Re: SSL_set_fd() and fd type in Windows 64

2013-11-04 Thread Pravesh Rai
We get such types of warning while doing compilation for x64 environment, but normally don't face any problem during run-time. Thanks, PK On Tue, Nov 5, 2013 at 6:36 AM, wrote: > On Windows, sockets and filedescriptors are HANDLES which are pointers. > > This is all nice and fine on 32bit Wind

SSL_set_fd() and fd type in Windows 64

2013-11-04 Thread sampo
On Windows, sockets and filedescriptors are HANDLES which are pointers. This is all nice and fine on 32bit Windows. However on 64bit windows int is 32bits and HANDLE is a 64bit pointer, leading to following warning: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]

RE: SSL/TLS encryption algorithms

2013-11-04 Thread Dave Thompson
> From: owner-openssl-users On Behalf Of Viktor Dukhovni > Sent: Friday, November 01, 2013 18:12 > > > $ openssl ciphers -v DHE-RSA-CAMELLIA256-SHA > > > DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA > Enc=Camellia(256) Mac=SHA1 > > > > > > $ openssl ciphers -v AES128-SHA256 > > >

RE: Signature Algorithm that was disabled because that algorithm is not secure

2013-11-04 Thread Dave Thompson
> From: owner-openssl-users On Behalf Of Marcus Schmitt > Sent: Monday, November 04, 2013 10:31 > I created the root-CA, Intermediate-CA and the servercert on my MAC > (10.8), afterwards I imported the file to my FreeBSD 9. > > When I try to create all the CA and certs on my FreeBSD directly I re

Re: Signature Algorithm that was disabled because that algorithm is not secure

2013-11-04 Thread Marcus Schmitt
Hello, there is one information I forgot to mention in my previews mails, maybe this is the reason for the problem. I created the root-CA, Intermediate-CA and the servercert on my MAC (10.8), afterwards I imported the file to my FreeBSD 9. When I try to create all the CA and certs on my FreeBS

Re: DTLS PSK in FIPS mode

2013-11-04 Thread Fredrik Jansson
Awesome, thank you! Can you please help me close bug 3152? I will put in a change request to have TLS1_TXT_PSK_WITH_AES_128_CBC_SHA and TLS1_TXT_PSK_WITH_AES_256_CBC_SHA enabled in FIPS mode. Best regards, Fredrik On Mon, Nov 4, 2013 at 3:37 PM, Dr. Stephen Henson wrote: > On Mon, Nov 04, 201

Re: DTLS PSK in FIPS mode

2013-11-04 Thread Dr. Stephen Henson
On Mon, Nov 04, 2013, Fredrik Jansson wrote: > Thanks, that did it! > > To try to understand the implications of this, if I add SSL_FIPS > to TLS1_TXT_PSK_WITH_AES_128_CBC_SHA and TLS1_TXT_PSK_WITH_AES_256_CBC_SHA, > am I violating the security policy? AES 128/256 CBC and SHA are approved > algor

Re: DTLS PSK in FIPS mode

2013-11-04 Thread Fredrik Jansson
Thanks, that did it! To try to understand the implications of this, if I add SSL_FIPS to TLS1_TXT_PSK_WITH_AES_128_CBC_SHA and TLS1_TXT_PSK_WITH_AES_256_CBC_SHA, am I violating the security policy? AES 128/256 CBC and SHA are approved algorithms(?). Best regards, Fredrik On Mon, Nov 4, 2013 at

Re: DTLS PSK in FIPS mode

2013-11-04 Thread Dr. Stephen Henson
On Mon, Nov 04, 2013, Fredrik Jansson wrote: > Steve, thanks for getting back! > > Since I could not reproduce this using s_client and s_server I set out to > take the code I am using into a sample project. > > Doing so I believe I have found the issue, SSL_CTX_set_cipher(ctx, > SSL_TXT_PSK) ret

Re: DTLS PSK in FIPS mode

2013-11-04 Thread Fredrik Jansson
Steve, thanks for getting back! Since I could not reproduce this using s_client and s_server I set out to take the code I am using into a sample project. Doing so I believe I have found the issue, SSL_CTX_set_cipher(ctx, SSL_TXT_PSK) returns an error ("SSL routines:SSL_CTX_set_cipher_list:no ciph