Re: Slow crypto initialization.

2010-06-30 Thread Ger Hobbelt
On Wed, Jun 30, 2010 at 9:12 PM, Brian Makin wrote: > > Thank you... this is mostly what I expected. > In our case we having a problem with a CGI program so the response time > is important and initialization happens many times. > > We may just have to hope no other boxes display this behavior :)

Application seg faults on SuSE zSeries 64 bit when upgraded OpenSSL from 0.9.8g to 0.9.8o

2010-06-30 Thread Jaswinder Bhamra
Hi, My application runs fine with OpenSSL 0.9.8g on SUSE LINUX Enterprise Server 9 (s390x) VERSION = 9 PATCHLEVEL = 4 . I re-compiled my application with libcrypto.a and libssl.a of OpenSSL 0.9.8o (w/o FIPS). Now when I run my application I get the "segmentation fault" error with a core dump. Belo

Re: Adding OIDs

2010-06-30 Thread Dr. Stephen Henson
On Wed, Jun 30, 2010, Mag wrote: > Thanks for the various replies. > > On Wed, Jun 30, 2010 at 4:26 AM, Dr. Stephen Henson wrote: > > If you want an extension then you need to make use of the mini-ASN1 compiler > > to add the appropriate fields. > > > > Note that if you add a new OID name in thi

RFC 3436 (tls-over-sctp) support?

2010-06-30 Thread Byron Campen
I am looking into the possibility of using openssl on an sctp association (for SIP, specifically), and the standardized way of doing it is non-trivial (although not terribly complex; I call it non-trivial because it is doing something other than "one stream, ordered delivery" sctp. It wo

Re: Adding OIDs

2010-06-30 Thread Mag
Thanks for the various replies. On Wed, Jun 30, 2010 at 4:26 AM, Dr. Stephen Henson wrote: > If you want an extension then you need to make use of the mini-ASN1 compiler > to add the appropriate fields. > > Note that if you add a new OID name in this way it only affects that instance > of OpenSSL

Re: Slow crypto initialization.

2010-06-30 Thread Brian Makin
This is Windows 2003, 64 bit, and it's definitely in RAND_screen. I'm trying to move things to 1.0.0a now. On Wed, 2010-06-30 at 20:47 +0200, Dr. Stephen Henson wrote: > On Wed, Jun 30, 2010, Ger Hobbelt wrote: > > > :-( I hope I recall correctly that what I mention next is indeed stuff > > happ

Re: Slow crypto initialization.

2010-06-30 Thread Brian Makin
Thank you... this is mostly what I expected. In our case we having a problem with a CGI program so the response time is important and initialization happens many times. We may just have to hope no other boxes display this behavior :) On Wed, 2010-06-30 at 19:19 +0200, Ger Hobbelt wrote: > :-( I

Re: Slow crypto initialization.

2010-06-30 Thread Dr. Stephen Henson
On Wed, Jun 30, 2010, Dr. Stephen Henson wrote: > On Wed, Jun 30, 2010, Ger Hobbelt wrote: > > > :-( I hope I recall correctly that what I mention next is indeed stuff > > happening in RAND_screen()... IIRC RAND_screen() isn't 'only' reading the > > screen but also doing a system-level heap trave

Re: Slow crypto initialization.

2010-06-30 Thread Dr. Stephen Henson
On Wed, Jun 30, 2010, Ger Hobbelt wrote: > :-( I hope I recall correctly that what I mention next is indeed stuff > happening in RAND_screen()... IIRC RAND_screen() isn't 'only' reading the > screen but also doing a system-level heap traversal and a few other things > and it was exactly that syste

Re: Slow crypto initialization.

2010-06-30 Thread Ger Hobbelt
:-( I hope I recall correctly that what I mention next is indeed stuff happening in RAND_screen()... IIRC RAND_screen() isn't 'only' reading the screen but also doing a system-level heap traversal and a few other things and it was exactly that system-level heap traversal that slowed a few spurious

Re: RAND_add with struct explanation?

2010-06-30 Thread Ger Hobbelt
RAND_add just treats those structs as bunches of bytes (count = sizeof(struct)) and meanwhile 'guestimates' that the entropy ~ unpredictability of said content is about 1 byte per field. The latter is a guestimate, nothing more. And it's probably an optimisitc guestimate at that too, but that's in

RAND_add with struct explanation?

2010-06-30 Thread Brian Makin
Could someone explain this to me? In various places RAND_add is called with sizeof a struct and the number of fields. Each of the fields is used to gather a byte of entropy. I don't understand how this works seeing that, due to field padding, we can't quite tell where the fields begin. Is this

Slow crypto initialization.

2010-06-30 Thread Brian Makin
I am seeing a very slow initialization on a single Windows 2003 box with openssl-0.9.8l. During initialization the function RAND_screen gets called. This effectively hashes the frame buffer to generate entropy. In our case we are running as an IIS user and I'm not even sure what screen it's gett

Re: Adding OIDs

2010-06-30 Thread Dr. Stephen Henson
On Wed, Jun 30, 2010, Eisenacher, Patrick wrote: > Hi Martin, > > > -Original Message- From: Martin Kaiser > > > > > > Now I understand that the oid definitions in the config file are not just > > used internally (for defining extensions etc) but they're picked up by the > > command line

RE: Adding OIDs

2010-06-30 Thread Eisenacher, Patrick
Hi Martin, > -Original Message- > From: Martin Kaiser > > > Now I understand that the oid definitions in the config file are not > just used internally (for defining extensions etc) but > they're picked up > by the command line tools. > > Is it correct that only req and ca use the oid defi

Re: Adding OIDs

2010-06-30 Thread Martin Kaiser
Hi Patrick, all, thanks for correcting my assumptions. Thus wrote Eisenacher, Patrick (patrick.eisenac...@bdr.de): > That line only defines the label "testoid1" and assigns the value > "1.2.3.4". > To use a private oid, you have to define its asn1 structure first. > Afterwards you can include i

Re: Adding OIDs

2010-06-30 Thread Dr. Stephen Henson
On Wed, Jun 30, 2010, Christian Hohnstaedt wrote: > Hi Mag, > > On Tue, Jun 29, 2010 at 06:43:24PM -0700, Mag wrote: > > I'm interested in using custom OIDs for private application purposes. > > I've found the documentation to be deficient. > > > > For instance, in openssl.cnf it gives an exampl

RE: Adding OIDs

2010-06-30 Thread Eisenacher, Patrick
Hi Mag, > -Original Message- > From: Mag > > I'm interested in using custom OIDs for private application purposes. > I've found the documentation to be deficient. > > For instance, in openssl.cnf it gives an example line of > [ new_oids ] > #testoid1=1.2.3.4 > > When I uncomment that lin

Re: Adding OIDs

2010-06-30 Thread Christian Hohnstaedt
Hi Mag, On Tue, Jun 29, 2010 at 06:43:24PM -0700, Mag wrote: > I'm interested in using custom OIDs for private application purposes. > I've found the documentation to be deficient. > > For instance, in openssl.cnf it gives an example line of > [ new_oids ] > #testoid1=1.2.3.4 > > When I uncomm

Re: Error with "dgst -sign"

2010-06-30 Thread Nacho Álvarez
I'm sorry very very much, I downloaded 1.0.0 instead of 1.0.0a. In last version I did the changes, compiled and ran OK. thank you very much for your help. 2010/6/29 Dr. Stephen Henson > On Tue, Jun 29, 2010, Nacho lvarez wrote: > > > Ok, with option disable-capieng (I didn't know it) OpenSSL c

Re: Adding OIDs

2010-06-30 Thread Martin Kaiser
Hi Mag, Thus wrote Mag (mag...@gmail.com): > I'm interested in using custom OIDs for private application purposes. > I've found the documentation to be deficient. > For instance, in openssl.cnf it gives an example line of > [ new_oids ] > #testoid1=1.2.3.4 > When I uncomment that line I can't