Re: McAfee Claims TLS Vulnerability

2012-05-01 Thread Mike Hoy
> > Use a SSL/TLS scanner to verify SSL is not available; and TLS ciphers > are available. How would I verifity that SSL is not available and TLS ciphers are available? > Since you are using a FIPS build, MD5 and lesser > friends should not be available. You can use "#openssl ciphers" shows tha

encode base 64 in simply smtp client

2012-05-01 Thread ml
hello hello honorable Member Doctor i work on small projet https://github.com/fakessh/openprojectssl/blob/master/smtp.c https://github.com/fakessh/openprojectssl/blob/master/smtp.h i realise encode base 64 like that //realizing base64 void base64(char *dbuf, char *buf128, int len) { str

Re: CVE-2012-2110: openssl-0.9.8l - Request for Clarification

2012-05-01 Thread Dr. Stephen Henson
On Mon, Apr 30, 2012, Welling, Conrad Gerhart wrote: > > > Our client application uses cURL-7.19.7 + openssl-0.9.8l to transfer > text files via HTTPS, using server-only authentication. The only call > the cURL source makes to an openssl d2i_*_bio() or d2i_*_fp() function > is d2i_PKCS12_fp().

Re: Diffie-Hellman and client certificates...

2012-05-01 Thread Dr. Stephen Henson
On Mon, Apr 30, 2012, barcaroller wrote: > > I have an SSL server that requests a client certificate from an SSL > client. Both were written using OpenSSL. This all works fine until > I ask the server to use Diffie-Hellman parameters; then the client > will not respond. > > My question is this

Re: McAfee Claims TLS Vulnerability

2012-05-01 Thread Ben Laurie
On Mon, Apr 30, 2012 at 5:23 PM, Paul Suhler wrote: > Perhaps it's related to CVE-2011-4576: > > https://kc.mcafee.com/corporate/index?page=content&id=KB75138&actp=LIST > and > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576 > > "The SSL 3.0 implementation in OpenSSL before 0.9.8s and

Re: McAfee Claims TLS Vulnerability

2012-05-01 Thread Ben Laurie
On Mon, Apr 30, 2012 at 12:45 PM, Dr. Stephen Henson wrote: > On Sun, Apr 29, 2012, Mike Hoy wrote: > >> We use McAfee to scan our website for vulnerabilities. They claim the >> following: >> >> > Configure SSL/TLS servers to only use TLS 1.1 or TLS 1.2 if supported. >> > Configure SSL/TLS servers

CVE-2012-2110: openssl-0.9.8l - Request for Clarification

2012-05-01 Thread Welling, Conrad Gerhart
Our client application uses cURL-7.19.7 + openssl-0.9.8l to transfer text files via HTTPS, using server-only authentication. The only call the cURL source makes to an openssl d2i_*_bio() or d2i_*_fp() function is d2i_PKCS12_fp(). Unfortunately, it is not absolutely clear - yet - that a PKCS#12