Re: OpenSSL 1.0.1 example with SRP

2011-10-26 Thread Jeffrey Walton
On Wed, Oct 26, 2011 at 10:28 PM, Norm Green wrote: > Is there no one that can help me get a simple SRP test case working?  Or > should I conclude SRP is broken in OpenSSL 1.0.1? > > From the output below, it appears the client and server support no less than > 9 ciphers in common.  Why then do

Re: OpenSSL 1.0.1 example with SRP

2011-10-26 Thread Norm Green
Is there no one that can help me get a simple SRP test case working? Or should I conclude SRP is broken in OpenSSL 1.0.1? >From the output below, it appears the client and server support no less than 9 >ciphers in common. Why then do I get the "no shared cipher" error? I rebuilt the library w

Re: strong TLS connections

2011-10-26 Thread Kristen J. Webb
On 10/26/11 6:35 PM, Wim Lewis wrote: On 7 Oct 2011, at 7:40 PM, Kristen J. Webb wrote: I'm exploring the security of TLS for TCP/IP connections. I would like to establish TLS connections using server certificates (managing client certs via external or internal PKI is painful). My understandi

Re: strong TLS connections

2011-10-26 Thread Wim Lewis
On 7 Oct 2011, at 7:40 PM, Kristen J. Webb wrote: > I'm exploring the security of TLS for TCP/IP connections. > I would like to establish TLS connections using server certificates > (managing client certs via external or internal PKI is painful). > My understanding is that a TLS connection with a

Re: strong TLS connections

2011-10-26 Thread Kristen J. Webb
On 10/8/11 1:16 AM, Michael Sierchio wrote: On Fri, Oct 7, 2011 at 7:40 PM, Kristen J. Webb wrote: My understanding is that a TLS connection with a server cert only identifies the server to the client. This leads to a MiTM attack, where the mitm can impersonate the client because the server

Re: AES key wrap feature unavailable in FIPS mode OpenSSL?

2011-10-26 Thread Jakob Bohm
On 10/26/2011 9:43 PM, Bill Durant wrote: Hello, Has the AES key wrap feature been removed from the nightly OpenSSL in FIPS mode? I have built a FIPS-capable OpenSSL using the following: ftp://ftp.openssl.org/snapshot/openssl-1.0.1-stable-SNAP-20111025.tar.gz ftp://ftp.openssl

Re: FIPS-capable OpenSSL that works on Windows NT

2011-10-26 Thread Bill Durant
On Oct 25, 2011, at 4:17 AM, Dr. Stephen Henson wrote: > On Mon, Oct 24, 2011, Bill Durant wrote: > >> On Oct 24, 2011, at 4:00 PM, Dr. Stephen Henson wrote: >>> On Mon, Oct 24, 2011, Bill Durant wrote: >>> Hello Steve: I downloaded ftp://openssl.org/snapshot/open

AES key wrap feature unavailable in FIPS mode OpenSSL?

2011-10-26 Thread Bill Durant
Hello, Has the AES key wrap feature been removed from the nightly OpenSSL in FIPS mode? I have built a FIPS-capable OpenSSL using the following: ftp://ftp.openssl.org/snapshot/openssl-1.0.1-stable-SNAP-20111025.tar.gz ftp://ftp.openssl.org/snapshot/openssl-fips-2.0-test-20111

Issue with Connection Reset

2011-10-26 Thread Ratin, Yuliya S.
Please help! Many thanks! Info: Connection to SQL Server 2008 R2 database (cluster install) We're seeing the connection reset while testing from multiple sources and applications - it seems like the server is not responding with an SSL certificate during the handshake, here's the output fr

Re: Secure plaintext-derived filename [was: HMAC with RSA Key]

2011-10-26 Thread Jakob Bohm
On 10/26/2011 3:01 PM, Steffen DETTMER wrote: 4. Truncate the string to your desired file name length, but not so short that accidental collisions become likely (Example to keep up to 16000 file names likely different, use file names with 2 * log2(16000)=2*14=28 bits minimum). Where can I lear

RE: Secure plaintext-derived filename [was: HMAC with RSA Key]

2011-10-26 Thread Steffen DETTMER
> > 4. Truncate the string to your desired file name length, but not so > > short that accidental collisions become likely (Example to > > keep up to 16000 file names likely different, use file names with 2 * > > log2(16000)=2*14=28 bits minimum). Where can I learn more about this formula? I th

openssl failing to download remote certificate

2011-10-26 Thread mohtashims
I tried openssl to download a remote cert on my181.svr.us.cyber.net Below are the 3 steps to generate self sign certificate. 1)To generate keys: /opt/boksm/lib/openssl genrsa -des3 -out server2.key 2048 -config /usr/sfw/lib/webmin/acl/openssl.cnf 2)To generate CSR /opt/boksm/lib/openssl