Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

On 07/12/15 05:18, Jayalakshmi bhat wrote: > Hi All, > > Is there inputs or suggestions. Have you run the tests on this platform? i.e. "make test" I'm particular interested to know if the constant_time_test passed. Matt > > Thanks and Regards > Jaya > > On Fri, Dec 4, 2015 at 11:37 AM,

Re: [openssl-users] Question about TLS record length limitations

Ben, I'm pretty new to TLS, so please bear with me. I was thinking through what you said and I had a few questions. Couldn't you pull off the same DOS attack using the existing 16K message size today. The scale of the DOS attack would have to be larger as the packet size is smaller, but the

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

On 08/12/2015 11:57, Matt Caswell wrote: On 07/12/15 05:18, Jayalakshmi bhat wrote: Hi All, Is there inputs or suggestions. Have you run the tests on this platform? i.e. "make test" I'm particular interested to know if the constant_time_test passed. He can't. WinCE is not a self-hosting

Re: [openssl-users] OPENSSL_VERSION_NUMBER and TLSv1_1 & TLSv1_2 supports

On 07/12/2015 11:52, zosrothko wrote: Hi Jacob Le 18/09/2015 19:34, Jakob Bohm a écrit : On 18/09/2015 18:05, zosrothko wrote: Hi is there a way to know the supported TLS protocols from the OPENSSL_VERSION_NUMBER (specifically, the TLSv1_1 and TLSv1_2? For exemple, I have a code that is

Re: [openssl-users] Failed TLSv1.2 handshake

Hi Viktor, thanks very much for taking a look, my plan now is to experiment disabling ciphers until I figure out which one is causing some kind of mismatch in TLS_RSA_WITH_AES_256_GCM_SHA384 Unlikely to be the RSA so I'll poke at disabling the aes-gcm and sha384 respectively. BTW, the client

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

On 08/12/15 17:27, Jakob Bohm wrote: > On 08/12/2015 11:57, Matt Caswell wrote: >> On 07/12/15 05:18, Jayalakshmi bhat wrote: >>> Hi All, >>> >>> Is there inputs or suggestions. >> Have you run the tests on this platform? i.e. "make test" >> >> I'm particular interested to know if the

[openssl-users] force to use /dev/random for openssl fips module

I don't know how critical is the DEVRANDOM for openssl-fips, in e_os.h I saw this: #define DEVRANDOM "/dev/urandom","/dev/random","/dev/srandom" we have a hardware RNG that is feeding /dev/random via: /sbin/rngd -r /dev/hwrng -W 4000 so the /dev/random will never block, I

[openssl-users] openssl fipsalgtest

I'm trying to run the algorithm tests under linux for fips 2.0.10 + openssl 1.0.1e, using the fips-2.0-tv.tar.gz from openssl website, and saw quite some errors, anything am I missing? Thanks, xxiao perl fipsalgtest.pl --dir=/tmp/tv WARNING: unrecognized filename

Re: [openssl-users] Failed TLSv1.2 handshake

I had an offline exchange with someone who pointed out the Bignum bug in 1.0.2? (https://www.openssl.org/news/vulnerabilities.html#2015-3193) How does this bug manifest itself? In my context, some RSA-based connections (those with tslv1) seem to work. Could this be related? Nou Dadoun