RE: Openssl req command - extensions and reqexts

2013-09-17 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of radiatejava > Sent: Tuesday, September 17, 2013 12:16 > I have some doubts on understanding the difference between extensions > and reqexts args used in the req command. I have this openssl.cnf > file. Using this I want to generate a certificat

RE: Concerning the ECDSA_sig size

2013-09-17 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of shotorddnadd > Sent: Tuesday, September 17, 2013 09:12 > I am writing a C++ application using Openssl library to sign the outgoing > messages and verify it on the other end. Everything works perfectly but > still there is a strange point which I

Re: Concerning the ECDSA_sig size

2013-09-17 Thread Billy Brumley
That's just the way ECDSA and DSA signatures work. Yes the ASN.1 encoding factors in but mostly it's just the way the math goes. The signature is a tuple (r,s) where r and s are mod n and n is fixed per curve. r and s are always smaller than n, normally around the same size as n, but can also be ev

Re: OpenSSL 1.0.1e build failure using MinGW, multiple definition of OPENSSL_Uplink [SOLVED?]

2013-09-17 Thread Thomas J Pinkl
On 09/13/2013 04:08 AM, Carl Young wrote: Forgive me if I am wrong, but I didn't think the FIPS 2.0 code base > could be used with anything else but MS VC on Windows!? The user guide does not state this explicitly as far as I can see, but the instructions - for building the canister and linkin

RE: Concerning the ECDSA_sig size

2013-09-17 Thread Khuc, Chuong D.
I remembered encountering this problem before. And although I don't remember all the details now, the basic idea is that openssl will only allocate enough memory for the "significant" bits of the signature. So if your signature has the first byte of 0x00, it will not store that byte. And if you

Re: Concerning the ECDSA_sig size

2013-09-17 Thread redpath
I am glad someone is asking this question. I sign the same data with same private key and sometimes the signature is 63 and sometimes it is 64 but overall the verification works for each anyhow. -- View this message in context: http://openssl.6102.n7.nabble.com/Concerning-the-ECDSA-sig-siz

can't we compiile openssl-1.0.1e without FIPS?

2013-09-17 Thread Elluru, Krishna
HI Experts, I see below symbols are defined in the file evp_fips.c. As per the name, they look FIPS related. is there a alternate definition available for these functions, without involving FIPS code compilation? I am unable to resolve below symbols. for ex: const EVP_CIPHER *EVP_aes_128_cbc(vo

Concerning the ECDSA_sig size

2013-09-17 Thread shotorddnadd
I am writing a C++ application using Openssl library to sign the outgoing messages and verify it on the other end. Everything works perfectly but still there is a strange point which I would like to discuss it and your help would be really appreciated in that case. I noticed that using private keys

Certificate extensions

2013-09-17 Thread radiatejava
I have some doubts on how to use certificate extensions. I have this openssl.cnf file: //cat openssl.cnf [v3_ca] basicConstraints = critical,CA:true keyUsage = digitalSignature, cRLSign, keyCertSign [ client_ext ] basicConstraints = CA:false keyUsage = critical,digitalSignature,nonRepudiation,ke

Openssl req command - extensions and reqexts

2013-09-17 Thread radiatejava
I have some doubts on understanding the difference between extensions and reqexts args used in the req command. I have this openssl.cnf file. Using this I want to generate a certificate for client (extended key usage=clientAuth) and one for server(extended key usage = serverAuth). However, when I

memory leak in ssl3_get_server_certificate?

2013-09-17 Thread Rajib Karmakar
Hi, I am using openssl and while running some tests with it, I see the memory usage of my application increasing when I open and close sessions - one at a time. After using valgrind I see a number of, Please note when I shutdown my application and do, I do not have any memory leaks. But I nee