Question on RSA engine and Key strength

2021-03-15 Thread Jayalakshmi bhat
Hi All, We are writing a RSA engine for OpenSSL library to handle certificates up to 4096 bytes strength. We do support certificates up to 8k. How to we make engine to handle certificates only up to 4K and others handled by OpenSSL itself. Any help, inputs are appreciated. Thanks and Regards, J

Why legacy implement still linked in the libcrypto?

2021-03-15 Thread Chenxinping

Re: Is SSL_CTX_set_tmp_rsa_callback() only for small keys?

2021-03-15 Thread Matt Caswell
On 15/03/2021 23:53, Thomas Dwyer III wrote: I'm porting some very old code from 1.0.2 to 3.0 (but it still has to compile for both) and I'm trying to understand it's use of SSL_CTX_set_tmp_rsa_callback(). It looks like this was removed in 1.1.0 but it's not obvious to me why it was necessar

Is SSL_CTX_set_tmp_rsa_callback() only for small keys?

2021-03-15 Thread Thomas Dwyer III
I'm porting some very old code from 1.0.2 to 3.0 (but it still has to compile for both) and I'm trying to understand it's use of SSL_CTX_set_tmp_rsa_callback(). It looks like this was removed in 1.1.0 but it's not obvious to me why it was necessary in the first place. My read of the 1.0.2 man page

Re: Client certificate authentication

2021-03-15 Thread Robert Ionescu
Hmm ok I get it. So, to be able to get the fingerprint for the used certificates during a TLS handshake is possible by using the SSL_set_verify callbacks in the application or is the mentioned postfix useful for this purpose? _

Re: Client certificate authentication

2021-03-15 Thread Viktor Dukhovni
On Mon, Mar 15, 2021 at 12:23:54PM +0100, Robert Ionescu wrote: > I already found the callbacks for the verification process and I am > still trying to figure it out if it is possible to change them in a > way that they will print some certificate information to determine > which certificate was u

Re: Client certificate authentication

2021-03-15 Thread Robert Ionescu
I already found the callbacks for the verification process and I am still trying to figure it out if it is possible to change them in a way that they will print some certificate information to determine which certificate was used?