Re: Linking error on Soalris x86 and sparc using fips capable openssl 1.0.1h

2014-09-16 Thread Mrunal Nerpawar
Thanks all for the help. I could resolve both the errors: Sun-Intel : using -Wl, -Bsymbolic and resolving few other linking errors. Sun-sparc : Re-building libstdc++ all the errors gone away. Thanks again Andy for pointing it out. Regards, Mrunal On Mon, Sep 15, 2014 at 12:40 AM, Andy Polyakov

Re: SSL v3.0 is not set as default protocol upon disabling v2.

2014-09-16 Thread Thulasi Goriparthi
On 16 September 2014 23:01, Viktor Dukhovni wrote: > On Mon, Sep 15, 2014 at 11:19:52AM +0530, Thulasi Goriparthi wrote: > > > I suggest you try disabling TLS 1.0 along with SSL2 if you want to force > > your client to use SSL3 without changing the context's method. > > SSL_CTX_set_options(ctx, S

Re: Verifying authenticode signature using openssl API

2014-09-16 Thread Jakob Bohm
On 16/09/2014 12:22, Prasad Dabak wrote: Hello, I am currently focusing on matching various digests that we talked about earlier in the thread. 1. Computing the hash of the executable (excluding the areas as defined by MS) and matching it with the value stored in spcIndirectData. This is st

Re: SSL v3.0 is not set as default protocol upon disabling v2.

2014-09-16 Thread Viktor Dukhovni
On Mon, Sep 15, 2014 at 11:19:52AM +0530, Thulasi Goriparthi wrote: > I suggest you try disabling TLS 1.0 along with SSL2 if you want to force > your client to use SSL3 without changing the context's method. > SSL_CTX_set_options(ctx, SSL_OP_ALL| >

Re: Openssl FIPS compliance

2014-09-16 Thread Tom Francis
On Sep 16, 2014, at 7:35 AM, T, Satyanarayana (GE Healthcare) wrote: > Hi, > > This is regarding FIPS support for openssl. I was able to build FIPS capable > Openssl and link it to my application which uses Openssl(AES-256) for > Database encryption. I enabled FIPS mode using FIPS_mode_set(1

Re: SSL v3.0 is not set as default protocol upon disabling v2.

2014-09-16 Thread John Lane Schultz
As Thulasi wrote, SSLv23_client_method supports *ALL* protocols that your library supports by default. The name of the function is just historical and should be ignored. From the documentation: "If the cipher list does not contain any SSLv2 ciphersuites (the default cipher list does not) or e

Re: SSL v3.0 is not set as default protocol upon disabling v2.

2014-09-16 Thread abhijit pai
Hi Thulasi, Thanks for the response. But my point is little different here. I have a generic HTTP client, that talks to SSL 3.0 as well as TLS 1.x enabled server. And as mentioned earlier, I have disabled SSLv2. Now, when I talk to any server, shouldn't the client be sending SSLv3(SSL 3.0) in t

Re: Certificate pass phrase brute force...

2014-09-16 Thread Gregory Sloop
[SNIP] >> However this looks like the key is encrypted with 3DES, but I "exported" it >> from the Cert+Key with "-aes256" - so I'm puzzled why I'd have a 3DES >> encrypted p12. DT> You thought you did but you didn't. DT> The doc is a bit subtle, but the -$cipher option is listed under "PARSING"

Openssl FIPS compliance

2014-09-16 Thread T, Satyanarayana (GE Healthcare)
Hi, This is regarding FIPS support for openssl. I was able to build FIPS capable Openssl and link it to my application which uses Openssl(AES-256) for Database encryption. I enabled FIPS mode using FIPS_mode_set(1) (which did passed) and ran some unit tests and I see that all of the current tes

Re: Verifying authenticode signature using openssl API

2014-09-16 Thread Prasad Dabak
Hello, I am currently focusing on matching various digests that we talked about earlier in the thread. 1. Computing the hash of the executable (excluding the areas as defined by MS) and matching it with the value stored in spcIndirectData. This is straight forward and figured out. 2. Computi

RE: Certificate pass phrase brute force...

2014-09-16 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Gregory Sloop > Sent: Monday, September 15, 2014 22:50 > And, one more question: > How can I tell what format/encryption my pkcs12 files are in? > [I believe for Android platform use, I need p12 certs/keys - so I'm working > on the export/con

RE: Certificate pass phrase brute force...

2014-09-16 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Gregory Sloop > Sent: Monday, September 15, 2014 17:14 > I've gone back and re-encrypted the private keys [thanks Dave, again!] > and this is the result from an asn1parse > Is that the new format? [It looks like it, but I'm such a "babe in the