Re: [openssl-users] command passwd

tual decision to use libmcrypt, libcrypto or any other library would probably be up to the maintainer of that lower system layer. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion me

Re: [openssl-users] Unexpected behaviors in TLS handshake

On 20/06/2018 23:07, Viktor Dukhovni wrote: On Jun 20, 2018, at 3:44 PM, Jakob Bohm wrote: I believe there is a fundamental concern, impossible to handle sanely at the CA policy level, that a CA may reasonably have certificate hierarchies targeting people with different maximum security

Re: [openssl-users] Unexpected behaviors in TLS handshake

or otherwise become viable. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedde

Re: [openssl-users] rsa_pss_pss_*/rsa_pss_rsae_* and TLS_RSA_*/TLS_ECDHE_RSA_*

-- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users mailing list

Re: [openssl-users] Windows 7 cryptbase.dll failing to load

dstone 4 Thus your 1.1.0 build runs on NT6.02 but not NT6.01, possibly due to references to NT6.02-only APIs Any suggestion on getting this to work on Windows 7? Has anyone else encountered this issue? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transform

Re: [openssl-users] Error compiling openssh with openssl

nSSL 0.9.8 forwarded those calls to the old FIPS validated implementation or just left the non-FIPS implementation available by accident. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussi

Re: [openssl-users] Selection of DHE ciphers based on modulus size of DH

" of an algorithm according to table 2 in this doc: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-57pt1r4.pdf <https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-57pt1r4.pdf> Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wis

Re: [openssl-users] PRNG is not seeded

locally. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl

Re: [openssl-users] PRNG is not seeded

opy out of various less-than-predictable hardware and OS states is what *all* non-hardware entropy gatherers ultimately do, from the Linux kernel's /dev/random mechanisms to haveged to what-have-you. Regards, Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com Transformervej

Re: [openssl-users] database openssl

are. Also note that unless a special setting is included (I forget where), the openssl ca database will be in a different (older) format that only remembers the most recently issued certificate for a given subject distinguished name. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A

Re: [openssl-users] SSLv3 error in Ubuntu/Apache2

should you set up a way to use SSLv3 on your web server. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service

Re: [openssl-users] Unable to install OpenSSL

anium processors (supported only on Windows Server 2008 and 2008 R2, with some historic support on old versions of Windows Server 2003 and Windows XP). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This p

Re: [openssl-users] get type of PEM data

IO interface if the application already has its own library for that (as many, but not all, network applications are likely to anyway). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion

Re: [openssl-users] renegotiate across exec()

rocess dedicated to doing encryption/decryption, thus completely shielding the keys (long term and short term) from any vulnerabilities in the data handling process. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13

Re: [openssl-users] c_hash/ca-certificates.crt

/share/ca-certificates/ are trusted unconditionally, no questions asked.  Due to bugs, you may have to run the command twice, with the same selections. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10

Re: [openssl-users] Loading CA from memory

: First allocate an empty STACK_OF X509 certificates Then loop over your in-memory CA certificates, passing each to d2i_X509, then adding the resulting X509 object to the stack. Finally pass that stack as the CA collection to an appropriate SSL_CTX function. Enjoy Jakob -- Jakob Bohm, CIO

Re: [openssl-users] Combining certificate and key in PEM format into a P12 file without knowing the key password?

pted private key could be kept without decrypting the private key, the password for the private key is still needed to encrypt the certificates with the same password. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 3

Re: [openssl-users] 回复： crash in `sha1_block_data_order_avx`

-- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users mailing list

Re: [openssl-users] mail encryption with ecdsa cert

://mta.openssl.org/mailman/listinfo/openssl-users Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management fo

Re: [openssl-users] CMAC Authentication

the normal memcmp() is wrong because it will reply quicker if the first byte(s) are wrong than if they are right).  The OpenSSL provides the a function CRYPTO_memcmp() that is good for this job. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg

Re: [openssl-users] How to enable Fixed Diffie Hellman key exchange mechanism

cannot use SSL_CTX_set_tmp_dh as this api is used for ephemeral Diffie Hellman key exchange. Please let me know where I am going wrong. I need to enable static DH in my application. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søbor

Re: [openssl-users] Can't build OpenSSL on Windows

iles (similar to GNU "cp --preserve=timestamps" ). This sometimes confuses build systems that assume file timestamps get updated when a file is copied into a build directory. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, De

Re: [openssl-users] Sudden control data sent during large transfer.

der of occurrence and direction of transmission)? Can you see what the "packets" are? For example, are they TLS alert messages? Are they TLS HelloRequest messages? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmar

Re: [openssl-users] Testing ports through firewall

keyout server.key -out server.pem -subj /CN=computer.example.com/O=test/C=US Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo -

Re: [openssl-users] Lattice Ciphers

On 19/12/2017 02:10, Colony.three via openssl-users wrote: On 18/12/2017 22:35, Colony.three via openssl-users wrote: PS, Jakob I'm getting on your email:  "This email has failed its domain's authentication requirements. It may be spoofed or improperly forwarded!" The reason

Re: [openssl-users] Lattice Ciphers

e the full headers, so I can debug? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for P

Re: [openssl-users] Lattice Ciphers

if other things go wrong first, upgrade when ready as a defense in depth. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo

Re: [openssl-users] ECC ciphers in OpenSSL and Citricom Patent/License terms

nSSL users will be in the same legal situation, and lawyers opinions on patent matters are frequently found by courts to be wrong anyway. Saying "in the distribution and website" is also quite vague and thus another example of a non-answer. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. ht

Re: [openssl-users] A question DH parameter generation and usage

e absurd. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-us

Re: [openssl-users] ECC ciphers in OpenSSL and Citricom Patent/License terms

invocation  of the regular OpenSSL ECC code in other scenarios, if so when and which. - Does CC/BB demand or not an additional patent license for use of the  regular OpenSSL ECC code for curves and or algorithms not standardized  in the NIST FIPS documents? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A

Re: [openssl-users] A question DH parameter generation and usage

ntents daily or weekly (overwriting the old parameters only after the new ones are ready).  The exim mail server does this if you follow the instructions. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13

Re: [openssl-users] FIPS certification for openssl

s is still OpenSSL that the world has known and loved for 20 years, or just some expensive imitation. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and m

[openssl-users] How do I run the OpenSSL library self-tests on embedded platforms

and those are used in the CE procedure). Regression testing is desired as I have done some fairly extensive patching to make the library code build for the targets. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 3

Re: [openssl-users] Automatically populating X509_STORE object cache from directory

Cert_Class_1_VA.pem . Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded

Re: [openssl-users] Help with making a SHA >1 certificate

ST=California, C=US/emailAddress=charl...@mcn.org, O=CZAGENT_Nov2017     Subject Public Key Info:     Public Key Algorithm: rsaEncryption     Public-Key: (2048 bit) While we’re at it, why doesn’t my –days 3650 seem to have any effect? Thanks! /Charles / Enjoy J

Re: [openssl-users] OCSP_BASICRESP_verify() in 1.1.0

ructures is internal to the inline implementation, not part of the interface. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remot

Re: [openssl-users] OpenSSL outputs entire CA bundle with libcurl

like it is debug output.  Did you by any chance configure or run curl with options to print lots of debug traces? Perhaps such an option is causing something to print each trusted CA cert as it is loaded into memory or checked. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://ww

Re: [openssl-users] OpenSSL outputs entire CA bundle with libcurl

from my host machine) Please clarify: - Is it being output to the network or to the terminal window where  curl is used? - Is it being output as shown (Base64 text with ending "=" signs and  a newline after each cert) or is it being output in another form  that you just describe

Re: [openssl-users] RSA-PSS Certificate

Identifier, maskGenAlgorithm mgf1SHA512Identifier, saltLength 20, trailerField 1 } -- Note: The saltLength should be 64, not 20, for --    rSSASSA-PSS-SHA512-param, see RFC4055 section 3.1 Enjoy Jakob -- Jakob Bohm, CI

Re: [openssl-users] OpenSSL engine and TPM usage.

, contrary to what would have been best security practice without this firmware bug. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo

Re: [openssl-users] Generating CSR based on an x25519 public key

. The x25519 public key has no certificate, it is randomly generated for each connection and signed with the RSA key from the certificate. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion

Re: [openssl-users] SSL_shutdown:shutdown while in init

att Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users mail

Re: [openssl-users] Query on API availability for openssl versions

e appropriate level in the > API so that we support it for the connections. Kindly provide your comments. You can set the security level via the cipher string using the special cipher string command "@SECLEVEL". For example to set all default ciphersuites at secu

Re: [openssl-users] Graceful shutdown of TLS connection for blocking sockets

On 09/10/2017 16:43, Thomas J. Hruska wrote: On 10/9/2017 7:29 AM, Jakob Bohm wrote: I suggest you find a good authoritative source for your claim that select() should not be used with blocking sockets. http://man7.org/linux/man-pages/man2/select.2.html Section BUGS: "Under Linux, s

Re: [openssl-users] Graceful shutdown of TLS connection for blocking sockets

sockets. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users

Re: [openssl-users] Openssl FIPS 186-4 Patch

nother algorithm that isn't used by many people yet to a FIPS module that is only used by the OpenSSL 1.0.x library that they are trying to discontinue. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This

Re: [openssl-users] Engine configuration

the engine code doesn't need to know or care about where that is. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Se

Re: [openssl-users] Storing private key on tokens

feature. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users

Re: [openssl-users] Integrating New Cipher Suite

clearing SSL_MODE_SEND_FALLBACK_SCSV (in a program), or (not) using the -fallback_scsv option to s_client? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding

Re: [openssl-users] How to increase the priority of some cipher ?

ES(128) Mac=SHA1 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD  but, after SSL_CTX_set_cipher_list(ctx, "RSA:ALL:!COMPLEMENTOFDEFAULT:!eNULL")  in my application, it didn't work, the first choice is still ECDHE-RSA-AES256-GCM-SHA

Re: [openssl-users] How can I sstart openssl ocsp in secure mode using TLS/SSL

central non-https OCSP responders is one of the few attacks that will reveal this without wiretapping the actual connection. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion messa

Re: [openssl-users] How can I sstart openssl ocsp in secure mode using TLS/SSL

Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users

Re: [openssl-users] Why wasn't the fix for IP name restrictions included in 1.0.2 ?

before 1.0.2 initial release. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones

[openssl-users] Why wasn't the fix for IP name restrictions included in 1.0.2 ?

rejects all such certificate chains. Why? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs

Re: [openssl-users] Why is this OCSP response reporting a hash using SHA1?

Also nice would be index.txt in SQL. Bob Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for P

Re: [openssl-users] SMIME -sign subcommand

make install Now debug the program in openssl-1.something-x86_64/bin/openssl (Sorry, I don't know how to tell XCode to debug a program already compiled with the XCode command line clang) Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søbo

Re: [openssl-users] openssl -check

On 07/09/2017 07:58, "Georg Höllrigl" wrote: *Gesendet:* Mittwoch, 06. September 2017 um 18:06 Uhr *Von:* "Jakob Bohm" <jb-open...@wisemo.com> *An:* openssl-users@openssl.org *Betreff:* Re: [openssl-users] openssl -check On 06/09/2017 16:18, "Georg Höllrigl&qu

Re: [openssl-users] Env variables in config file to add a whole line

"ecu" (has crl and ocsp, plus different settings again), etc. etc. Very different certificate purposes should ideally have their own SubCA's that can be managed differently, and have the CA cert restricted. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisem

Re: [openssl-users] openssl -check

joy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users ma

Re: [openssl-users] ASN1_TIME to time_t

r is 367 days, divide equally among 12 months, restart about 20 days before spring equinox, use a historic rounding rule represented by Y. Of cause with Roman numerals, they would have used (month - 2)). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29

Re: [openssl-users] Problem with Last step in setup

de are run. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-

Re: [openssl-users] Cant get openssl x509 to work as documented

prevent use of DER for a file, it can be converted on the fly, storing the converted file in RAM (using tmpfs or similar). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message

Re: [openssl-users] Using set_serial to control serial number size directly

between code size (to do the conversion) and data size (to store the certificate). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo

Re: [openssl-users] Cant seem to get prompt no to work

e to find the one that has ENV in it. I DO have an example of one such to use... Given all these problems with the Distinguished Name prompting mechanism, just add the -subject option to the req command line (using appropriate environment variables in the shell script). Enjoy Jakob -- Jakob Bohm, CI

Re: [openssl-users] Personal CA: are cert serial numbers critical?

t FOREMAIL=m...@example.com export FORUSER="Moe Madman" export CERTFN=moe openssl req -config /etc/cacfg/ca2017-mail.conf -newkey rsa:3072 -keyout ${CERTFN}.key -out ${CERTFN}.csr Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860

Re: [openssl-users] Personal CA: are cert serial numbers critical?

r program). I would recommend to also implement traditional CRLs, since for smaller CAs it is a better solution for browsers and servers that support it. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 3

Re: [openssl-users] Displaying subjectAtlName othername content

On 14/08/2017 21:38, Robert Moskowitz wrote: On 08/14/2017 03:28 PM, Jakob Bohm wrote: On 14/08/2017 20:55, Robert Moskowitz wrote: On 08/14/2017 02:04 PM, Salz, Rich via openssl-users wrote: ➢ Is there anyway to display the basic ASN.1 structure here so I can see what was stored

Re: [openssl-users] Displaying subjectAtlName othername content

. However it requires that you convert from Base64 to binary before calling it. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo

Re: [openssl-users] How to get a bye or word from BIGNUM in OpenSSL 1.1?

On 02/08/2017 09:47, Jeffrey Walton wrote: On Wed, Aug 2, 2017 at 12:38 AM, Jakob Bohm <jb-open...@wisemo.com> wrote: On 02/08/2017 04:21, Jeffrey Walton wrote: I'm trying to extract the low-order byte or word from a BIGNUM in OpenSSL 1.1. We were told to use BN_bn2binpad, but its not

Re: [openssl-users] How to get a bye or word from BIGNUM in OpenSSL 1.1?

you *all* the bytes in the number in a buffer of you own. You can then extract the bytes from there. If you care mostly about the least significant bytes, using BN_bn2lebinpad may be easier than BN_bn2binpad, as the least significant bytes will be first, not last, in the result. Enjoy Jakob -- Jako

Re: [openssl-users] Considering C# OpenSSL openssl-net-master

joy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded -- openssl-users ma

Re: [openssl-users] Default key length of DH/DHE/ECDH/ECDHE

there is no default other than what the application (in this case OpenVPN) sets. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

the resulting program/dll to make sure there are no other C runtime differences causing trouble. P.S. I kind of wonder what in the fips canister uses wcsstr(), but since that cannot be changed while retaining the FIPS validation status, that's just curiousness. Enjoy Jakob -- Jakob Bohm, CIO, P

Re: [openssl-users] [ssllabs-discuss] Apache configuration

OpenSSL version loaded elsewhere in the process? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Mana

Re: [openssl-users] Rejecting SHA-1 certificates

in depth. Of cause adding this in OpenSSL itself would have to be configurable for situations partially outside the public trust environment, such as talking to IoT devices with old crypto libraries and rechecking/decrypting S/MIME mails received years ago. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo

Re: [openssl-users] Rejecting SHA-1 certificates

On 12/07/2017 07:23, Viktor Dukhovni wrote: On Wed, Jul 12, 2017 at 02:02:31AM +0200, Jakob Bohm wrote: I don't think a state is really needed for this, if the callback simply checks if the certificate is in the loaded trust collection, and/or if it is self-signed (depending

Re: [openssl-users] Rejecting SHA-1 certificates

the certificate is in the loaded trust collection, and/or if it is self-signed (depending on the application's chosen root CA trust model). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussio

Re: [openssl-users] openssl 1.0 and 1.1 co-exist

) for the different versions are not on the same machines, only the compiled binaries. For this simplified scenario (only one set of headers etc. per system), self-compiled OpenSSL simply goes in /usr/local with no use of Rpath. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https

Re: [openssl-users] newer openSSL no longer produce libeay32 on Windows?

On 08/06/2017 20:26, Ludwig, Mark wrote: From: Jakob Bohm, Thursday, June 08, 2017 12:32 PM On 08/06/2017 18:48, Baojun Wang wrote: Also on Windows (64-bit), openssl produces libssl-1_1-x64.dll as well as libcrypto-1_1-x64.dll, this could be painful for application who has to specify openssl

Re: [openssl-users] newer openSSL no longer produce libeay32 on Windows?

bit, Itanium, AMD x86_64, 64 bit ARM). Microsoft did some crazy experiments with a directory scheme called SxS for versioned DLLs, its badly done and should be avoided if possible. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark.

Re: [openssl-users] CSR with multiple subject names?

5 SomeCity, ST=SomeState, C=US) Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones an

Re: [openssl-users] Cannot find SSL_CTX_get0_param in libssl library

hole point of the versioned .so file names. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for P

Re: [openssl-users] sha256 digest support in v102l build missing; present in v110f. missing build flag?

r the 102l build. Is there an additional, specific flag required to enable the higher bit-depth digests for v102l that I've missed. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion mess

Re: [openssl-users] OpenSSL and RPATH's (was: Cannot find SSL_CTX_get0_param in libssl library)

compiled against version 1.0.1t headers), then you may also need a special SO name or RPATH to link locally compiled software against the latest 1.0.x release, rather than 1.0.1 . RPATH support is nice for corner cases, but it should not be the default, ever. Enjoy Jakob -- Jakob Bohm, CIO

Re: [openssl-users] automating my CA

. And the LetsEncrypt code is open source. I think he wants the server side, and maybe not for DV certs. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors

Re: [openssl-users] gpgsm/openssl cms detached signatures verification fails

openssl cms/gpgsm compute the sha256sum differently in the detached case. Is there a hidden flag to make either tool behave like the other? Look at the documentation of the openssl cms "-inform SMIME", "-outform SMIME" and "-binary" options. Enjoy Jakob -- Jakob

Re: [openssl-users] Dumb question about DES

3 ECDH-ECDSA-DES-CBC3-SHA 192.18 ECDHE-RSA-DES-CBC3-SHA 192.8 ECDHE-ECDSA-DES-CBC3-SHA Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and

Re: [openssl-users] forking server question

that N processes, and understand why this should be a FAQ. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2860 Soborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service

Re: [openssl-users] Is there a "Golden" CA makefile?

the branch you're adminning from. (*) Of course, there *are* other techniques to work around the problem, but.) Not as much "defeat", as setting the relevant option by adding the following command during CA (and SubCA) setup: echo "unique_subject = no" > ${CADIR}/db/index.a

Re: [openssl-users] AES-256 Do I need random IV?

sing a key based on a password. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones an

Re: [openssl-users] How do I connect to this server

I specify this username and password when using SSL_connect()? You don't. That stuff is at the protocol level about TLS/SSL. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussio

Re: [openssl-users] Certificate chain validation

related function as a list of untrusted additional certificates, which the certificate verification code can search for needed intermediate certificates. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10

Re: [openssl-users] SSL_shutdown return error when close in init

e abort flag. Similarly if the protocol is waiting for a handshake record from the other end, it would continue that wait, then abort just before processing either a received handshake or a protocol error (such as lost connection). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.w

Re: [openssl-users] SSL_shutdown return error when close in init

: To make the "SSL_shutdown" call "just work" from an application perspective, and to minimize security exposure after the call has been made (e.g. in case some application level code decides the other end is probably malicious). Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseM

Re: [openssl-users] SSL_shutdown return error when close in init

nsmissions. In other words, returning appropriate errors/alerts to the other end according to the handshake step. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-bindi

Re: [openssl-users] Multithreading: Global locks causing bottleneck in parallel SSL_write calls

rrent TLS versions handle padding and IV management, not issues with CBC itself. Also note that GCM is very much a "marginal" design, operating at the very edge of what is safe to do and furthermore putting all the cryptographic "eggs" in one basket (AES and GF-2^n arithmetic).

Re: [openssl-users] OCSP Responder Running on Localhost using the Source Code..!

w do i use the available openssl source code which is present in C language to implement the OCSP responder function. Please help me with this as i am very new to openssl and OCSP concepts. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søbor

Re: [openssl-users] openssl verify with 1B certificates

is approach I feel like verifying the signature would be a big challenge. Any ideas on how I can tackle these problems? -- Jakob Bohm, CIO, partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Soborg, Denmark. direct: +45 31 13 16 10 <tel:+4531131610> This mess

Re: [openssl-users] OpenSSL sending close_notify right afterresponding to a heartbeat request

penSSL is doing. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedd

Re: [openssl-users] Static FIPS Library with Address Randomization

On 21/03/2017 16:06, Steve Marquess wrote: On 03/21/2017 10:17 AM, Jakob Bohm wrote: On 21/03/2017 14:02, Michael Wojcik wrote: From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of William A Rowe Jr Sent: Monday, March 20, 2017 20:59 To: openssl-users@openssl.org Subject

<    1   2   3   4   5   6   7   8   9   10   >