Encryption algorithm

2012-10-12 Thread Alex Chen
The 'openssl cipher -v' command shows the following cipher suites: $ openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256)

Re: Inconsistent behavior between FIPS and non-FIPS AES

2012-10-12 Thread AJ
Hi Jeff, Thanks for the response ... all the return values are 1, including setting the FIPS mode. I had removed the checks in this stripped down example code to get to my point and try to show the relevant portions, and minimize the code for someone to look at. -AJ - Original Message --

Re: Inconsistent behavior between FIPS and non-FIPS AES

2012-10-12 Thread Jeffrey Walton
Hi aunt.jomamma, You have ignored every return value. You should probably start by checking all return values. If you check all return values *and* assert all the checks, you will have self debugging code. I find self debugging code the best code of all, but I'm kind of lazy. > 2) Is there purpo

Re: Firefox unhappy with my self signed Cert

2012-10-12 Thread Derek Cole
Interesting. While I was playing around with this, I actually noticed that if I use the -subj option on the CSR, I am not able to do this. I was able to get it working by adding the common name on the actual cert generation from that CSR. The config file was modified so that for my priority_match,

RE: Firefox unhappy with my self signed Cert

2012-10-12 Thread Dave Thompson
>From: owner-openssl-us...@openssl.org On Behalf Of Derek Cole >Sent: Friday, 12 October, 2012 11:22 >So I think you were right. I used a command to view the CSR >that I generated with the following: >openssl req -new -nodes -subj "/CN=www.myserver.com" -out /tmp/file.csr >-keyout /tmp/privkey.c

Inconsistent behavior between FIPS and non-FIPS AES

2012-10-12 Thread AJ
Hi, I've noticed an inconsistency between the behavior of AES_CTR in FIPS and non-FIPS modes. I am using openssl-1.0.1c and openssl-fips-2.0.  The following code demonstrates the issue:   1 #include   2 #include   3 #include "openssl/evp.h"   4    5 #define MSG_SIZE 14   6 const unsigned char

Re: PKCS7 open and extract signature

2012-10-12 Thread Dr. Stephen Henson
On Fri, Oct 12, 2012, redpath wrote: > > Tried to find documentation and examples ( which includes searching the > forum) > for using a PKCS7 standard in context to what I am trying to do for best > practices > when using a signature to verify a document received. > > Basically I have a document

Re: FIPS seed_pid issue

2012-10-12 Thread Dr. Stephen Henson
On Fri, Oct 12, 2012, Kumar Ghanta wrote: > Hi, > Earlier versions of openssl-fips (versions 1.1.2 etc) have the following > checks in the fips_rand.c. It looks this check is being removed in the > later versions. I just want to know whether we need this check in earlier > versions as per the NIST

Re: Best practice for client cert name checking

2012-10-12 Thread Jeffrey Walton
On Thu, Oct 11, 2012 at 6:47 PM, Charles Mills wrote: > Thanks. > > My boss is not technical. I am the CTO of this product. Our customers are > your basic commercial customers. Yes, I picture that they would be their own > CA. Why pay Verisign if you don't have a bunch of people sitting at their >

Re: PKCS7 open and extract signature

2012-10-12 Thread redpath
Tried to find documentation and examples ( which includes searching the forum) for using a PKCS7 standard in context to what I am trying to do for best practices when using a signature to verify a document received. Basically I have a document file (100k) called BackgroundCheck.doc (document_

Re: id-aes256-GCM command line encrypt+decrypt fail

2012-10-12 Thread Dr. Stephen Henson
On Fri, Oct 12, 2012, Michel wrote: > I am guessing that 'special handling' is linked to the 'no > additional authentication data' issue discussed in : > http://incog-izick.blogspot.fr/2011_08_01_archive.html > It's to do with the fact that additional parameters are required with GCM and how the

Re: Firefox unhappy with my self signed Cert

2012-10-12 Thread Derek Cole
So I think you were right. I used a command to view the CSR that I generated with the following: openssl req -new -nodes -subj "/CN=www.myserver.com" -out /tmp/file.csr -keyout /tmp/privkey.csr -config /my/openssl.cnf when I do this though, I noticed that my subject line, which I view with opens

Re: Mac OS X and SSL Client Certitficates

2012-10-12 Thread Tom Browder
On Fri, Oct 12, 2012 at 9:10 AM, Graham Leggett wrote: > On 12 Oct 2012, at 3:59 PM, Tom Browder wrote: > >> I have successfully generated SSL client certs (generated with openssl >> 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus >> IE 9 on Windows, but I cannot get success

Re: Mac OS X and SSL Client Certitficates

2012-10-12 Thread Graham Leggett
On 12 Oct 2012, at 3:59 PM, Tom Browder wrote: > I have successfully generated SSL client certs (generated with openssl > 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus > IE 9 on Windows, but I cannot get successful access with either Safari > or Firefox on Mac OS X. > > W

Mac OS X and SSL Client Certitficates

2012-10-12 Thread Tom Browder
I have successfully generated SSL client certs (generated with openssl 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus IE 9 on Windows, but I cannot get successful access with either Safari or Firefox on Mac OS X. When I try on Mac/Safari I get the error: The server did no

Re: id-aes256-GCM command line encrypt+decrypt fail

2012-10-12 Thread Michel
I am guessing that 'special handling' is linked to the 'no additional authentication data' issue discussed in : http://incog-izick.blogspot.fr/2011_08_01_archive.html Le 11/10/2012 22:33, Erik Tkal a écrit : I think Steve posted a while back that those ciphers require special handling and do n