Re: [openssl-users] FIPS mode errors

2016-02-11 Thread cloud force
Hi Jakob, This is the most severe FIPS error code, it means one of > 3 things: > > 1. (official reason for this error code): Someone illegally > modified the FIPS validated crypto code after it was > compiled, do not use this computer until the cause has > been thoroughly investigated and co

Re: [openssl-users] FIPS mode errors

2016-02-11 Thread Jakob Bohm
On 12/02/2016 03:45, cloud force wrote: Hi, I built the FIPS capable OpenSSL library on Ubuntu 12.04. When I run the command "OPENSSL_FIPS=1 openssl ciphers", I saw the following error: 140073969415840:error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match:fip

[openssl-users] FIPS mode errors

2016-02-11 Thread cloud force
Hi, I built the FIPS capable OpenSSL library on Ubuntu 12.04. When I run the command "OPENSSL_FIPS=1 openssl ciphers", I saw the following error: 140073969415840:error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match:fips.c:232: I tried few other openssl commands u

[openssl-users] 2-key vs 3-key 3DES

2016-02-11 Thread Nounou Dadoun
I've just been reading about recommended and deprecated encryption and tripped over a nist document (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf) that distinguishes between 2key and 3key 3DES saying that the former is deprecated after 2015 but the latter is still

Re: [openssl-users] OpenSSL lib build errors

2016-02-11 Thread cloud force
Anyone saw these errors before? On Wed, Feb 10, 2016 at 5:34 PM, cloud force wrote: > Hi All: > > I tried to build a FIPS capable OpenSSL Ubuntu package (using the Ubuntu > 12.04 debian meta file). > > The Ubuntu package uses Configure for configuring the source tree with the > following paramet

[openssl-users] PKCS12 command ignore -cipher option silently

2016-02-11 Thread Michel
Hi, Testing the PKCS12 command I notice the -cipher option (in this case -aes128) was silently ignore : c:\OpenSSL_11_dbg\bin\openssl pkcs12 -export -out Certificate.p12 -inkey RSAKey.pem -in Certificate.cer -aes128 -passin pass:test -passout pass:test looks Ok but verifying, it is sti

Re: [openssl-users] [openssl-dev] Removing obsolete crypto from OpenSSL 1.1 - seeking feedback

2016-02-11 Thread Jakob Bohm
Someone picked up an old dead thread, but I'll make some brief responses. On 11/02/2016 20:49, Valerie Anne Fenwick wrote: Hi Jakob - On 11/22/15 08:17 PM, Jakob Bohm wrote: On 20/11/2015 23:26, Short, Todd wrote: While I am all for simplicity, I also think that removing functionality is a “

Re: [openssl-users] regarding SSL security

2016-02-11 Thread Jakob Bohm
On 11/02/2016 19:31, R-D intern wrote: Hello , I am a Masters student and currently working on a project related to security. I have certain queries regarding ssl security. It would be of great use to me if some of my queries get clarified. The following is listed as: 1. How do I prove t

Re: [openssl-users] [openssl-dev] Removing obsolete crypto from OpenSSL 1.1 - seeking feedback

2016-02-11 Thread Valerie Anne Fenwick
Hi Jakob - On 11/22/15 08:17 PM, Jakob Bohm wrote: On 20/11/2015 23:26, Short, Todd wrote: While I am all for simplicity, I also think that removing functionality is a “bad idea”. To reduce the support burden, deprecate the ciphers: 1. Under support, indicate that these ciphers will no longe

Re: [openssl-users] OpenSSL lib build errors

2016-02-11 Thread cloud force
I checked the libcrypto.so which was built right before this, and was able to find these symbols. Still not sure why these errors showed up. Any suggestions and possible solutions are greatly appreciated. On Wed, Feb 10, 2016 at 5:34 PM, cloud force wrote: > Hi All: > > I tried to build a FIPS

[openssl-users] regarding SSL security

2016-02-11 Thread R-D intern
Hello , I am a Masters student and currently working on a project related to security. I have certain queries regarding ssl security. It would be of great use to me if some of my queries get clarified. The following is listed as: 1. How do I prove that ECC 256 bit key is equivalently stron

Re: [openssl-users] Errors in building 1.0.2f

2016-02-11 Thread Alex Chen
Yes, I did. It still failed. I manually made the symbolic links and the compilation completed without problem. But this should have been taken care of by Configure, should it not? Alex On 2/11/16, 1:07 AM, "openssl-users on behalf of Matt Caswell" wrote: > > >On 11/02/16 01:03, Alex Chen

Re: [openssl-users] no version information available error

2016-02-11 Thread Jakob Bohm
On 10/02/2016 22:46, cloud force wrote: Hi Everyone, I installed the FIPS capable openssl library (which was built by myself) on my Ubuntu linux box. For some reason, I keep running into the following errors whenever I run ssh related command: ssh: /lib/x86_64-linux-gnu/libcrypto.so.1

Re: [openssl-users] Win32 - PEM_read_PrivateKey crash

2016-02-11 Thread Lloyd
Thanks, The problem is solved when compiled and linked with "applink.c" On Thu, Feb 11, 2016 at 5:05 PM, Lloyd wrote: > Hi, > > I have downloaded prebuilt version of openssl for windows. I am running on > Windows 7 64bit, Using Visual Studio 2010, generating 32bit binary. > > When I run a simpl

[openssl-users] Win32 - PEM_read_PrivateKey crash

2016-02-11 Thread Lloyd
Hi, I have downloaded prebuilt version of openssl for windows. I am running on Windows 7 64bit, Using Visual Studio 2010, generating 32bit binary. When I run a simple application which calling "PEM_read_PrivateKey" it crashes with error "OPENSSL_Uplink(505D6000,08): no OPENSSL_Applink" What cou

Re: [openssl-users] Errors in building 1.0.2f

2016-02-11 Thread Matt Caswell
On 11/02/16 01:03, Alex Chen wrote: > I tried to build openssl 1.0.2f on MacOS with the following > configuration options "Configure no-bf" but it failed because there is > no header file blowfish.h in include/openssl directory. > This does not happen in 1.0.2d where include/openssl/blowfish.h is