Restricting ciphers list to RSA only in Client Hello

2011-05-03 Thread Gauri Kshirsagar
Hi All, I have built an SIP test application using openssl. I am trying to restrict the ciphers sent by this application in Client Hello to those with only RSA key exchange. Is there a way to configure it in OpenSSL? I tried to compile the source code with SSL_DEFAULT_CIPHER_LIST set to

Re: Restricting ciphers list to RSA only in Client Hello

2011-05-03 Thread derleader mail
Hi All, I have built an SIP test application using openssl. I am trying to restrict the ciphers sent by this application in Client Hello to those with only RSA key exchange. Is there a way to configure it in OpenSSL? I tried to compile the source code with SSL_DEFAULT_CIPHER_LIST

how to get RSA key pair from genrsa

2011-05-03 Thread vichy
Dear all: I try to use openssl genrsa -out 1024.private.key 1024 to generate rsa key pairs. if I remember correctly, 1024 is the size of n, the unit in bits and it will be one of public key paris. But when I generate the public key by the command,openssl rsa -in 1024.private.key -pubout. I cannot

Re: Restricting ciphers list to RSA only in Client Hello

2011-05-03 Thread Gauri Kshirsagar
Won't be able to paste the entire source code since the SIP application uses SipXces stack. SipStack has been built with open ssl which calls SSL_connect as shown below void OsSSLConnectionSocket::SSLInitSocket(int socket, long timeoutInSecs) { if (mIsConnected) { int err = -1; // TODO:

Compressed ECC points - X9.62 vs IEEE1363

2011-05-03 Thread Julien Poumailloux
Dear subscribers of the openssl-users list, I read in the code of openssl (crypto/ec.h) that the compression of ECC points is compliant with the X9.62 standard. Unfortunately I don't have access to this standard. I am required to use compressed ECC points compliant with the IEEE1363-2000

Re: Compressed ECC points - X9.62 vs IEEE1363

2011-05-03 Thread Michael Sierchio
http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/DRBG_ANSI_X9-62-1998.pdf On Tue, May 3, 2011 at 3:28 AM, Julien Poumailloux julien.p...@free.fr wrote: Dear subscribers of the openssl-users list, I read in the code of openssl (crypto/ec.h) that the compression of ECC points is

Compressed ECC points - X9.62 vs IEEE1363

2011-05-03 Thread Julien Poumailloux
Dear subscribers of the openssl-users list, I read in the code of openssl that the compression of ECC points is compliant with the X9.62 standard. Unfortunately I don't have access to this standard. I am required to use compressed ECC points compliant with the IEEE1363-2000 standard. My

stunnel 4.36 released

2011-05-03 Thread Michal Trojnara
Dear Users, Version 4.36 of stunnel was released. The ChangeLog entry: Version 4.36, 2011.05.03, urgency: LOW: * New features - Updated Win32 DLLs for OpenSSL 1.0.0d. - Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. - Strict

Re: how to get RSA key pair from genrsa

2011-05-03 Thread Martin Kaiser
Thus wrote vichy (vichy@gmail.com): Dear all: I try to use openssl genrsa -out 1024.private.key 1024 to generate rsa key pairs. if I remember correctly, 1024 is the size of n, the unit in bits and it will be one of public key paris. But when I generate the public key by the

Re: how to get RSA key pair from genrsa

2011-05-03 Thread vichy
hi all: 2011/5/3 vichy vichy@gmail.com: Dear all: I try to use openssl genrsa -out 1024.private.key 1024 to generate rsa key pairs. if I remember correctly, 1024 is the size of n, the unit in bits and it will be one of public key paris. But when I generate the public key by the

RE: RE: RE: Cannot encrypt text - need help

2011-05-03 Thread Steffen DETTMER
* derleader mail on Monday, May 02, 2011 8:14 PM But what exactly do you want to know? If you can use SSL and Blowfish? It does not appear in http://www.openssl.org/docs/apps/ciphers.html. Yes the web site and the book about the OpenSSL is outdated. Does TLS spec nowadays defines a

OpenSSL crashes generating CSR -- help!

2011-05-03 Thread Jesse Keller
I need to generate a CSR, but OpenSSL always crashes. What am I doing wrong? c:\GnuWin32\binopenssl genrsa -out switchvox.key 2048 c:\GnuWin32\binopenssl req -new -key switchvox.key -out switchvox.csr -config ..\share\openssl.cnf OpenSSL prompts me for the city, state, etc. I fill

leak memory with SSL_load_error_strings

2011-05-03 Thread ikuzar
Hi, When I tracked memory leak ( with valgrind ), it is said that memory allocated by SSL_load_error_strings is not released. what function should I use to free memory allocated by SSL_load_error_strings ? Thanks for your help

SSL_shutdown closesocket

2011-05-03 Thread Harshvir Sidhu
Hi, I am using Blocking sockets for my applicaiton. The server i have accept SSL and non SSL connections, from the client side when i connect with SSL then on closesocket i dont get a notification of client closed, while for non SSL i get notification. Is this some desired behavior or i am

Re: SSL_shutdown closesocket

2011-05-03 Thread derleader mail
Hi, I am using Blocking sockets for my applicaiton. The server i have accept SSL and non SSL connections, from the client side when i connect with SSL then on closesocket i dont get a notification of client closed, while for non SSL i get notification. Is this some desired behavior or i am

How can I copy RSA structure

2011-05-03 Thread rale77
Hello, Is there any function for copy RSA structure (something like BN_dup for BIGNUM), I can not find nothing till now? I created RSA structure called rsa with RSA_generate_key, but I now need deep copy of this object, I suppuse that I can do that with new operator RSA * copy = new RSA(*rsa),

Re: TPM engine

2011-05-03 Thread Kenneth Goldman
I'd try a trousers mailing list as well. I just compiled trousers and linked with openssl 1.0.0 and it works. But I didn't try the TPM engine, which I understand to be a layer on top of trousers. Did you 'discover' that it doesn't work through documentation or did you try to link. My

Re: SSL_shutdown closesocket

2011-05-03 Thread Harshvir Sidhu
Which code you want, my application is very big? Just the code to call, SSL_shutdown from client side is pasted in this. http://pastebin.com/7P70aNWU On Tue, May 3, 2011 at 12:35 PM, derleader mail derlea...@abv.bg wrote: Hi, I am using Blocking sockets for my applicaiton. The server

RE: leak memory with SSL_load_error_strings

2011-05-03 Thread Jeremy Farrell
From: ikuzar Hi, When I tracked memory leak ( with valgrind ), it is said that memory allocated by SSL_load_error_strings is not released. what function should I use to free memory allocated by SSL_load_error_strings ? Thanks for your help http://lmgtfy.com/?q=SSL_load_error_strings

How to create threaded pool with OpenSSL

2011-05-03 Thread derleader mail
Hi, I found OpenSSL server code which uses threds in order to process clients. Is it possible to create connection pool with OpenSSL. There is no information about this on openssl.org How I can add threaded pool to this code? http://pastebin.com/pkDB7fHm Regards

RE: Handling Indirect CRL Issuer

2011-05-03 Thread Adam Rosenstein
So, we can only use indirect crl if it was issued by a CRL issuer with the same identity name as the CA? Is there a way to have one indirect CRL issuer produce a crl for many intermediate CAs (to potentially revoke the CA certificates as well as the EE certs that they sign)? Ideally, we would

Re: How to create threaded pool with OpenSSL

2011-05-03 Thread David Schwartz
On 5/3/2011 11:31 AM, derleader mail wrote: Hi, I found OpenSSL server code which uses threds in order to process clients. Is it possible to create connection pool with OpenSSL. There is no information about this on openssl.org How I can add threaded pool to this code?

RE: OpenSSL crashes generating CSR -- help!

2011-05-03 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jesse Keller Sent: Tuesday, 03 May, 2011 09:17 I need to generate a CSR, but OpenSSL always crashes. What am I doing wrong? c:\GnuWin32\binopenssl genrsa -out switchvox.key 2048 c:\GnuWin32\binopenssl req -new

RE: how to get RSA key pair from genrsa

2011-05-03 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Martin Kaiser Sent: Tuesday, 03 May, 2011 07:04 Thus wrote vichy (vichy@gmail.com): Dear all: I try to use openssl genrsa -out 1024.private.key 1024 to generate rsa key pairs. if I remember correctly, 1024 is the size of n, the

RE: Restricting ciphers list to RSA only in Client Hello

2011-05-03 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Gauri Kshirsagar Sent: Tuesday, 03 May, 2011 05:37 I have built an SIP test application using openssl. I am trying to restrict the ciphers sent by this application in Client Hello to those with only RSA key exchange.

RSA_private_decrypt across processes

2011-05-03 Thread Ashwin Chandra
I generate an RSA key using RSA_generate_key in one process. I then take the RSA structure that is generated and serialize it and send it to another process via an RPC mechanism. In the other process I then de-serialize the RSA data and use that as input to an RSA_private_decrypt function to