[openssl-users] FIPS 140-2 hostages executed

2015-06-16 Thread Steve Marquess
If you don't know or care what FIPS 140-2 is then count yourself very lucky and move on. There is a new development in the long running saga of the "hostage issue"[*]; the hostages have been executed: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#1747 Cross-referencing th

Re: [openssl-users] Certificat & CRL verification chain by callback

2015-06-16 Thread Viktor Dukhovni
On Tue, Jun 16, 2015 at 05:51:34PM +0200, Fabrice wrote: > I understand that, when I want to verify a certificate, I need to load the > X509_STORE_CTX with all the certificats and CRLs needed by the chain > verification > (like the command openssl verify -CApath -CAfile ...) What is the context

[openssl-users] DES3 CFB1 mode

2015-06-16 Thread Marcus Vinicius do Nascimento
Hi there, I've been trying to use DES_EDE3_CFB1 encryption in openssl version 1.0.1f but I couldn't make it work correctly. My understanding is that EVP_CipherUpdate is expecting the input data length (inl) in bytes, not bits as expected. I tried digging a little the GitHub repository but

Re: [openssl-users] OpenSSL support on Solaris 11 (built on Solaris 10)

2015-06-16 Thread Matt Caswell
On 16/06/15 18:07, Valerie Fenwick wrote: > So, while the general principle should work, your time is probably > better invested in standardizing on 1.0.1. If you are going to the trouble of upgrading, I would go straight to 1.0.2. As previously stated in our release strategy, 1.0.1 has a lifeti

Re: [openssl-users] OpenSSL support on Solaris 11 (built on Solaris 10)

2015-06-16 Thread Valerie Fenwick
On 6/16/2015 12:21 AM, Atul Thosar wrote: ​Hi All, From archives/google, I understood that the OpenSSL works/supported on Solaris 11 platform, but in our case, it's a bit different scenario. Currently, we build OpenSSL v0.9.8zc on Solaris 10 (SunOS, sun4u, sparc) and it works well on Solaris

[openssl-users] Fast DH parameters generation

2015-06-16 Thread Massimiliano Pala
Hi all, I am working on an application that would use DH to allow exchanging symmetric keys (not a TLS app), and we noticed that we could use two different approaches to generate the parameters. The first option is to use the DH_generate_parameters_ex() + DH_generate_key() - but that takes q

Re: [openssl-users] [openssl-dev] OpenSSL support on Solaris 11 (built on Solaris 10)

2015-06-16 Thread Nico Williams
I should add that you should read all the release notes of every update and check if your product would be affected. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Certificat & CRL verification chain by callback

2015-06-16 Thread Fabrice
Hello, I understand that, when I want to verify a certificat, I need to load the X509_STORE_CTX with all the certificats and CRLs needed by the chain verification (like the command openssl verify -CApath -CAfile ...) But, given a certificat to verify, I want to be called back to go up into t

Re: [openssl-users] [openssl-dev] OpenSSL support on Solaris 11 (built on Solaris 10)

2015-06-16 Thread Nico Williams
On Tue, Jun 16, 2015 at 12:51:31PM +0530, Atul Thosar wrote: > Currently, we build OpenSSL v0.9.8zc on Solaris 10 (SunOS, sun4u, sparc) > and it works well on Solaris 10 platform. We use Sun Studio 12 compiler. > > We would like to run it on Solaris 11.2 (SunOS, sun4v, sparc) platform w/o > changi

Re: [openssl-users] Certificat & CRL verification chain by callback

2015-06-16 Thread Jakob Bohm
On 16/06/2015 16:38, Fabrice wrote: Hello, I explain : I would like a function like this : int X509_verify(const char *certPem, void *who, char *(*whatYouWant)(void *who, int type, const X509_NAME *subject, const X509_NAME *issuer)) where : : is a certificat in PEM format to verify : is

Re: [openssl-users] Certificat & CRL verification chain by callback

2015-06-16 Thread Viktor Dukhovni
On Tue, Jun 16, 2015 at 04:38:16PM +0200, Fabrice wrote: > I explain : > > I would like a function like this : > > int X509_verify(const char *certPem, void *who, char *(*whatYouWant)(void > *who, int type, const X509_NAME *subject, const X509_NAME *issuer)) > > where : > > : is a certificat

[openssl-users] Certificat & CRL verification chain by callback

2015-06-16 Thread Fabrice
Hello, I explain : I would like a function like this : int X509_verify(const char *certPem, void *who, char *(*whatYouWant)(void *who, int type, const X509_NAME *subject, const X509_NAME *issuer)) where : : is a certificat in PEM format to verify : is an instance of a class whatYouWant :

[openssl-users] Application and TCP buffers with OpenSSL

2015-06-16 Thread Dipak Gaigole
Hello, I am writing a Client Server program. In order to achieve the Network Throughput I was playing around with the Application buffer size and TCP Buffer size (SO_SNDBUF/SO_RCVBUF) to find the best values for a specific client-server pair. I am transferring a file of size 748MB from Client to S

[openssl-users] OpenSSL support on Solaris 11 (built on Solaris 10)

2015-06-16 Thread Atul Thosar
​Hi All, >From archives/google, I understood that the OpenSSL works/supported on Solaris 11 platform, but in our case, it's a bit different scenario. Currently, we build OpenSSL v0.9.8zc on Solaris 10 (SunOS, sun4u, sparc) and it works well on Solaris 10 platform. We use Sun Studio 12 compiler.