Re: Using pkcs12

2009-08-31 Thread Bram Cymet
tushar ganguli wrote: > Hi, > I have been using the PKCS12 command and it seems that the command > compulsorily asks for the password. > Shouldn't that be optional. Does it compulsorily encrypt all > certificates and keys with the export password? > > Regards, > Tushar. Use the command line option

Re: Using pkcs12

2009-08-31 Thread Javier Mosqueda
Just because the PKCS12 is going to be YOUR cert (to sign), it requires this password . It can not be optional because when you are about to install this file in an email client, the email client needs to make sure it's yours; so the password is then asked. No password is requested for OTHER's c

Using pkcs12

2009-08-31 Thread tushar ganguli
Hi, I have been using the PKCS12 command and it seems that the command compulsorily asks for the password. Shouldn't that be optional. Does it compulsorily encrypt all certificates and keys with the export password? Regards, Tushar.

RE: fips_premain.c

2009-08-31 Thread David Schwartz
pankaj227 wrote: > Ok ! I can't modify the fips_premain.c but what If It can't be integrated > into my application as it is. Doesn't it limit the usage of > fipscanister.lib > by making it mandatory to have c like application which can use it. No, it doesn't. The FIPS canister has to provide som

ErrorCode 06065064

2009-08-31 Thread Nigel Sollars
Hi all, After looking at many examples and reading the OpenSSL book i purchased, I was wondering what the usual culprits are for the errorcode 06065064. By the looks of it, it could be a bad password / key or perhaps a wrong sized outbuf. Any more information would be highly appreciated,

Re: add extension to an existing (signed) CA certificate

2009-08-31 Thread jehan procaccia
Jehan PROCACCIA a écrit : Le 28/08/2009 02:57, Patrick Patterson a écrit : Now I removed all my mozilla (firefox, seamonkey ) profiles on my test client that's what you mean by "replacing root CA certificate on your client " ? since I erased profiles (and hence stored ca and servers certificates

RE: fips_premain.c

2009-08-31 Thread Will Bickford
> > In FIPS OpenSSL 1.2, fips_premain.c is produced as an output after > > doing ms\do_fips. > > A fips_premain.c.sha1 file is also produced containing the > > SHA1 of the c file. Does the security policy restricts modification > > to this file? > > My application is in C++ and I need to do chan

RE: fips_premain.c

2009-08-31 Thread pankaj227
Ok ! I can't modify the fips_premain.c but what If It can't be integrated into my application as it is. Doesn't it limit the usage of fipscanister.lib by making it mandatory to have c like application which can use it. What if I don't use fips_premain.c at all and write my own code to set FIPS_s

RE: fips_premain.c

2009-08-31 Thread David Schwartz
> In FIPS OpenSSL 1.2, fips_premain.c is produced as an output after doing > ms\do_fips. > A fips_premain.c.sha1 file is also produced containing the SHA1 of the c > file. Does the security policy restricts modification to this file? My > application is in C++ and I need to do changes in this file

fips_premain.c

2009-08-31 Thread pankaj227
Hi, In FIPS OpenSSL 1.2, fips_premain.c is produced as an output after doing ms\do_fips. A fips_premain.c.sha1 file is also produced containing the SHA1 of the c file. Does the security policy restricts modification to this file? My application is in C++ and I need to do changes in this file (lik

Re: Diffie-Hellman key exchange : Preventing MITM attack

2009-08-31 Thread Steffen DETTMER
* Victor Duchovni wrote on Fri, Aug 28, 2009 at 13:39 -0400: > The OP is not using fixed DH keys. He is proposing to use ADH key > exchange. This gives confidentiality, but NOT authentication. Yes, and confidentiality without authentication usually doesn't help much. In case of MITM, the confiden