Re: Create certificate on the fly (from external file)

2004-09-22 Thread sam
Sravan wrote: sam wrote: Hi, I have changed the openssl.conf file, it got rid of the problem now. Thank you so much for the help. Now there is another question to ask wrt the openssl.conf file. When the following command enter: openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout

File Upload Issues

2010-11-24 Thread Sam Jantz
Thank you. -Sam -- Sam Jantz Software Engineer

Help building FIPS openssl (suitable for apache)

2011-06-11 Thread Sam Theman
Hello, First off, I AM trying to follow the FIPS/OPENSSL user guide What am I doing wrong: 1.) downloaded fips openssl 1.2.3 2) ./config fipscanisterbuild make make install 3.) ./config fips --with-fipslibdir=/usr/local/ssl/fips1.2.3/lib make make install 4) build apache with ./

RE: Help building FIPS openssl (suitable for apache)

2011-06-13 Thread Sam Theman
> Date: Sun, 12 Jun 2011 04:10:39 +0200 > From: st...@openssl.org > To: openssl-users@openssl.org > Subject: Re: Help building FIPS openssl (suitable for apache) > > On Fri, Jun 10, 2011, Sam Theman wrote: > > > > > Hello, > > > > First off, I AM tr

Verifying X509 Certificates Using The OpenSSL API

2010-08-06 Thread Sam Jantz
(server_ssl); if(certValid == X509_V_OK) cout << endl << "Certificate is valid" << endl; If you need any more information please let me know and I will post what I can. Thank you in advanced for the help. Thanks, Sam -- Sam Jantz Software Engineer

Session Secrete Keys

2010-08-13 Thread Sam Jantz
N_get_ex_data() function (aside from the man page) as far in as where the arguments would come from. Again, any help would be greatly appreciated. One humbled techno weenie, Sam -- Sam Jantz Software Engineer

Re: Session Secrete Keys

2010-08-16 Thread Sam Jantz
Is there even a way to get the session secret? I mean, it has to be stored in memory somewhere right? I would greatly appreciate anything that anyone can give me since I am completely at wits end with this. Thanks, Sam On Fri, Aug 13, 2010 at 3:40 PM, Sam Jantz wrote: >

Generating Session Keys

2010-08-17 Thread Sam Jantz
me in the right direction, or explain the process a little better I would really appreciate it. Thanks in advanced, Sam -- Sam Jantz Software Engineer

Re: Getting info from SSL_CTX

2010-08-19 Thread Sam Jantz
nt function called tls1_PRF() found int ssl/t1_enc.c at line 230. This one takes a lot more parameters, but does not require the SSL structure like the first one does. I hope that this helps, and please let me know if you find anything else, or successfully generate the keys. Happy to help,

Re: Create Cert Dynamically

2010-08-19 Thread Sam Jantz
un to have your question ignored, so I figured I would at least contribute what I knew. I hope this helps, and good luck! -Sam On Thu, Aug 19, 2010 at 7:34 AM, Raj wrote: > Hi All >Can anybody tell me how to create a Digital certificate and its key > from an applica

Re: Certificate roll

2010-08-19 Thread Sam Jantz
certificate and sign it yourself with the same private key as before, and then start using the new one. So I am not familiar with the Java interface with SSL, but in c at least you would create this new cert using the X509 library. Hope this helps shed some light. -Sam On Thu, Aug 19

Re: Certificate roll

2010-08-20 Thread Sam Jantz
icate at any point the connection must undergo a renegotiation which will effectively be a new SSL session. Somebody who knows more than I do, please correct me if I'm wrong. -Sam On Fri, Aug 20, 2010 at 12:05 PM, Mohan Radhakrishnan < radhakrishnan.mo...@gmail.com> wrote: > H

SSL_CIPHER member data issue

2010-08-23 Thread Sam Jantz
o work around it like I did with with the SSL_get_current_cipher()? Please let me know if you know of any possible solution. I am really at a loss for why this field never gets populated. Thanks again, Sam -- Sam Jantz Software Engineer

Re: SSL_CIPHER member data issue

2010-08-23 Thread Sam Jantz
that it's not the most elegant solution, and if anyone has the correct way to do this I would appreciate it, but this will work for me for now. Happy coding, Sam On Mon, Aug 23, 2010 at 12:45 PM, Sam Jantz wrote: > Hello all, > > I am trying to reconstruct the key

Re: sha_block_data_order Crash

2010-08-24 Thread Sam Jantz
functions see the man page for CRYPTO_set_locking_callback, and CRYPTO_set_id_callback I hope that this is new information, and not something you already knew. Cheers, Sam On Tue, Aug 24, 2010 at 6:37 AM, Sayan Chaliha wrote: > Hey all, > > Under stressed conditio

Hello All Once Again

2010-08-26 Thread Sam Jantz
al behavior? or should the be rather unpredictably random. The way I am calculating the vector does not rely on this data, so it's neither here nor there, but it did strike me as odd. If anyone has any comments, or input I would like to hear what is really going on here. Looking forward to

Re: Signing the certificate

2010-08-27 Thread Sam Jantz
f signed certificate unless you know the private key of a CA. At this link there are some useful links on certificates, and keys: http://www.openssl.org/docs/HOWTO/ I hope that this clears things up, Sam <http://www.openssl.org/docs/HOWTO/> On Thu, Aug 26, 2010 at 11:59 PM, Raj wrote: &

Connection Resetting

2010-08-27 Thread Sam Jantz
pet0"; filename="mario.jpg" Content-Type: image/jpeg ^Yo{Z]^A^?<87><87>1^B/A^D9^_w+W [n7Y<9B>z7`:{y qތ[^V&ʎ#^Q ey...@ajb^tu And then the process repeats nearly word for word. However when I attach a smaller image it works perfectly and instead of repeating a

Re: Connection Resetting

2010-08-30 Thread Sam Jantz
though. What would cause SSL_ERROR_SYSCALL to be flagged, and have an empty error queue if the socket was not closed improperly on the other side? On Sun, Aug 29, 2010 at 11:06 PM, Dave Thompson wrote: > > From: owner-openssl-us...@openssl.org On Behalf Of Sam Jantz > > Sent

Re: Connection Resetting

2010-08-31 Thread Sam Jantz
long. My question is why is the session getting reset before I can upload a file? Is there some sort of a watchdog timer that I am neglecting to poke before the connection is reset? Any help would be appreciated. Thanks, Sam On Mon, Aug 30, 2010 at 12:49 PM, Sam Jantz wrot

Re: Connection Resetting

2010-09-01 Thread Sam Jantz
will be happy to provide what I can. I know that this can be confusing, but I tried to lay it out in as logical of an order as possible. It's hard to type english descriptions of code. Thank you for any help you can give. -Sam On Tue, Aug 31, 2010 at 9:59 PM, David Schwartz wrote: > &

Re: multi thread, example on win32 is wrong?

2010-09-02 Thread Sam Jantz
nvironments, the user should set > thses tow callback functions > locking_function and threadid_func > > the example: > *crypto/threads/mttest.c* > on win32 platform: > > it does not set threadid_func. it is an error? > -- Sam Jantz Software Engineer

Re: multi thread, example on win32 is wrong?

2010-09-02 Thread Sam Jantz
Sorry accidentally sent that: return pthread_self() } Then you register it, and your library should be thread safe. Again sorry about sending that too soon. Best of luck! -Sam On Thu, Sep 2, 2010 at 10:36 AM, Sam Jantz wrote: > Lu, > > I'm not sure spec

Symmetric Key Encryption

2010-09-02 Thread Sam Jantz
re verbose, than lacking in detail. Long story short, if there is a better way to access the the session key I would like to know about it. Thank you for any input or feedback you can provide. -Sam -- Sam Jantz Software Engineer /* Copyright (C) 1995-1998 Eric Young (e...@cryptsoft.com) * Al

Re: Windows Certificate Store with OpenSSL Certificate

2010-09-07 Thread Sam Jantz
root certificate to windows, I'm afraid I don't have an answer, but at least in the mean time this will get you by. Hope this helps! -Sam On Tue, Sep 7, 2010 at 2:59 AM, Dongsheng Song wrote: > Hi, > > When I install my self-signed certificate to 'Certificate Store&

SSL_connect, and SSL_accept

2010-09-07 Thread Sam Jantz
of the library, and is part of an example program. Any suggestions are appreciated. Thank you, -Sam -- Sam Jantz Software Engineer

Re: generating keys from passwords

2010-09-10 Thread Sam Jantz
al is generated for a given session. See section 6.3 on page 20. There is a similar section in the SSLv3 RFC document too. Hope this sheds some light! -Sam On Fri, Sep 10, 2010 at 1:57 PM, Stephan Müller wrote: > Hello, > > i am wondering how key derivation in openssl works, I got >

Doubt regarding PKCS5_PBKDF2_HMAC_SHA1() function

2008-11-13 Thread sam josh
Hi All, I am using this function to create a key for password encryption. I have a similar application running on Windows which uses Rfc2898DeriveBytes class to generate the key. The problem I am facing here is the difference between the keys generated using Windows and OpenSSL. It happens only wh

Changing private key passphrase using PHP OpenSSL

2012-11-28 Thread Sam Tuke
less portable. Thanks! Sam. signature.asc Description: This is a digitally signed message part.

Re: Can a linux service work as both TLS client and server?

2019-11-15 Thread Sam Roberts
is a client (or wait for any data, I don't think a server starts sending data until it gets something, but its been a while since I looked). Hope thats helpful, and even if not, it'd be interesting to know what apple is doing that is pushing you down this path. Sam

Re: OpenSSL 3.0

2020-02-26 Thread Sam Roberts
On Tue, Feb 25, 2020 at 8:00 PM Matt Caswell wrote: > alpha1, 2020-03-31: Basic functionality plus basic FIPS module I'd like to give this a spin, to get an idea what's going to be involved in porting from FIPS2.0 to 3.0, any pointers on where to start? Sam

Re: OpenSSL 3.0

2020-02-26 Thread Sam Roberts
ific doc changes or hints as what to do for FIPS3.0, and it wasn't clear where to start. Sam

Re: OpenSSL 3.0

2020-02-26 Thread Sam Roberts
nse of what will involved in porting Node.js. If asking for information is too distracting, no problem, I'll wait another month for the alpha and hope it contains some info on how to do this: > using a FIPS-validated crypto provider Cheers, Sam

Re: Forthcoming OpenSSL release

2020-03-11 Thread Sam Roberts
Will it include ONLY the CVE fix, or will it include other fixes, such as to the getrandom() call on some archs? commit 4dcb150ea30f9bbfa7946e6b39c30a86aca5ed02 Author: Kurt Roeckx Date: Sat Sep 28 14:59:32 2019 +0200 Add defines for __NR_getrandom for all Lin

Removing tls1 support in Openssl 1.0.2o

2020-04-18 Thread Sam Kappen
8921/ For disabling tls1 tried with EXTRA_OECONF = " -no-ssl3 -no-tls1" but seems like all of the tls1, tls1_1, tls1_2 are disabled. Request your help in disabling the protocol tls1 in openssl. Regards, Sam

Re: OpenSSL Security Advisory

2020-04-21 Thread Sam Roberts
directly by SSL_check_chain, but it is also called by tls1_set_cert_validity, and that is called from inside the tls state machine, but with different parameters, so its a bit hard to see if it is affected or not. Thanks, Sam On Tue, Apr 21, 2020 at 6:26 AM OpenSSL wrote: > > -BEGIN PGP

Re: OpenSSL Security Advisory

2020-04-21 Thread Sam Roberts
That makes sense, thank you all.

Re: OpenSSL version 3.0.0-alpha1 published

2020-04-23 Thread Sam Roberts
Resending to -users. On Thu, Apr 23, 2020 at 9:58 AM Sam Roberts wrote: > > Seems to be something wrong with the way config is generating the > version strings: > gcc -Icrypto -I. -Iinclude -Iproviders/common/include > -Iproviders/implementations/include -Icrypto/inc

Re: OpenSSL version 3.0.0-alpha1 published

2020-04-23 Thread Sam Roberts
, but more than that changed. I haven't looked at these yet other than scan the output, we might be relying on internals, but just for anyone curious, here's the test output: https://gist.github.com/sam-github/5a3b3775029efb3d31109d7e6e390f85

Re: OpenSSL version 3.0.0-alpha1 published

2020-04-24 Thread Sam Roberts
On Fri, Apr 24, 2020 at 1:05 AM Matt Caswell wrote: > This one is interesting: > > ERR_OSSL_EVP_FETCH_FAILED > > > This means that the algorithm you are trying to use isn't available in > the loaded providers. Since you should be getting the default provider > loaded automatically it could be beca

website changelog didn't get updated for 1.1.1 f and g

2020-04-27 Thread Sam Roberts
https://www.openssl.org/news/changelog.html#openssl-111 ^--- missing the last two patch releases. Cheers, Sam

Re: OpenSSL version 3.0.0-alpha1 published

2020-04-30 Thread Sam Roberts
to load Legacy provider: error:2567:DSO support routines::could not load the shared library /home/sam/w/core/tls/./node[26693]: ../../src/node_crypto.cc:6804:void node::crypto::InitCryptoOnce(): Assertion `"Unreachable code reached"' failed. 1: 0x557630598d84 node::Abort() [/home

Re: OpenSSL version 3.0.0-alpha1 published

2020-05-01 Thread Sam Roberts
On Thu, Apr 30, 2020 at 9:27 PM Richard Levitte wrote: > Yes, running from the DESTDIR "installation" gets you into trouble. > DESTDIR is intended to be a staging directory, i.e. a place to put Fair enough, I don't have to use DESTDIR, I configure with openssldir and prefix set to a sandbox now.

Re: liblegacy.a does not work unless compiled with -static

2020-05-01 Thread Sam Roberts
On Fri, May 1, 2020 at 10:22 AM Salz, Rich via openssl-users wrote: > Hm, so DSO support is a requirement for legacy crypto now? That probably > needs to be made explicit, and see if the project gets pushback. It would mean legacy alg support would not exist for Node.js binary distributions, bu

Re: liblegacy.a does not work unless compiled with -static

2020-05-02 Thread Sam Roberts
My first try after a static only build (and delete of all .so files) got an error from that, but if its the correct way, I'll investigate more. Sam

Using des-cbc in 3.0

2022-05-23 Thread Sam Varshavchik
I'm looking for an example of using des-cbc in openssl 3.0, I think I figured it out, but I'm not certain. I'm having trouble finding documentation, and the best kind of documentation is, of course, code. I have existing code that uses EVP_des_cbc() followed by EVP_EncryptInit_ex(). It st

RE: How to add my own crypto with openssl libs

2014-02-14 Thread Sam Kerr
You might be better served using a smaller library like PolarSSL for an embedded target. -Sam Kerr From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On Behalf Of Indtiny S Sent: Friday, February 14, 2014 6:10 AM To: openssl-users@openssl.org; openssl

Re: [openssl-users] big endian vs little endian

2016-12-21 Thread Sam Horwitz
Yes. Thanks you it works. My stupid. -Original Message- From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Salz, Rich Sent: Tuesday, December 20, 2016 12:16 PM To: openssl-users@openssl.org Subject: Re: [openssl-users] big endian vs little endian > I am obviosly

[openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-13 Thread Sam Roberts
d, it does appear to have code to find and add fipscanister.o to the link line. Any idea what I am doing wrong, or not understanding about fipslink.pl? Thanks, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-13 Thread Sam Roberts
rballs for openssl 1.0.2j or 1.1.0c, or tarballs for openssl-fips 2.0.9, or 2.0.16 Thanks, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-13 Thread Sam Roberts
On Thu, Jul 13, 2017 at 1:41 PM, Dr. Stephen Henson wrote: > On Thu, Jul 13, 2017, Sam Roberts wrote: >> On Thu, Jul 13, 2017 at 12:34 PM, Dr. Stephen Henson >> wrote: >> > If you do want to link against the static libraries then the easiest way >> > to do >

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-17 Thread Sam Roberts
On Thu, Jul 13, 2017 at 7:46 PM, Dr. Stephen Henson wrote: > On Thu, Jul 13, 2017, Sam Roberts wrote: > >> On Thu, Jul 13, 2017 at 1:41 PM, Dr. Stephen Henson >> wrote: >> >> >> >> Where is nt.mak? Its mentioned in the User Guide but I didn't fi

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-19 Thread Sam Roberts
On Thu, Jul 13, 2017 at 11:07 AM, Sam Roberts wrote: > I'm having trouble linking on Windows with fipslink.pl, lots of FIPS_ > symbols are unresolved. OK, I attempted to do as ms/nt.mak does, rewriting it as a batch file: https://github.com/sam-github/node/blob/fips-win-ninja/fipsl

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-20 Thread Sam Roberts
, and __imp___stdio_common_vsscanf, both of which sound suspiciously like a problem with the runtime compilation flags to me. Cheers, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] shouldn't fipslink.pl include the fipscanister.lib in the link line?

2017-07-20 Thread Sam Roberts
On Thu, Jul 20, 2017 at 4:08 PM, Dr. Stephen Henson wrote: > On Thu, Jul 20, 2017, Sam Roberts wrote: > >> >> Most of the application is compiled with /MT, but openssl-fips-2.0.16 >> is using /MD, could this be an issue? Can I/should I convince >> ms\do_fips to bu

Re: [openssl-users] problem with -aes256 and -outform der in cmmand

2017-08-21 Thread Sam Roberts
Probably I misunderstand the context, since PKCS#8 can be used to encrypt EC private key info, some more info at https://tools.ietf.org/html/rfc5915. Which doesn't help the OP if the openssl CLI doesn't support it. On Mon, Aug 21, 2017 at 8:52 AM, Salz, Rich via openssl-users wrote: > ➢ OK. And

Re: [openssl-users] PKCS7 and RSA_verify

2017-09-30 Thread Sam Roberts
On Thu, Sep 28, 2017 at 2:28 AM, ch wrote: > Hi! > > I thought the difference between PEM and DER is NOT ONLY a different > encoding of the string? > base64 vs. binary > > So to understand that clear please let me ask: > If I convert a PEM-signature from base64 to binary then it is DER? Yes. Well

[openssl-users] Problems with man page code example at EVP_EncryptInit

2018-09-05 Thread Sam Habiel
al_ex(ctx, outbuf + outlen, &outlen)) It would be nice if there is a complete example that compiles and has a main() to run it. --Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] Problems with man page code example at EVP_EncryptInit

2018-09-05 Thread Sam Habiel
I had to double check something--I was wrong about something--&outlen is not incremented inside of openssl--so you have to keep another variable to which you add outlen and use that to set the read/write pointer in outbuf. --Sam On Wed, Sep 5, 2018 at 10:04 AM Sam Habiel wrote: > >

Re: [openssl-users] Problems with man page code example at EVP_EncryptInit

2018-09-05 Thread Sam Habiel
Todd, What is the correct repo on Github? --Sam On Wed, Sep 5, 2018 at 10:46 AM Short, Todd via openssl-users wrote: > > PRs on GitHub to fix documentation are always welcome. > -- > -Todd Short > // tsh...@akamai.com > // "One if by land, two if by sea, three if by the

Re: [openssl-users] Problems with man page code example at EVP_EncryptInit

2018-09-05 Thread Sam Habiel
Never mind. Easy google search away: https://github.com/openssl/openssl On Wed, Sep 5, 2018 at 10:49 AM Sam Habiel wrote: > > Todd, > > What is the correct repo on Github? > > --Sam > On Wed, Sep 5, 2018 at 10:46 AM Short, Todd via openssl-users > wrote: >

[openssl-users] Is there any standard way of getting the error name from an SSL error?

2018-11-21 Thread Sam Roberts
For example, I want the string "SSL_R_TOO_MANY_WARN_ALERTS" for an error with that value, not just the "too many alerts" description. I'm suspecting not, I don't see any use of #reason in ERR_REASON() or the macros it uses. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mai

[openssl-users] was the change in when disabled ciphers are skipped intentional?

2018-11-23 Thread Sam Roberts
In 1.1.0j, if SSL_CTX_set_cipher_list() is called with "not-a-cipher" or "rc4", then SSL_R_NO_CIPHER_MATCH will occur. In 1.1.1a, set_cipher_list() suceeds, seems to return the complete cipher list (should it do this?) but later ssl_cipher_list_to_bytes() will find that ssl_cipher_disabled() is tr

Re: [openssl-users] was the change in when disabled ciphers are skipped intentional?

2018-11-23 Thread Sam Roberts
On Fri, Nov 23, 2018 at 11:41 AM Viktor Dukhovni wrote: > > On Nov 23, 2018, at 2:25 PM, Sam Roberts wrote: > > > > In 1.1.0j, if SSL_CTX_set_cipher_list() is called with "not-a-cipher" > > or "rc4", then SSL_R_NO_CIPHER_MATCH will occur. > >

[openssl-users] what is the relationship between (Client)SignatureAlgorithms and cipher_list()?

2018-12-03 Thread Sam Roberts
/man1.1.1/man3/SSL_CONF_cmd_value_type.html ? Thanks! Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] version OPENSSL_1_1_1 not defined in file libcrypto.so.1.1 with link time reference

2018-12-05 Thread Sam Roberts
On Wed, Dec 5, 2018 at 5:22 AM Vincent Le Bourlot wrote: > After a fresh build of branch OpenSSL_1_1_1-stable on our ppc64 machine, > openssl seems broken for an unknown reason… > Executing `openssl version` results in: I'm no expert, but try `ldd openssl`, is it dynamically linking against the

Re: [openssl-users] A script for hybrid encryption with openssl

2018-12-18 Thread Sam Roberts
On Tue, Dec 18, 2018 at 3:18 AM Nick wrote: > I should add that I don't really care about the format, or even the use of > openssl - just the ability to tackle large files with the benefits of public > key encryption, in a self-contained way without needing fiddly work deploying > the keys (as

[openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Sam Roberts
ell people that file:///home/sam/w/core/node/out/doc/api/crypto.html#crypto_crypto_getciphers only works for TLS1.2 and below. Cheers, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-08 Thread Sam Roberts
On Tue, Jan 8, 2019 at 7:10 PM Viktor Dukhovni wrote: > On Tue, Jan 08, 2019 at 02:23:27PM -0800, Sam Roberts wrote: > > node.js has an API that lists all the cipher suite names that can be > > validly passed to set_cipher_list(), but I don't see how to get them > > fo

Re: [openssl-users] SSL_CTX_set_cert_verify_callback and certificate access

2019-01-11 Thread Sam Roberts
e able to do anything it wants with the ssh-facing socket descriptors, perhaps sending data to/from your server which can then move the data through the in-process abstractions? Cheers, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-14 Thread Sam Roberts
at are enabled, it doesn't give all. As you saw with both of your `ciphers` commands, they are printing the 3 TLS1.3 cipher suites that are enabled by default, but OpenSSL supports 5 TLS1.3 cipher suites, two are missing from the output. Cheers, Sam -- openssl-users mailing list To unsu

Re: [openssl-users] is there an API to list all the TLS 1.3 cipher suite names?

2019-01-18 Thread Sam Roberts
On Thu, Jan 17, 2019 at 5:40 PM Jordan Brown wrote: > On 1/14/2019 4:09 AM, Matt Caswell wrote: > > This works more "by accident". There is no ciphersuite alias called > "TLSv1.3", so using it as above results in no ciphersuites matched. Since the > TLSv1.3 ciphersuites are on by default anyway

[openssl-users] is the openssl wiki down for maintenance, or is something broken?

2019-01-30 Thread Sam Roberts
https://wiki.openssl.org/index.php/TLS1.3 is returning ``` Sorry! This site is experiencing technical difficulties. Try waiting a few minutes and reloading. (Cannot access the database) ``` -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] how is it possible to confirm that a TLS ticket was used?

2019-02-04 Thread Sam Roberts
getting the callback (twice per connection, of course), which makes me think that somehow my ticket reuse code is working only for 1.2. For both, I'm getting the session in the new session callback, and then setting it with SSL_set_session(), so I'd expect resumption to work for either prot

Re: [openssl-users] how is it possible to confirm that a TLS ticket was used?

2019-02-05 Thread Sam Roberts
On Mon, Feb 4, 2019 at 9:46 PM Viktor Dukhovni wrote: > On Mon, Feb 04, 2019 at 03:54:48PM -0800, Sam Roberts wrote: > However, because in TLS 1.3, session > tickets are sent *after* the completion of the handshake, it is > possible that the session handle you're saving is the on

Re: [openssl-users] how is it possible to confirm that a TLS ticket was used?

2019-02-05 Thread Sam Roberts
semi-obvious in retrospect, after having read our ticket key handling code, but it took me a while to find it. And it turns out that yes, SSL_session_resumed() does work with TLS tickets. Thanks for the suggestions, Viktor. Cheers, Sam -- openssl-users mailing list To unsubscribe: https://mta.open

Re: [openssl-users] how is it possible to confirm that a TLS ticket was used?

2019-02-09 Thread Sam Roberts
On Wed, Feb 6, 2019 at 1:01 PM Viktor Dukhovni wrote: > On Tue, Feb 05, 2019 at 02:43:03PM -0800, Sam Roberts wrote: > Your ticket rotation approach looks a bit fragile. I agree, though perhaps I should not have described what was happening as rotation. The test that was failing with TLS1

[openssl-users] when should client stop calling SSL_read to get TLS1.3 session tickets after the close_notify?

2019-02-14 Thread Sam Roberts
onsider the connection closed... not sure what else to do. Thanks, Sam -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: when should client stop calling SSL_read to get TLS1.3 session tickets after the close_notify?

2019-02-15 Thread Sam Roberts
Resending, I just got banned for "bounces", though why gmail would be bouncing I don't know. On Thu, Feb 14, 2019 at 2:51 PM Sam Roberts wrote: In particular, I'm getting a close_notify alert, followed by two NewSessionTickets from the server. The does SSL_read()/SS

Re: [openssl-project] OpenSSL 3.0 and FIPS Update

2019-02-15 Thread Sam Roberts
ch is very promising. I also looked around in github.com/openssl, even the OpenSSL_1_0_2-stable branch, and couldn't find where the openssl-fips-2.0.16.tar.gz is built from. Where is it located? Thanks, Sam

Re: [openssl-users] when should client stop calling SSL_read to get TLS1.3 session tickets after the close_notify?

2019-02-15 Thread Sam Roberts
On Fri, Feb 15, 2019 at 3:35 PM Matt Caswell wrote: > On 15/02/2019 20:32, Viktor Dukhovni wrote: > >> On Feb 15, 2019, at 12:11 PM, Sam Roberts wrote: > > OpenSSL could delay the actual shutdown until we're about to return > > from the SSL_accept() that i

Re: CVE-2019-1559 advisory - what is "non-stiched" ciphersuite means?

2019-02-27 Thread Sam Roberts
affected. Sam

Re: Stitched vs non-Stitched Ciphersuites

2019-02-27 Thread Sam Roberts
On Tue, Feb 26, 2019 at 8:42 AM Matt Caswell wrote: > > What about AEAD ciphers? Are they considered "stitched"? > > No, they are not "stitched" but they are not impacted by this issue. We should > probably make that clearer in the advisory. That would be helpful! Even though this is fixed, woul

Re: Stitched vs non-Stitched Ciphersuites

2019-02-28 Thread Sam Roberts
On Wed, Feb 27, 2019 at 8:42 AM Matt Caswell wrote: > On 27/02/2019 16:33, Sam Roberts wrote: > > That would be helpful! > > It has been updated: Thank you, that is helpful.

Re: Online docs have broken links

2019-03-01 Thread Sam Roberts
I ran linklint on the output of `make install_html_docs`, and there are a fair amount of refs to non-existent pages as well. Maybe its worth adding a `test-docs` target? Would PRs to fix the below be welcomed? # # ERROR 18 missing html

Why were edwards curves given distinct key types, aren't they EC keys?

2019-03-15 Thread Sam Roberts
necessary to make them distinct, both from each other, and EVP_PKEY_EC? Thanks, Sam

Re: Why were edwards curves given distinct key types, aren't they EC keys?

2019-03-16 Thread Sam Roberts
That helps a lot, I can see why they are different enough from EC key types to be distinct. It still leaves me wondering whe two edwards curves have key types distinct from each other? Why aren't they both EVP_PKEY_ED? (or something of the like) Cheers, Sam

Re: Why were edwards curves given distinct key types, aren't they EC keys?

2019-03-16 Thread Sam Roberts
n of the library as other project members. > > BR, > > Nicola > > On Sat, Mar 16, 2019, 17:00 Sam Roberts wrote: >> >> That helps a lot, I can see why they are different enough from EC key >> types to be distinct. >> >> It still leaves me wondering

Re: OpenSSL server sending certificate chain(inc. root cert) during handshake

2019-05-31 Thread Sam Roberts
The root cert is not used for validation, so it doesn't have to be sent. However, sending it does no harm, and it is useful for humans who are attempting to diagnose problems, it allows them to see what what root cert they are expected to have locally for sucessful cert chain validation.

Re: Calling EVP_DigestFinal_ex multiple times

2019-06-17 Thread Sam Roberts
d memory is unavoidable, but calling an API twice sounds detectable. Cheers, Sam

any subtleties about OCSP in TLS1.3 with ecdh curves?

2019-06-24 Thread Sam Roberts
Node.js has a bug report and repro of ocsp status not being sent from a node server to the openssl CLI when TLS1.3 is being used, but only when server is setting an ecdh curve, with SSL_CTX_set1_curves_list() repro is https://github.com/sam-github/node-ocsp-bug-repro TLS trace of success is

Copying an EVP_CIPHER_CTX

2008-01-28 Thread Sam Elstob
) { memcpy(out->cipher_data, in->cipher_data, in->cipher->ctx_size); } return retval; } Our goal is really to save and restore the cipher state of an RC4 cipher context. It does not seem to be possible to ask an EVP_CIPHER_CTX to save and restore it's interna

Open SSL Symmetric Code Security with Apache2.0

2005-12-15 Thread Sam Nokia
Hi guys,I'm hoping to get very basic instructions on how to create a client side certificate.Desirably, I want to be able to hand clients a USB stick with a security key on it. And then only those clients who physically have the key can access a directory of a website. (If they have to move the key

RE: Win32 Mail Server + SSL

2000-02-29 Thread Sam Stern
il also support SSL but I can't be sure). Note: I don't know how well these products can be integrated with OpenSSL - I usually lurk while I'm soaking up the information :> HTH, Sam Stern Bethesda, MD, USA PGP Keys available from the server S/Mime certificates available by direct r

RE: Verisign/NSI/Thawte monopoly

2000-03-28 Thread Sam Stern
Hi, Take a look at http://www.openca.org Sam Stern, Bethesda, MD, USA > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of dreamwvr > Sent: Tuesday, March 28, 2000 6:18 PM > To: [EMAIL PROTECTED]; Hostmaster; [EMAIL PROTECTED

RE: Outlook2000 Certificates in which format???

2000-04-20 Thread Sam Stern
and make a new contact record for that person. At this point, their certificate will be imported into their contact record for your convince. HTH, Sam Stern, Bethesda, MD, USA PGP ID:0x949342F9 mailto:[EMAIL PROTECTED] > -Original Message- > From: [EMAIL PROTECTED] > [m

Digital Signature Implementation

2000-10-31 Thread sam . duncan
help! Im feeling a bit daft, but all im looking for is an example on implementing digital signatures, and I keep finding myself bogged down with theory! Can you point ,me in the direction of a coding example? thanks in anticipation! Sam Duncan

./config problem

1999-04-12 Thread Sam Pye
is going on? I've been trying out different things for awhile. Can't figure it out :( -- Sam Pye MAYA Heat Transfer Technologies Ltd. Systems Administrator 4999 St Catherine West, Suite 400 Email: [EMAIL PROTECTED] Montreal, QC H2E-1M3 Canada http://ww

Re: Do openssl use the private key signed by WIN2000?

2001-04-12 Thread Sam Chueng
did that make any difference? >From: "cai" <[EMAIL PROTECTED]> >Reply-To: [EMAIL PROTECTED] >To: <[EMAIL PROTECTED]> >Subject: Do openssl use the private key signed by WIN2000? >Date: Thu, 12 Apr 2001 17:17:46 +0800 > >Dear Sir, > Could you help me? > I have a question about the use of

Re: gcc (2.95.2) loops spawning cpp compiling cryptolib.c in openssl-0.9.6

2000-10-26 Thread Sam C. Nicholson !!
talls. -sam Earlier today, I asked: > >To: [EMAIL PROTECTED] >Subject: gcc (2.95.2) loops spawning cpp compiling cryptolib.c in openssl-0.9.6 >Date: Tue, 24 Oct 2000 12:01:17 -0400 >From: "Sam C. Nicholson !!" <[EMAIL PROTECTED]> > >Env: > >gcc -v >g

  1   2   >