Trying to Link Statically to Libcrypto

2011-07-15 Thread brandonshw
Hi. I am writing some C++ on Linux with g++. When I try to link statically to libcrypto, by using the libcrypto.a library, it complains that RSA_generate_key and DH_generate_parameters are undefined references. Actually, I believe it said that openldap.so was complaining that they were undefin

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread yyyy
openssl dgst -ripemd160 -sign ec5_ca.key shr.o.txt WARNING: can't open config file: /usr/local/ssl/openssl.cnf Error setting context 5664:error:100C508A:elliptic curve routines:PKEY_EC_CTRL:invalid digest type:.c ryptoecec_pmeth.c:229: Also, in documentation on pkeyutl program is mentioned,

Converting ECC public key point-compressed and uncompressed

2011-07-15 Thread Erwin Himawan
Hi All, I would like to know whether openssl API has function call for generating ECC point-compression given that only the uncompressed ECC public key. Likewise, given the point-compressed ECC Key, I would also like to recover the uncompressed ECC key. Thanks for the help Regards, Erwin

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread Jeffrey Walton
On Fri, Jul 15, 2011 at 5:36 PM, Kyle Hamilton wrote: > On Fri, Jul 15, 2011 at 10:32 AM, Gaglia wrote: >> On 07/15/2011 08:23 AM, Kyle Hamilton wrote: >>> ... >> >> Excuse me, I got lost somewhere... Does this mean that it is not >> possible to use EC crypto with OpenSSL because the algorithms a

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread Steve Marquess
On 07/15/2011 05:36 PM, Kyle Hamilton wrote: > ... > > EC is considered to be a patent minefield. Some people (RSA Data > Security) say that it's possible to implement EC cryptography using > different types of algorithms which are not covered by the patents. > Other people (Bruce Schneier, US NSA)

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread Kyle Hamilton
On Fri, Jul 15, 2011 at 10:32 AM, Gaglia wrote: > On 07/15/2011 08:23 AM, Kyle Hamilton wrote: >> ... > > Excuse me, I got lost somewhere... Does this mean that it is not > possible to use EC crypto with OpenSSL because the algorithms are > patented? If so, why OpenSSL does provide support to EC c

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread Dr. Stephen Henson
On Fri, Jul 15, 2011, y...@inbox.lv wrote: > > Version of ECDSA available in openssl 1.0.0d supports only SHA1. > (maybe there are patches, which adds other hash functions, but > default build on win32 supports only sha1). What makes you think that? OpenSSL 0.9.8 only supports SHA1 with ECDSA

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread yyyy
Version of ECDSA available in openssl 1.0.0d supports only SHA1. (maybe there are patches, which adds other hash functions, but default build on win32 supports only sha1). ECDH and ECDSA are not guaranteed to use the same curve. At least with s_server curve for ECDSA is specified in certifica

Getting the "tls-unique" channel binding

2011-07-15 Thread Antoine Pitrou
Hello, The "tls-unique" channel binding is necessary to implement the SCRAM-SHA-1-PLUS authentication mechanisms (see RFC 5802, RFC 5929). We have a pending patch for Python's ssl binding to compute that piece of information (*), and I would like to know if there's some example code somewhere so

Re: Please help: OpenSSL + OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian)

2011-07-15 Thread Gaglia
On 07/15/2011 08:23 AM, Kyle Hamilton wrote: > ... Excuse me, I got lost somewhere... Does this mean that it is not possible to use EC crypto with OpenSSL because the algorithms are patented? If so, why OpenSSL does provide support to EC crypto? Sorry, I don't want to start a religion war, but as

Re: Adding Multiple Root certificates in Openssl

2011-07-15 Thread Ciprian Pavel
Hi Mayur, You can create a file where you may concatenate all your trusted certificates in PEM format and use that file for verification. Another way is to store your trusted certificates in PEM format in filesystem and create a folder from where you create symbolic links to every certificate. The

Adding Multiple Root certificates in Openssl

2011-07-15 Thread Mayur Premi
Hi , I am using openssl for signature verification of the files in my application. For supporting multiple root certificates , Is there a db or storage area[file] which openssl searches while finding the root of the passed input certificates ? I am using X509_Verify_cert api of openssl to v