IDP support in 1.0.1

2013-04-12 Thread Bin Lu
Hi, I have a CRL data which worked fine with 0.9.8d but now is failing with 1.0.1c. The IDP contains the following info: Distribution Point Name: Full Name: URL =http://... Directory Address: CN=... O=... Only Contains User Certs=No Only Contains CA Certs=No Indirect CR

RE: Unable to retrieve the certificates from

2013-04-12 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Sukumar Bhukta > Sent: Friday, 12 April, 2013 01:20 > We have a master client (developed using TIBCO\BW) which calls a HTTP > web service and got URI and port dynamically back. From the output > (the URI and port) we need these as input and woul

RAND functions, FIPS, and forking

2013-04-12 Thread no_spam_98
It seems that the 0.9.8-era FIPS_rand_set_key() and FIPS_rand_seed() APIs have been removed from the 1.0.1-era FIPS Object Module.  Are there replacements for these APIs?  If so, what are they? I used to use them after my FIPS-mode application forked to reset the entropy state in the child proc

Re: RFC 2246

2013-04-12 Thread Marek . Marcola
Hello, In your code in main() function change line: sha=EVP_sha(); to: sha=EVP_sha1(); and lines: char *label = "1234567890"; int label_len = 10; to: char *label = "1234567890xyz"; int label_len = 13; In OpenSSL code "label" is equal "label+seed" in main code. Best regards, --

calling incore_macho run script for iOS FIPS from a dynamic library

2013-04-12 Thread Taraniteja Vishwanatha
Hello, I know that we can call the run script incore_macho for fingerprint check from an iOS application. I want ton know whether it is possible to call it from a dynamic library (dylib). Its not very common to build a dylib in iOS but we do have one. When I try to call incore_macho from our dyl

Re: RFC 2246

2013-04-12 Thread Sergei Gerasenko
But... your results are the same as those of tls_prf_sha1_md5 which I took from the code of wpa_supplicant (sha1-tlsprf.c) So which result is right? :) On Fri, Apr 12, 2013 at 04:04:20PM +0200, marek.marc...@malkom.pl wrote: > Hello, > > Output from attached code: > admin# ./mcl_tls1_PRF > 0x

Re: RFC 2246

2013-04-12 Thread Sergei Gerasenko
Since i don't know where to get that include (mclcrypto.h), I made the attached code from openSSL functions (~/openssl-0.9.8k/ssl/t1_enc.c). And the output I get is totally different: 0x51 0xc7 0x9f 0x01 0x94 0x7d 0x04 0xcd 0x99 0xc7 0x3c 0x7a 0x28 0x85 0x6a 0x52 Let me know what you think. Tha

Re: RFC 2246

2013-04-12 Thread Sergei Gerasenko
Hi Marek, I can't find mclcrypto.h anywhere. Where is it? Thanks! Sergei On Fri, Apr 12, 2013 at 04:04:20PM +0200, marek.marc...@malkom.pl wrote: > Hello, > > Output from attached code: > admin# ./mcl_tls1_PRF > 0x8b 0x13 0xc7 0x58 0xc3 0x4f 0x99 0x3a > 0x18 0x7d 0x29 0x45 0xed 0x5b

Re: RFC 2246

2013-04-12 Thread Sergei Gerasenko
Thanks so much for a reply. I'll compare your code with a few other versions right now. Thanks On Fri, Apr 12, 2013 at 04:04:20PM +0200, marek.marc...@malkom.pl wrote: > Hello, > > Output from attached code: > admin# ./mcl_tls1_PRF > 0x8b 0x13 0xc7 0x58 0xc3 0x4f 0x99 0x3a > 0x18 0x7d 0

How to hash large sections of a file

2013-04-12 Thread Paul Gardiner
I need to verify a pkcs7 signature of a file's contents, but the signature is included in the file, and the hash ranges over the two parts of the file on either side of the signature. I don't want to pull the parts into a single memory buffer, so I'm guessing I should in some way create a BIO repr

RSA blinding active by default?

2013-04-12 Thread Jakob Hirsch
Hi, we have an application that will make heavy use of RSA_private_decrypt() to decrypt passwords. Do we have to use RSA_blinding_on() to protect us from timing attacks? All I found is some older advisory that blinding is activated by default (http://www.mail-archive.com/openssl-users@openssl.org/

Re: RFC 2246

2013-04-12 Thread Marek . Marcola
Hello, Output from attached code: admin# ./mcl_tls1_PRF 0x8b 0x13 0xc7 0x58 0xc3 0x4f 0x99 0x3a 0x18 0x7d 0x29 0x45 0xed 0x5b 0x69 0x1d Best Regards, -- Marek Marcola owner-openssl-us...@openssl.org wrote on 04/11/2013 09:48:51 PM: > Sergei Gerasenko > Sent by: owner-openssl-us...@ope

RFC 2246

2013-04-12 Thread Sergei Gerasenko
Hello, Does anybody have sample input and output for the tls1_PRF function which is described in RFC 2246? I've used several implementations of it including the one from openSSL and I'm not sure if what I'm getting is right -- and all of them return something different. Thanks! __