RE: Use TLS over UDP connection

2013-02-25 Thread Dave Thompson
> From: owner-openssl-...@openssl.org On Behalf Of David Woodhouse > Sent: Monday, 25 February, 2013 05:54 > On Sun, 2013-02-24 at 22:26 -0500, Dave Thompson wrote: > > TLS depends on TCP's reliable in-order transport. DTLS basically > > re-implements enough of TCP to make TLS functionality work.

Checking Anon Ciphers

2013-02-25 Thread Nathan Smyth
What's the best way to check whether an anonymous cipher is being used in an active session. Currently, we're doing a string search for "ADH" in ssl->session->cipher->name, which is not ideal. Thanks __ OpenSSL Project

EC_KEY functions thread safe?

2013-02-25 Thread Tom Leavy
In the testing of my application I have received a bad memory access crash that was triggered by the EC_POINT_point2oct function inside i2o_ECPublicKey. I have been testing this application for some time now and this is the first time it has crashed. What I did notice in particular is that it seem

Re: fipsld ./fips_premain_dso: No such file or directory

2013-02-25 Thread Roar Lien
According to the documentation, fips_premain_dso appears to be required when the application is a shared library. fips_premain_dso is part of the static build and it is referenced in fipsld. With that and adding lpthread and Bsymbolic to the command line I am able to link statically and enter fips

Re: Use TLS over UDP connection

2013-02-25 Thread David Woodhouse
On Sun, 2013-02-24 at 22:26 -0500, Dave Thompson wrote: > TLS depends on TCP's reliable in-order transport. DTLS basically > re-implements enough of TCP to make TLS functionality work. That isn't entirely true. Or at least it's misleadingly phrased. DTLS copes with packet loss and packet re-orde

Re: Certificate expiry alarms Reg.

2013-02-25 Thread Ashok C
Thanks a lot Jeff, The book is really very useful. On Sun, Feb 24, 2013 at 12:36 AM, Jeffrey Walton wrote: > On Fri, Feb 15, 2013 at 9:25 AM, Ashok C wrote: > > On Thu, Feb 14, 2013 at 5:31 PM, Jeffrey Walton > wrote: > >> On Thu, Feb 14, 2013 at 5:58 AM, Ashok C wrote: > >> > > >> > As part

padding differences for SSL 3.0/TLS 1.x records

2013-02-25 Thread Thulasi Goriparthi
Can somebody please tell me what were the attacks which made SSL 3.0 record padding to be modified in TLS 1.x forcing each byte in the padding data to contain padding length instead of leaving them arbitrary except for the last byte? Will it be a problem, If I let SSL 3.0 records to be padded simi

Re: check certificate chain in a pem file

2013-02-25 Thread Jakob Bohm
On 2/25/2013 4:26 AM, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Friday, 22 February, 2013 06:03 On 2/21/2013 2:29 PM, ashish2881 wrote: I have a certificate chain in a file chain.pem .it also has root certificate(self signed) . How can i verify t

Re: Certificate expiry alarms Reg.

2013-02-25 Thread Jeffrey Walton
On Fri, Feb 15, 2013 at 9:25 AM, Ashok C wrote: > On Thu, Feb 14, 2013 at 5:31 PM, Jeffrey Walton wrote: >> On Thu, Feb 14, 2013 at 5:58 AM, Ashok C wrote: >> > >> > As part of implementing certificate expiry related alarms for my SSL >> > application, I would kindly require few suggestions and

Re: CVE-2013-0169

2013-02-25 Thread Jakob Bohm
On 2/25/2013 4:26 AM, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Friday, 22 February, 2013 05:06 On 2/21/2013 11:12 AM, Mozes, Rachel wrote: [other reports say issue] affects just "The TLS protocol *_1.1 and 1.2_ *and the DTLS protocol 1.0 and