EC_GROUP_new_by_curve_name(curveId); EC_KEY* pKey = EC_KEY_new(); EC_KEY_set_group(pKey, pGroup); EC_KEY_generate_key(pKey));

Re: ifdef OPENSSL_NO_COMP

2010-12-20 Thread Victor Duchovni
On Mon, Dec 20, 2010 at 07:21:54PM -0500, Bhola Ray wrote: I have noticed the above flag in our openssl code in several c and h files. If I use #define OPENSSL_NO_COMP 1 in the right include file, and build the libcrypto.a and libssl.a then in that build Do not do this by