Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread Bill Durant
On May 24, 2011, at 5:42 PM, Dr. Stephen Henson wrote: > On Tue, May 24, 2011, Bill Durant wrote: > >> On May 24, 2011, at 3:58 PM, Dr. Stephen Henson wrote: >>> On Tue, May 24, 2011, ciphertexto wrote: >>> On May 24, 2011, at 4:18 AM, Dr. Stephen Henson wrote: > > It can take a lon

Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread Dr. Stephen Henson
On Tue, May 24, 2011, Bill Durant wrote: > On May 24, 2011, at 3:58 PM, Dr. Stephen Henson wrote: > > On Tue, May 24, 2011, ciphertexto wrote: > > > >> On May 24, 2011, at 4:18 AM, Dr. Stephen Henson wrote: > >>> > >>> It can take a long time to execute sometimes as it performs two slow DH > >>>

Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread Bill Durant
On May 24, 2011, at 3:58 PM, Dr. Stephen Henson wrote: > On Tue, May 24, 2011, ciphertexto wrote: > >> On May 24, 2011, at 4:18 AM, Dr. Stephen Henson wrote: >>> >>> It can take a long time to execute sometimes as it performs two slow DH >>> parameter generation operations. Retry it a few times.

FIPS: Zeroization function during Power on self tests

2011-05-24 Thread vidyasagar Ravipati
Hi, I am compiling and running open ssl fips compliant version and trying to run the power on self tests during boot up time as part of FIPS requirements. I have observed invokation of zeroization function as well as output displayed as part of this function. Here are questions a) What is the in

Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread Dr. Stephen Henson
On Tue, May 24, 2011, ciphertexto wrote: > On May 24, 2011, at 4:18 AM, Dr. Stephen Henson wrote: > > > > It can take a long time to execute sometimes as it performs two slow DH > > parameter generation operations. Retry it a few times. If it still doesn't > > complete try: > > > > OPENSSL_FIPS=

Re: Download fips 1.2.3

2011-05-24 Thread John R Pierce
On 05/24/11 3:26 PM, Eric S. Eberhard wrote: If you tried to open it in Winzip (which can open tar files and tar.gz files) you can see if it is the Solaris or the file. To have Winzip do the tar.gz rename it to simply .tgz ... You could always transfer it from your PC if you do it this way --

Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread ciphertexto
On May 24, 2011, at 4:18 AM, Dr. Stephen Henson wrote: > On Mon, May 23, 2011, ciphertexto wrote: > >> On May 23, 2011, at 7:20 PM, Dr. Stephen Henson wrote: >>> On Sun, May 22, 2011, Bill Durant wrote: >>> Hello, Has anyone been able to build a "working" 64-bit version of the >>

RE: Download fips 1.2.3

2011-05-24 Thread Eric S. Eberhard
If you tried to open it in Winzip (which can open tar files and tar.gz files) you can see if it is the Solaris or the file. To have Winzip do the tar.gz rename it to simply .tgz ... You could always transfer it from your PC if you do it this way -- if you are running Samba on the Solaris it is

RE: Download fips 1.2.3

2011-05-24 Thread Jeremy Farrell
> From: John R Pierce > Sent: Tuesday, May 24, 2011 9:20 PM > > On 05/24/11 12:53 PM, Kyle Hamilton wrote: > > I don't think that Solaris's tar hits the bug every time. Do you > > think Oracle (nee Sun) would ship something that failed 100% of the > > time instead of 0.1% of the time? > > bug

Re: Download fips 1.2.3

2011-05-24 Thread Eric S. Eberhard
winzip will open tar files ... E At 01:20 PM 5/24/2011, you wrote: On 05/24/11 12:53 PM, Kyle Hamilton wrote: I don't think that Solaris's tar hits the bug every time. Do you think Oracle (nee Sun) would ship something that failed 100% of the time instead of 0.1% of the time? bug? no, this

Re: Download fips 1.2.3

2011-05-24 Thread Kyle Hamilton
John, The OP said that he gunzipped it in-place before doing tar xvf. It -is- a bug in Solaris tar, and it's known in many different places. One of which is here: http://docs.activestate.com/activetcl/8.5/at.install.html It appears that there are two separate issues involved. First, Solaris

Re: Specifications of the .pem container file

2011-05-24 Thread Kyle Hamilton
Xac, You seem to be looking for a utility which provides access much like tar or cpio. I'm sorry to have to report that this does not exist the way you seem to expect. If you want something that can automagically do everything that you need to accomplish from the command-line, I recommend GN

Re: Download fips 1.2.3

2011-05-24 Thread John R Pierce
On 05/24/11 12:53 PM, Kyle Hamilton wrote: I don't think that Solaris's tar hits the bug every time. Do you think Oracle (nee Sun) would ship something that failed 100% of the time instead of 0.1% of the time? bug? no, this is not a bug. native posix tar doesn't read gzip files, gzip does.

Re: Download fips 1.2.3

2011-05-24 Thread Kyle Hamilton
Well, Ryan I don't think that Solaris's tar hits the bug every time. Do you think Oracle (nee Sun) would ship something that failed 100% of the time instead of 0.1% of the time? Just try GNU tar. See if it works. That's what's used to create the tarball in the first place, and GNU tar has

Re: CMS: message digest algorithm selection is ignored when signing receipts (+ peer-review request)

2011-05-24 Thread Maxim Kammerer
On Tue, Dec 7, 2010 at 01:50, Dr. Stephen Henson wrote: > On Tue, Dec 07, 2010, Maxim Kammerer wrote: >> > The command-line argument "-md" to "openssl cms -sign_receipt" is >> > apparently ignored, and the default digest algorithm (SHA-1 in my >> > tests) is used instead. > > At present this is a

[error] Re-negotiation request failed IE, not FF

2011-05-24 Thread Yelgni
I have just moved a website from a Fedora 10 server to RedHat 5.5. On the Fedora the openssl version was 0.9.8g. On RedHat it is 0.9.8e-fips-rhel5 Lots of client PC's have the digital certificate installed in IE, and the users of the PC's would like to continue using IE as their other systems re

答复: EVP_VerifyFinal fail use RSA public key, openssl-1.0.0d, win32, vc2008sp1

2011-05-24 Thread bs1
Sorry, I’ve made a mistake L if(!EVP_VerifyUpdate(&v_ctx, out, outlen)){ MUST CHANGE TO = > EVP_VerifyUpdate(&v_ctx, inbuf, inbuflen) 发件人: owner-openssl-us...@openssl.org [mailto:owner-openssl-users@openssl. org] 代表 bs1 发送时间: 2011年5月24日 22:52 收件人: openssl

Re: FIPS-capable OpenSSL stops working sporadically

2011-05-24 Thread Dr. Stephen Henson
On Mon, May 23, 2011, ciphertexto wrote: > Hello, > > Does any one know how can any application work 100% reliably with a > FIPS-capable OpenSSL given the following requirement from page 33 of the > OpenSSL UserGuide at http://www.openssl.org/docs/fips/UserGuide.pdf: > > === > "The

Re: Specifications of the .pem container file

2011-05-24 Thread Dr. Stephen Henson
On Tue, May 24, 2011, xaccrocheur wrote: > Hi everyone ; This is my first msg on the list > > I'd like to know if there are any specifications I can read about > the .pem format ? From what I understand it is a "container" > meta-format, like ogg or avi, so how do I know how to read it, what > to

Re: Specifications of the .pem container file

2011-05-24 Thread TJ Saunders
> I'd like to know if there are any specifications I can read about the .pem > format See: http://en.wikipedia.org/wiki/Privacy-enhanced_Electronic_Mail and the mentioned RFCs. Although Privacy Enhanced Email is not widespread as such, the formatting of messages *is* used (e.g. for PEM fil

RE: Download fips 1.2.3

2011-05-24 Thread Ruiyuan Jiang
Well, Kyle I don't think tar is the problem here. After I had the problem with v1.2.3, I downloaded fips 1.2.2 afterwards and I don't have problem to untar the tar ball. Ryan -Original Message- From: owner-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of

EVP_VerifyFinal fail use RSA public key, openssl-1.0.0d, win32, vc2008sp1

2011-05-24 Thread bs1
Hello, EVP_VerifyFinal fail when use RSA public key, can anyone help? I use openssl cmd line tool generate a key pair of RSA and store them to two pem files. And RSA_sign and RSA_verify work fine with the pem files. To support large buffer , I change the code to work with EVP_Sign and EVP_Ve

Re: Building a 64-bit version of the FIPS-capable OpenSSL on Mac OS X 10.6.7

2011-05-24 Thread Dr. Stephen Henson
On Mon, May 23, 2011, ciphertexto wrote: > On May 23, 2011, at 7:20 PM, Dr. Stephen Henson wrote: > > On Sun, May 22, 2011, Bill Durant wrote: > > > >> Hello, > >> > >> Has anyone been able to build a "working" 64-bit version of the > >> FIPS-capable OpenSSL on Mac OS X 10.6.7 (SnowLeopard)? >

Specifications of the .pem container file

2011-05-24 Thread xaccrocheur
Hi everyone ; This is my first msg on the list I'd like to know if there are any specifications I can read about the .pem format ? From what I understand it is a "container" meta-format, like ogg or avi, so how do I know how to read it, what to expect and how to properly write it ? I found not

Re: Trying to figure out what needs to be released and how

2011-05-24 Thread Dr. Stephen Henson
On Mon, May 23, 2011, drachs wrote: > > I'm trying to parse a certificate for the DNS names of the site it's for. > Unfortunately, all the examples I can find don't bother releasing any of the > ram they acquire! So I'm left trying to figure it out myself because I > need to parse a few hundr

Trying to figure out what needs to be released and how

2011-05-24 Thread drachs
I'm trying to parse a certificate for the DNS names of the site it's for. Unfortunately, all the examples I can find don't bother releasing any of the ram they acquire! So I'm left trying to figure it out myself because I need to parse a few hundred of these a second. In addition, I can't se

Re: CMS: message digest algorithm selection is ignored when signing receipts (+ peer-review request)

2011-05-24 Thread Maxim Kammerer
On Tue, Dec 7, 2010 at 01:50, Dr. Stephen Henson wrote: > On Tue, Dec 07, 2010, Maxim Kammerer wrote: >> > The command-line argument "-md" to "openssl cms -sign_receipt" is >> > apparently ignored, and the default digest algorithm (SHA-1 in my >> > tests) is used instead. > > At present this is a