Re: SSL_write( ) fails

2011-03-02 Thread David Schwartz
On 3/2/2011 9:55 AM, ikuzar wrote: 3) I come back to the SSL_write( ). He wants to read( ). The doc says : " Caveat: Any TLS/SSL I/O function can lead to either of *SSL_ERROR_WANT_READ* and *SSL_ERROR_WANT_WRITE*. In particular, |SSL_read()| or |SSL_peek()| may want to write data and |SSL_write(

Re: BN_mod_mul_montgomery() causing cpu spike

2011-03-02 Thread Steve Marquess
prakgen wrote: Hi, I've enabled fips in sshd (OpenSSH 5.5p1) and linked it against openssl-fips-1.2. Everytime time sshd is spawned, the cpu utilization shoots up and remains high (40% to 90%) for around 5 seconds. By taking backtraces at time intervals (please see below), I found that, dur

Re: Locating AES GCM & GMAC Code under OpenSSL

2011-03-02 Thread Frank Morgner
Hi! > I was little concerned about the availability of aes_gcm code under > openssl for my use. I downloaded the latest code from > http://www.openssl.org/source/, but don't seem to find out gcm/gmac > libraries. > > There are earlier mails chains explaining the GCM update under > http://marc.inf

Error 0D0C50A1 (unknown message digest algorithm) after call to OpenSSL_add_all_algorithms

2011-03-02 Thread Hannes Mezger
hi, i have a problem with OpenSSL_add_all_algorithms() in openssl: on startup, my application calls OpenSSL_add_all_algorithms() in the main thread. a while after that, a new thread is created. this second thread then calls X509_verify_cert() which returns the error: 'error:0D0C50A1:asn1 encodin

Re: Is there an openssl command line equivalent to RSA_sign and RSA_verify?

2011-03-02 Thread jps3318
jps3318 wrote: > > Is there an openssl command line equivalent to: > RSA_sign(NID_sha1, hash, 20, sig, &siglen, rsa_pkey); > and/or > RSA_verify(NID_sha1, hash, 20, sigbuf, siglen, rsa_pkey) > > These functions work fine for signing and verifying data from a c program, > but I can't figure o

Command Line Question

2011-03-02 Thread Bob Bell (rtbell)
Folks - I am trying to generate a PKCS#10 certificate request with a pre-existing RSA public/private key pair that was generated using genpkey. The actual command is openssl genpkey -out Keys.bin -outform DER -algorithm rsa -pkeyopt rsa_keygen_bits:2048 Could someone please provide me wit

BN_mod_mul_montgomery() causing cpu spike

2011-03-02 Thread prakgen
Hi, I've enabled fips in sshd (OpenSSH 5.5p1) and linked it against openssl-fips-1.2. Everytime time sshd is spawned, the cpu utilization shoots up and remains high (40% to 90%) for around 5 seconds. By taking backtraces at time intervals (please see below), I found that, during this entire

Re: SSL_write( ) fails

2011-03-02 Thread ikuzar
Ok. Thanks. So, here SSL_write( ) wants to read( ). In fact, ssl_accept( ) fails ( but I continued instead of returning -1 for example. I repaired this programming error. Now it's OK ). -- Then I realize that ssl_accept returns ***ret = 0. * -- I check if ret < 1. If true then I make : gret = SSL_g

RE: DH_generate_key issue

2011-03-02 Thread Erik Tkal
Hi Viktor, If you perform BN_mod_exp you will find that mathematically the public key is correct. I suppose there is a 1 in 256 chance that the high order byte would be 0, so that explains your result of it happening when you do large numbers of such operations. BTW, you can also use BN_rand

Re:DH_generate_key issue

2011-03-02 Thread lzyzizi
I haven't run your code.I doubt why are you sure that the the length of thepub_key is equal to the length of the p.In my opinion,it is not longer than p.I found a counter example in WIKI. Alice and Bob agree to use a prime numberp=23 and baseg=5. Alice chooses a secret integera=6, then sends Bob

Is there an openssl command line equivalent to RSA_sign and RSA_verify?

2011-03-02 Thread jps3318
Is there an openssl command line equivalent to: RSA_sign(NID_sha1, hash, 20, sig, &siglen, rsa_pkey); and/or RSA_verify(NID_sha1, hash, 20, sigbuf, siglen, rsa_pkey) These functions work fine for signing and verifying data from a c program, but I can't figure out if there is an openssl command

Re:SSL_write( ) fails

2011-03-02 Thread lzyzizi
If you stepped a bit into the source code , you would have found the answer yourself. They are defined in the ssl.h.You may see the help doc for more details. #define SSL_ERROR_NONE0 #define SSL_ERROR_SSL1 #define SSL_ERROR_WANT_READ2 #define SSL_ERROR_WANT_WRITE

SSL_write( ) fails

2011-03-02 Thread ikuzar
Hello, SSL_write fails in my program. After debuging, I have got err = 2 in err = SSL_get_error(ssl, err); Does someone know what does it mean ? Thanks.

Re: SSL_read( ) => segmentation fault

2011-03-02 Thread ikuzar
I found where the segmentation fault happens. There is no link between SSL function call and the seg fault. SSL functions work fine until now. 2011/3/1 ikuzar > Hello, > I develop a secure stack. This stack is between TCP and an application. The > appli call my stack's functions ( my_connect( ),

DH_generate_key issue

2011-03-02 Thread Viktor Krikun
Hello, guys! I'm new to OpenSSL so sorry in advance if I get something wrong. I'm using OpenSSL Diffie-Hellman key exchange in my project. In 'normal' mode it works just perfect, but during stress-testing I have discovered "strange" behavior: I sequentially start X00 DH calculations and it randoml

RE: SSL - Weak Encryption Test

2011-03-02 Thread Nouefel
Hi Answering your questions: Are you even sure HOSTNAME:443 and HOSTNAME:8000 are the same host? Yes . Its a device . 2. 443 is disabled , Hence it disconnects. 3. 8000 is the port we used to communicate. I need to make sure device does not support weak security. Hence , I ran the openssl co