Re: [openssl-users] OpenSSL 1.1.0 assertion failure: ssl_free_wbio_buffer()

On 16/04/18 09:19, marcus.schafheu...@gmx.de wrote: > SSL_set_bio(ssl, NULL, NULL); // free BIOs when finished There should be no reason to do this. The BIO's will get freed automatically by the SSL_free() call. > Is this a faulty behavior of OpenSSL 1.1.0 or is the fault on my side?  This

Re: [openssl-users] Open ssl error "hex string is too long invalid hex key value"

On 12/04/18 07:05, shagun maheshwari wrote: > Hi, > > We are getting an error "OpenSSL error hex string is too long invalid hex key > value" . OpenSSL version we are using is openssl-1.0.2k-8.el7. We have solved > this issue by applying a patch in openssl package suggested by openssl >

Re: [openssl-users] DTLS with multiple clients

On 06/04/18 00:19, Varun Kulkarni wrote: > > > On Thu, Apr 5, 2018 at 4:03 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 05/04/18 23:37, Varun Kulkarni wrote: > > > > > Thanks for the

Re: [openssl-users] DTLS with multiple clients

On 05/04/18 23:37, Varun Kulkarni wrote: > > Thanks for the reply Matt. Previosuly , I did the exact thing you > mentioned. But in that case , the DTLSV1_listen returns succesfully (> > 0) immediately on reception of > app packet and hangs on SSL_accept. > > Here is tshark trace of the same:

Re: [openssl-users] DTLS with multiple clients

options(ssl, SSL_OP_COOKIE_EXCHANGE); > > /* Wait for incoming connections */ > while (!DTLSv1_listen(ssl, _addr)); > > /* connect to client on different fd and complete the handshake and > process data packets */ > > } > > > > > Thanks, > Varun

Re: [openssl-users] AES-GCM cipher in TLS

On 05/04/18 18:35, PS wrote: > Thanks Matt. > > I did read those RFC as well. And here is the confusion. The RFC5116 > says this section 2.1 > > There is a *single output:* > > A ciphertext C, which is at least as long as the plaintext, or > > an indication that the requested

Re: [openssl-users] AES-GCM cipher in TLS

On 05/04/18 05:12, PS wrote: > I am trying to decrypt TLS 1.2 records that is using the > TLS_AES_128_GCM_SHA256 cipher-suite using openssl's EVP API. > > Per RFC 5246, decryption needs 4 inputs. > " > >In order to decrypt and verify, the cipher takes as input the key, >nonce, the

Re: [openssl-users] DTLS with multiple clients

Are you able to share a simple reproducer of your problem? Matt On 05/04/18 02:14, Varun Kulkarni wrote: > Hi, > > I was able to get DTLS work with the latest version of openssl with a > single client and server. However, I was unable to get it to work with > multiple clients. The first client

Re: [openssl-users] make test failure OpenSSL 1.0.2o

On 04/04/18 16:38, Jerry L wrote: > Compiled OpenSSL on AIX 7.1.5.2 using gcc, I used the same Configuration > options that I have been using for 5 years: > >     Configure aix-gcc zlib fips shared > > When running make test, I am getting the following: > >  test_bad_dtls > >    

Re: [openssl-users] Unable to select NULL or NULL-MD5

On 29/03/18 00:14, Eric Jacksch wrote: > Greetings, > > I'm using OpenSSL for testing and recently compiled 1.1.0g and h. I'm > seeing the same behaviour in both.  > > openssl ciphers -v list the NULL ciphers, but when I try to use NULL or > NULL-MD5 I get the same result:  No ciphers

Re: [openssl-users] get type of PEM data

Take a look at the new STORE functions in 1.1.1. They do something like what you are describing. They can take a URI and load whatever objects it finds there using the right kind of loader based on the PEM type. You can also search for particular objects in your store. See:

Re: [openssl-users] ed25519 key generation

On 26/03/18 13:58, Salz, Rich via openssl-users wrote: > For RSA it's the ASN1 sequence of the key. For Ed25519 it's just the 40 > bytes of the raw key. > > Note that for Ed25519 the raw public key is 32 bytes not 40. Matt -- openssl-users mailing list To unsubscribe:

Re: [openssl-users] ed25519 key generation

On 25/03/18 12:46, Jeremy Harris wrote: > On 25/03/18 02:05, Viktor Dukhovni wrote: >>> Is there a way yet to get the raw public-key out, >>> documented or not? As you may guess, this is for DKIM. >> >> Not sure what format DKIM wants the key in, but if it is SKPI >> in base64 form > > It is

Re: [openssl-users] File signing/encrypting upgrade from 1.0.2 to 1.1.0

On 23/03/18 17:03, Jan Kohnert wrote: > Hello, > > I'm using the openssl-libs for signing/encrypting files in PKCS#7 > format. When trying to upgrade from 1.0.2 to 1.1.0 the code stops > working properly: Files are generated, but the formating is broken. > When trying to decrypt the generated

Re: [openssl-users] File signing/encrypting upgrade from 1.0.2 to 1.1.0

Your minimal working example only does the encrypt side. Please could you show the decrypt side too that demonstrates the error. Matt On 23/03/18 18:25, Jan Kohnert wrote: > Hi again, > > Am Fri, 23 Mar 2018 18:03:17 +0100 > schrieb Jan Kohnert : > >> I'm using

Re: [openssl-users] Windows shared libraries version information needs some fixes

On 21/03/18 09:36, Matt Caswell wrote: > > > On 21/03/18 00:45, RTT wrote: >> Hello, >> >> Building the shared libraries (version 1.1.1 pre 3) for Windows with >> Visual Studio, targets VC-WIN32 or VC-WIN64A, result in DLLs with >> version inform

Re: [openssl-users] Windows shared libraries version information needs some fixes

On 21/03/18 00:45, RTT wrote: > Hello, > > Building the shared libraries (version 1.1.1 pre 3) for Windows with > Visual Studio, targets VC-WIN32 or VC-WIN64A, result in DLLs with > version information with outdated copyright date, i.e. "Copyright > 1998-2016 The OpenSSL Authors. All rights

[openssl-users] Forthcoming OpenSSL releases

Forthcoming OpenSSL releases The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.1.0h and 1.0.2o. These releases will be made available on 27th March 2018 between approximately 1300-1700 UTC. These are security-fix releases.

Re: [openssl-users] EVP signing

On 14/03/18 09:20, Federico Buti wrote: > Hi list. > > I'm currently implementing a signing routine and for that I'm using the > high-level API EVP according to this page > . I'm > using openssl 1.0.2m. > > I need to sign with

Re: [openssl-users] how to control the cipher list of an openssl server

On 12/03/18 22:53, Chris Bare wrote: > I have a fairly basic server set up based on various examples I've seen. > > I run an nmap script I found against it and see only 16 ciphers listed, > none of which are supported by modern web browsers. > Yet when I run "openssl ciphers I get a list of 97.

Re: [openssl-users] Compilation error in ssl/t1_trce.c

On 12/03/18 18:39, Erik Forsberg wrote: > > There are missing comma's in ssl/t1_trce.c that causes compilation to fail. > You have to configure with enable-ssl-trace to see it though. > > gcc -I. -Iinclude -I../src -I../src/include -fPIC -std=gnu90 -march=core2 > -Wall -O3

Re: [openssl-users] Need help regarding openssl errror

On 08/03/18 13:14, binod kumar via openssl-users wrote: > Hello openssl users, > > Need you help understanding the openssl error > "*error:140760FC:lib(20):func(118):reason(252)*".  I am using SSL server > on Windows machine and am successfully able to connect and make requests > to this server

[openssl-users] Looking for Christophe Renou

Hi all As many of you know we are looking to change the licence for OpenSSL to the Apache Licence. To do that we are trying to trace all previous committers. We have a small number of people left to find. See: https://license.openssl.org/trying-to-find Of these one stands out as being a

Re: [openssl-users] x509: recent change in Subject and Issuer printing?

On 04/03/18 02:22, Adam Shannon wrote: > Was there a change included in the 1.1.0 series which prints names > differently? I've looked, but been unable to narrow down what in > specific changed. This was changed by commit f1cece554d. The default "nameopt" setting for the x509 app (and a few

Re: [openssl-users] compiling cups-1.4.3 w/ OpenSSL 1.10 && BIO_METHOD

On 01/03/18 12:07, Matthias Apitz wrote: > > Hello, > > Compiling cups-1.4.3 against OpenSSL 1.10 gives the following error: > > ... > Compiling http.c... > http.c:216: error: variable `http_bio_methods' has initializer but > incomplete type > > the code in question is: > > #if

Re: [openssl-users] Is EVP_BytesToKey() still recommended ?

On 26/02/18 01:15, pratyush parimal wrote: > Hi everyone, > > I'm trying to find a way to convert a string password to an AES-256 > encryption key. I came across EVP_BytesToKey(), but the man-page says at > the end: > > "Newer applications should use a more modern algorithm such as PBKDF2 as >

Re: [openssl-users] c_hash/ca-certificates.crt

On 23/02/18 14:06, e...@coderhacks.com wrote: > Hello! > > Normally I put new certificates into /etc/ssl/certs and create the > hash-link. > That workes for me for many years. > > > Just found out 2 new things agout that. > > 1. There is c_hash that does the creation of the hash-link for me.

Re: [openssl-users] DTLS server records repeated

On 21/02/18 21:38, Michael Richardson wrote: > > I'm capturing from my DTLS client and server, with CoAP running on top. > I've been debugging some ruby-level I/O buffering issues. > I noticed this while capturing, and used tshark to get this print out. > (I've added columns for port numbers) >

Re: [openssl-users] compilation error with openssl-1.1.0 and DH_get0_key

On 21/02/18 16:20, Benjamin Kaduk via openssl-users wrote: > On 02/21/2018 10:16 AM, Robert Watson wrote: >> I'm trying to update a crypto library for crtmpserver to work with >> openssl 1.1.0.  The software is no longer actively maintained and my >> c++ skills are somewhat rudimentary but I

Re: [openssl-users] OpenSSL Version Definitions Issue on ARM

On 21/02/18 01:19, Andrei Danaila wrote: > Any insight would be greatly appreciated. > All OpenSSL versions before 1.1.0 provide no symbol version information. However Debian distribute a patched version of OpenSSL that adds this - so this is why you will see a difference between your system

Re: [openssl-users] Programmatic key conversion of PKCS#1 to #8

On 16/02/18 17:24, Gelareh Taban wrote: > Hi all, > > I need to convert a Json Web Key (JWK) to PEM PKCS#8 format. > > I am using creating an RSA key using the parameters in JWK and then > using i2d_RSAPublicKey() to  encode the RSA key to PEM PKCS#1.  > > Are there any OpenSSL functions that

Re: [openssl-users] TLS 1.3 PSK test server setup

On 15/02/18 16:38, Viktor Dukhovni wrote: > > >> On Feb 15, 2018, at 10:47 AM, Matt Caswell <m...@openssl.org> wrote: >> >> TLSv1.3 PSKs are very different to TLSv1.2 PSKs. In TLSv1.3 they are >> effectively the same thing as a session (they

Re: [openssl-users] TLS 1.3 PSK test server setup

On 15/02/18 15:33, Viktor Dukhovni wrote: > > >> On Feb 15, 2018, at 9:57 AM, Matt Caswell <m...@openssl.org> wrote: >> >> As pointed out by Hubert in #5378 this is in accordance with the >> recommendations in the spec: >> >> "Implemen

Re: [openssl-users] TLS 1.3 PSK test server setup

On 14/02/18 23:33, Viktor Dukhovni wrote: > > >> On Feb 14, 2018, at 6:14 PM, Matt Caswell <m...@openssl.org> wrote: >> >> For a PSK to be used in needs to be the correct length for the selected >> ciphersuite. The ciphersuite is selected *first*. Next the

Re: [openssl-users] error (openssl-1.1.0g)

On 15/02/18 08:52, Sakuma, Koshiro wrote: > Hi, Rich, > > Here is the result.  However, I tried to do the "config" with normal > user and I got an error like you don't have permission.   > You have any ideas??   > > #   Failed test 'Testing that we aren't running as a privileged user, > such

Re: [openssl-users] Explicit IV in TLS 1.1+

9c, 7c] > 04:09:47.779 Decrypted: [f1, 4e, b3, 18, 26, d7, ae, 12, bf, 5d, fe, > 2a, 18, a1, 6f, 19, 60, 73, 26, c8, 74, 7c, c6, a6, a1, 65, d3, ad, > 45, f9, e3, 42, aa, e0, bd, 1d, a0, 18, b3, f3, 94, 28, 4e, 2a, ca, > 24, 25, 70, 7c, a9, f6, 19, 17, f5, ef, ee, b, 30, 2f, ec, 4d,

Re: [openssl-users] Openssl 1.1 / TLS 1.3

On 14/02/18 17:28, Richard Moore wrote: > > > On 14 February 2018 at 16:34, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 14/02/18 16:27, Richard Moore wrote: > > If I run the following: > &g

Re: [openssl-users] error (openssl-1.1.0g)

Did you run "make test" as root by any chance? There is a known issue where this test fails if you run it as root (fixed in git by commit b15e62ecc). Matt On 14/02/18 21:33, Sakuma, Koshiro wrote: > Hi, Team, > > I'm trying to install openssl-1.1.0g on my CentOS7, but I've gotten > error during

Re: [openssl-users] TLS 1.3 PSK test server setup

On 14/02/18 19:39, Hubert Kario wrote: > How to start current master branch OpenSSL so that it will support static PSK > key exchange in TLS1.3? > > with client running as: > openssl s_client -psk > > > I've tried: > openssl

Re: [openssl-users] Openssl 1.1 / TLS 1.3

On 14/02/18 16:27, Richard Moore wrote: > If I run the following: > >  openssl-1.1.1pre1 ciphers -tls1_3 -v The man page says this about the "-tls1_3" option: "In combination with the B<-s> option, list the ciphers which would be used if TLSv1.3 were negotiated." So you need to add "-s". If

Re: [openssl-users] Explicit IV in TLS 1.1+

On 13/02/18 22:02, Curt Johansson wrote: > Hi all, > > I'm developing support for TLS 1.1 and 1.2 in a radius-server that until now > only handles TLS 1.0. I'm testing with a testtool that the vendor says is > using OpenSSL to implement the TLS support. It all seems to work except for > the

Re: [openssl-users] OpenSSL 1.1.1 pre-release 1 build failure

On 13/02/18 21:06, Norm Green wrote: > This is on Ubuntu 16.04with a build configured to be debug-linux-x86_64 > > normg@moop>gmake > make depend && make _all > make[1]: Entering directory > '/export/moop3/users/normg/gs64-3xm1/slow50/openssl_1.1' > make[1]: Leaving directory >

Re: [openssl-users] Creating a Json Web Key

On 08/02/18 19:42, Angus Robertson - Magenta Systems Ltd wrote: >>> I've not yet found any helpers for getting n and e any other way. >> RSA_get0_key()? > > Perfect, should have been able to find that myself... > > If there an equivalent for EC_GROUP to get x and y? Do you mean for an

Re: [openssl-users] Creating a Json Web Key

On 08/02/18 18:17, Angus Robertson - Magenta Systems Ltd wrote: > I need to create a Jose JWK from the public part of a private key in a > PEVP_PKEY, with 1.1.0. > > I've done it using the old struct rsa_st from 1.0.2 and > EVP_PKEY_get1_RSA, and then converting the n and e BIGNUMs to binary

[openssl-users] TLSv1.3 blog post

FYI, I reposted my TLSv1.3 blog post from last year, but updated with the latest information. You can read it here: https://www.openssl.org/blog/blog/2018/02/08/tlsv1.3/ Matt -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Lock for SSL_accept method

On 08/02/18 00:43, Yan, Bob via openssl-users wrote: > I used a mutex lock to prevent the SSL_accept() method being called by > multiple thread concurrently since it may get coredump if there is no > lock on SSL_accept() method. I am just wondering is the lock is still > needed for openssl

Re: [openssl-users] Low level AES alternative in FIPS-140 OpenSSL

On 03/02/18 08:13, Alex Dankow via openssl-users wrote: > Greetings! > > You probably know that low level AES function AES_set_encrypt_key is > disabled in FIPS 140-2 module. Instead it is offered to use EVP_ > set of functions. > > We develop transparent database encryption for SQL Server and

Re: [openssl-users] Release Strategy

On 25/01/18 14:07, REIX, Tony wrote: > Hi, > > We (ATOS BullFreeware project) are building and delivering OpenSSL on > AIX. However, there are different providers of OpenSSL on AIX (IBM > AIX project, Perzl, Bull Freeware, IBM AIX Toolbox), and we have some > compatibility issues when mixing

Re: [openssl-users] Next LTS version

On 17/01/18 09:27, Saul Dickinson wrote: > Thanks Rich. That means there's not even any indication of when there > might be something to say? > > Even just an indication of when the decision might be taken would be > helpful at this stage. We are committed to specifying a release as LTS at

Re: [openssl-users] Multiple reconnection in OpenSSL 1.1.0

On 16/01/18 16:22, Huy Cong Vu wrote: > Ok the call for SSL_clear() apparently works. Thanks a lot. > To make the code clean, I will re-instantiate SSL object for each connection. > I do not have any specific reasons to keep SSL object alive after each > connection. It just that I do not want

Re: [openssl-users] Multiple reconnection in OpenSSL 1.1.0

On 16/01/18 15:27, Huy Cong Vu wrote: > Here is any traffic transfer between my clients and server from the beginning > to the 1st failed SSL_read(): > https://pastebin.com/raw/Bjixearh > > IP src: 192.168.1.4 > IP dest: 192.168.1.121 > > I'm not sure the version I pasted have enough

Re: [openssl-users] Multiple reconnection in OpenSSL 1.1.0

On 16/01/18 15:15, Huy Cong Vu wrote: >> - A wireshark trace of the communication between the two endpoints might >> be helpful to figure out what is going wrong > > ERR_print_errors_fp() before call of SSL_read returns nothing, which should > be a good new... > By browsing Wireshark, I jump

Re: [openssl-users] Multiple reconnection in OpenSSL 1.1.0

On 16/01/18 13:35, Huy Cong Vu wrote: > Thanks for the advice, I got these as error: > 1408F10B:SSL routines:ssl3_get_record:wrong version > number:ssl/record/ssl3_record.c:210 > 1408F119:SSL routines:ssl3_get_record:decryption failed or bad record > mac:ssl/record/ssl3_record.c:375 > > Does

Re: [openssl-users] Multiple reconnection in OpenSSL 1.1.0

On 16/01/18 10:31, Huy Cong Vu wrote: > OpenSSL_add_all_algorithms(); > SSL_load_error_strings(); You do not need to make the above two calls in 1.1.0. They are called automatically. > //Setup curves parameters > EC_KEY *ecdh = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1); >

Re: [openssl-users] OpenSSL error message when decrypting Ethereum encrypted private key

On 14/01/18 15:26, Chris B wrote: > I'm trying to help someone recover his password for an older format > ethereum encrypted private key (EPK). My plan has been to use his best > guess at the password to brute force the actual password. > > The EPK is a 132 character string, and it looks

[openssl-users] OpenSSL wins the Levchin prize

Today I have had great pleasure in attending the Real World Crypto 2018 conference in Zürich in order to receive the Levchin prize on behalf of the OpenSSL team. More details are available in my blog post here: https://www.openssl.org/blog/blog/2018/01/10/levchin/ Matt -- openssl-users mailing

Re: [openssl-users] Issue on DTLS over UDP

t is a negative scenario setup on configuration. > Thanks, > Grace > > > On Fri, Jan 5, 2018 at 4:28 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 05/01/18 05:30, Grace Priscilla Jero wrote: > > Hi Matt, &g

Re: [openssl-users] Issue on DTLS over UDP

. Is this a deliberate choice or a mis-configuration? Matt > > yes, the SSL_get_error() gives 2. > The alert is sent but ignored. > > Thanks, > Grace > > On Wed, Jan 3, 2018 at 4:23 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: >

Re: [openssl-users] Issue on DTLS over UDP

On 03/01/18 10:40, Grace Priscilla Jero wrote: > Hi, > Can someone please respond to the below mail as we want to confirm if it > is an issue with our application or a bug in openSSL. It isn't a known bug (which doesn't mean it isn't an unknown bug!). I think we're going to need some more

Re: [openssl-users] Padding for RSA signatures

Some comments inserted below. Matt On 29/12/17 15:20, Gelareh Taban wrote: > Hi all, > > Any help would be *much* appreciated. I am playing around with RSA > signatures with different padding options and I have some questions. > > I am trying to define different padding options and so am

Re: [openssl-users] FW: Help to understand WPACKET API

On 19/12/17 13:43, Sai Teja Chowdary wrote: > After going through the code I understand the new tls1.3 implemented > OpenSSL code is using WPACKET API to frame the records. I need help in > understanding what the following functions do. I am new to the mailing > list, thanks in advance. > >   >

Re: [openssl-users] "make test" error for release 1.0.2n

On 07/12/17 16:55, Porter, Andrew wrote: > My "make test" for today's 1.0.2n release is getting an error at the very > last (I think) > "test_bad_dtls" step. This is FIPS-enabled, built with the 2.0.12 FIPS > module. With the > Previous 1.0.2m release the "test_bad_dtls" step silently

Re: [openssl-users] VS2017 15.5 hangs indefinitely with Blake2b.c

On 07/12/17 04:38, Oliver Niebuhr wrote: > BTW: It turned out that the VS SSA-Optimizer is at fault here! After > disabling it with '/d2SSAOptimizer-' blake2b.c compiles fine. > > Seems like a Bug with this Tool Set Version. > > I created a BR: > https://github.com/openssl/openssl/issues/4859 >

Re: [openssl-users] VS2017 15.5 hangs indefinitely with Blake2b.c

On 06/12/17 08:24, Oliver Niebuhr wrote: > Hello. > > I am not sure if it is a VS Compiler Bug or a Bug in OpenSSL. > > When the Compiler reaches 'Blake2b.c', it creates the 'Blake2b.obj' and > then hangs indefinitely. > > CPU usage for CL stays at 27-28 Percent. Used RAM stays at 34-35

[openssl-users] Forthcoming OpenSSL release

Forthcoming OpenSSL release === The OpenSSL project team would like to announce the forthcoming release of OpenSSL version 1.0.2n. There will be no OpenSSL 1.1.0 release at this time. This release will be made available on 7th December 2017 between approximately 1300-1700

Re: [openssl-users] DTLS in multi-thread and concurrent connection acceptance environment

On 28/11/17 14:01, Anand Choubey via openssl-users wrote: > But I do not know, whether DTLSv1_Listen/SSL_accept in the listener > thread is capable to deal with thousands concurrent connection > establishment. Is there known limitation around it?  I don't know if anyone has ever created any

Re: [openssl-users] Compatibility between different openssl versions

On 27/11/17 08:47, Sanjaya Joshi wrote: > Hello, > Whether openssl 1.0.x and 1.1.x can interwork ? > That is, whether TLS client on top of openssl 1.1.x and TLS server on > top of openssl 1.0.x (or vice versa) can interwork efficiently ? Yes - absolutely. Matt -- openssl-users mailing list

Re: [openssl-users] Non const input for EVP_EncryptUpdate and EVP_DecryptUpdate

This is a bug in the docs. In the header files they are declared as const: int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,

Re: [openssl-users] Apparent Memory Leak When Executing EVP_PKEY_derive (MS vc14, 32 bit, OpenSSL 1.0.2h/m)

Before you close your application down try calling: CRYPTO_cleanup_all_ex_data() See: https://wiki.openssl.org/index.php/Library_Initialization#Cleanup The whole dance around init/de-init of the library becomes a whole lot easier in 1.1.0 (it should all happen automatically) - but in 1.0.2 you

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

nt from SCTP. > "dtls_wait_for_dry" always returns "WORK_MORE_A". Hereafter flow > never enters "read_state_machine" where alert is to be red.This > causes SSL_Connect to be in infinite loop. > > > Thanks, > Mahesh G S > > On F

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

On 17/11/17 06:42, mahesh gs wrote: > Why > does client respond with "Client key exchange" even if the the handshake > failure alert is sent from server? The client will send its entire flight of messages before it attempts to read anything from the server. So, in this case, the

Re: [openssl-users] Supported cipher suites

On 16/11/17 07:00, Viktor Dukhovni wrote: > In the upcoming TLS 1.3 the ciphers are completely different from > previous versions, and configuration via cipher strings was not > implemented last I looked. This may have changed... You have always been able to configure the TLSv1.3 ciphers via

Re: [openssl-users] Supported cipher suites

On 15/11/17 06:08, Grace Priscilla Jero wrote: > Hi All, > Do we have the exact list of cipher suites supported by default in > openssl for each of the below in 1.1.0g version of openSSL. > > TLS 1.0 > TLS 1.1 > TLS 1.2 > DTLS 1.0 > DTLS 1.2 You can use the command line "ciphers" command for

Re: [openssl-users] Deactivation of client renegotiation particularily in OpenSSL 1.1.0

On 14/11/17 09:40, marcus.schafheu...@gmx.de wrote: > Hello, >   > I am referring to the DoS via repeated SSL session renegotiations > (http://kalilinuxtutorials.com/thc-ssl-dos/). >   > Prior to OpenSSL 1.1.0 the approach to deactivate client renegotiation > was to set the corresponding flag

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

On 14/11/17 10:44, mahesh gs wrote: > case SSL_ERROR_SYSCALL: > > if (EWOULDBLOCK == errno || EAGAIN == errno) > { >   /* Nothing to do, retry to connect again */ > } This doesn't look right. If SSL_connect() fails due to an NBIO event then you should get SSL_ERROR_WANT_READ or

Re: [openssl-users] Same library usage for DTLS on SCTP and UDP

ble in the latest 1.1.0g release, so please upgrade. Matt > > Thanks, > Grace > > On 13-Nov-2017 4:02 PM, "Matt Caswell" <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 13/11/17 06:48, Grace Priscilla Jero wrote: &

Re: [openssl-users] Same library usage for DTLS on SCTP and UDP

On 13/11/17 06:48, Grace Priscilla Jero wrote: > Hi, > > We are using openssl library for UDP and SCTP connections. The library > is compiled with "sctp" option. But when it is used for DTLS on UDP the > connection hangs at SSL_accept. > > When we remove the sctp option in compilation, the

Re: [openssl-users] Potential memory leak in RSA_private_decrypt

On 08/11/17 09:47, Wang wrote: > Hello Matt, > > Thank you for trying to help. > Is this the "bottom" of the OpenSSL stack? i.e. your application calls RSA_private_decrypt() directly? > Yes, it does. > Do you share a single RSA object across multiple threads? > Yes, my

Re: [openssl-users] Potential memory leak in RSA_private_decrypt

On 07/11/17 10:01, Wang wrote: > Hello Rich, > > Thank you for trying to help. > > My product is running on Linux. The following leak was detected by Valgrind. > Valgrind only reportes > the leak in threaded mode. I run 'top' on linux to monitor the memory usage > of my product. I can see the

Re: [openssl-users] How to know maximum sendable fragment size?

On 07/11/17 03:56, J Decker wrote: > I've been developing this NodeJS plugin, it implements HTTPS server and > now client.  I was having an issue with HTTPS request getting ECONNRESET > for no apparent reason; so I implemented my own request, and ran into > the same sort of issue.  What I was

Re: [openssl-users] SSL_renegotiate for DTLS client

On 06/11/17 12:52, Viney Yadav wrote: > Going through the documentation of SSL_renegotiate > , it > says "For historical reasons, DTLS clients will not attempt to resume > the session in the new handshake". The paragraph is about

Re: [openssl-users] Latest releases missing from website

On 03/11/17 13:54, Thomas J. Hruska wrote: > I still only see 1.0.2l and 1.1.0f at: > > https://www.openssl.org/source/ > > Tried multiple browsers, flushed caches, etc.  The problem does not > appear to be on my end of things. > Hmmmits working for me. Perhaps an Akamai issue Rich Salz?

Re: [openssl-users] TLS 1.3 handshake: Limit signature algorithm?

On 02/11/17 10:32, Christian Heimes wrote: > However this trick will not work with TLS 1.3. The new TLS 1.3 cipher > suites no longer specify authentication algorithm or key > agreement/exchange. TLS 1.3 RFC specifies a signature_algorithms > extension [5]. I could not find any API call in

Re: [openssl-users] Wanted details on ./config or Configure options

hink that should work (Richard Levitte may be able to comment). You can also use no-engine which switches off engine support altogether Matt > > > Regards > Jayalakshmi > > On Thu, Oct 26, 2017 at 4:09 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>>

Re: [openssl-users] OCSP_BASICRESP_verify() in 1.1.0

On 31/10/17 17:30, Dave Coombs wrote: > Hi Matt, thanks for your response. > >>> Is the correct solution to use OCSP_basic_verify(), which feels like >>> overkill for my needs (the code in question is *part of* our own >>> path-validation routine), or might there be some other way? >> >> Can

Re: [openssl-users] DTLS UDP issue

On 31/10/17 16:58, Grace Priscilla Jero wrote: > Hi Matt, > > Please find attached the pcap which contains only the "Hello Client". Thanks. Switching back to openssl-users. > Search with ip.src==22.33.40.11 > > SSL_accept fails with -1 and get error gives the number as 2. Error 2 is

Re: [openssl-users] OCSP_BASICRESP_verify() in 1.1.0

On 31/10/17 16:42, Wouter Verhelst wrote: > On 31-10-17 17:26, Matt Caswell wrote: >> I agree its not a great name for it. Unfortunately we are stuck with it >> for compatibility reasons. If we renamed it we would break any code that >> is currently using it. We could

Re: [openssl-users] OCSP_BASICRESP_verify() in 1.1.0

On 31/10/17 16:02, Wouter Verhelst wrote: > Hi Matt, > > On 31-10-17 16:36, Matt Caswell wrote: >> Can you use OCSP_basic_verify() passing in OCSP_NOVERIFY in the final >> "flags" argument? This basically finds the signer certificate and >> verifies the

Re: [openssl-users] OCSP_BASICRESP_verify() in 1.1.0

On 31/10/17 13:06, Dave Coombs wrote: > Hello, > > I was fiddling around with OpenSSL 1.1.0 this past weekend, because > One Day We'll Need To Upgrade (tm), and ran into the following. > > We have some code that uses OCSP_BASICRESP_verify() with 1.0.1 / > 1.0.2 to confirm that the signature on

Re: [openssl-users] Issue with DTLS for UDP

lto:grace.prisci...@gmail.com>> wrote: > > Please find attached the pcap. It only has Client Hello. > While debugging SSL_accept, I see it stuck in s->method->ssl_read_bytes > > Thanks, > Grace > > > On Tue, Oct 31, 2017 at 4:16 PM, Matt Cas

Re: [openssl-users] Issue with DTLS for UDP

> > On Tue, Oct 31, 2017 at 3:50 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 31/10/17 06:06, Grace Priscilla Jero wrote: > > Thankyou for the suggestions. After correcting few options the > > "Clien

Re: [openssl-users] Issue with DTLS for UDP

: > > Hi Matt, > > SSL_get_error()  returns 5.  > It is the same socket using which the UDP connection is established. > Could you suggest some logging that can be done for OPENSSL. > > Thanks, > Grace > > > On Thu, Oct 26, 2017 at 9:

Re: [openssl-users] Forthcoming OpenSSL releases

On 30/10/17 13:50, Matt Caswell wrote: > Forthcoming OpenSSL releases > > > The OpenSSL project team would like to announce the forthcoming release > of OpenSSL versions 1.1.0g and 1.0.2m. > > These releases will be made available on 2nd

[openssl-users] Forthcoming OpenSSL releases

Forthcoming OpenSSL releases The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.1.0g and 1.0.2m. These releases will be made available on 2nd November 2017 between approximately 1300-1700 UTC. This is a bug-fix release. It

Re: [openssl-users] Issue with DTLS for UDP

e it? Matt > > > > Thanks, > Grace > > On Tue, Oct 24, 2017 at 4:07 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 24/10/17 11:25, Grace Priscilla Jero wrote: > > We are using SSL_accept to accept

Re: [openssl-users] SSL_read() failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init

On 26/10/17 13:50, Kadlecsik József wrote: > Hi Matt, > > On Thu, 26 Oct 2017, Matt Caswell wrote: > >>>>> Oct 20 18:50:05 mail2 dovecot: imap-login: Debug: SSL error: SSL_read() >>>>> failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while

Re: [openssl-users] SSL_read() failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init

On 26/10/17 13:28, Kadlecsik József wrote: > Hi, > > On Thu, 26 Oct 2017, Matt Caswell wrote: > >>> Oct 20 18:50:05 mail2 dovecot: imap-login: Debug: SSL error: SSL_read() >>> failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init >>&

Re: [openssl-users] SSL_read() failed: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init

On 26/10/17 11:22, Kadlecsik József wrote: > Hello, > > We upgraded one of our dovecot servers to debian stretch with dovecot > 2.2.27 and since then an alpine MUA user has been experiencing random IMAP > failures. > > We enabled debugging at both sides, the client tells only: > >

Re: [openssl-users] Wanted details on ./config or Configure options

could be the case that there are some options that are undocumented in 1.0.2. Matt > > Regards > Jayalakshmi > > On Tue, Oct 24, 2017 at 2:31 PM, Matt Caswell <m...@openssl.org > <mailto:m...@openssl.org>> wrote: > > > > On 24/10/17 07:06, Jayalaks

Re: [openssl-users] Issue with DTLS for UDP

On 24/10/17 11:25, Grace Priscilla Jero wrote: > We are using SSL_accept to accept the connection for which we see the > failure. Please let know if you have any thoughts. Have you set the wbio correctly? Does SSL_get_wbio() return your wbio object if you call it immediately before

<    4   5   6   7   8   9   10   11   12   13   >