Re: OCB Authenticated Encryption

2013-03-28 Thread Ben Laurie
On 27 March 2013 12:04, Matt Caswell fr...@baggins.org wrote: On 27 March 2013 11:52, Michael Sierchio ku...@tenebras.com wrote: Does Phil still teach at UC Davis? You could always ask him directly for clarification or a waiver. Hi contact details are on the web page describing the various

DTLS fails handshake due to early CHANGE_CIPHER_SPEC

2013-03-28 Thread Daniel Caiafa
tl;dr: I've been looking into an issue in my product (uses DTLS) for the last couple of days. Tracked it down to a CHANGE_CIPHER_SPEC being processed too early causing the handshake to never complete. Details: - OpenSSL version 1.0.1c - Brackets indicate a single datagram packet. (1) Client:

[openssl.org #3025] Patch for 2012-A-0070 (UNCLASSIFIED)

2013-03-28 Thread Ramkelawan, Dennis P CTR via RT
Classification: UNCLASSIFIED Caveats: NONE Hello, I'm running Apache 2.2.22 with OpenSSL 0.98t on Windows 2008R2. I installed the software bundle from the Apache Software Foundation. I need to correct the vulnerability 2012-A-0070, Multiple Remote Memory Corruption Vulnerabilities in OpenSSL

[openssl.org #3026] Possible BUG in OpenSSL 1.0.1c regarding string types

2013-03-28 Thread Joseba Gil Irisarri via RT
Hello, I´m using OpenSSL 1.0.1c as a CA to sign a corporate certificate. OpenSSL is configured as follows: # This sets a mask for permitted string types. There are several options. # default: PrintableString, T61String, BMPString. # pkix : PrintableString, BMPString (PKIX recommendation

Re: [openssl-dev] [openssl.org #3026] Possible BUG in OpenSSL 1.0.1c regarding string types

2013-03-28 Thread Erwann Abalea
The countryName field is a PrintableString, that's mandatory (see X.520). It also MUST be 2 characters long, but that's not enforced by OpenSSL. -- Erwann ABALEA Le 28/03/2013 14:33, Joseba Gil Irisarri via RT a écrit : Hello, I´m using OpenSSL 1.0.1c as a CA to sign a corporate certificate.

Re: [openssl-dev] [openssl.org #3026] Possible BUG in OpenSSL 1.0.1c regarding string types

2013-03-28 Thread Erwann Abalea via RT
The countryName field is a PrintableString, that's mandatory (see X.520). It also MUST be 2 characters long, but that's not enforced by OpenSSL. -- Erwann ABALEA Le 28/03/2013 14:33, Joseba Gil Irisarri via RT a écrit : Hello, I´m using OpenSSL 1.0.1c as a CA to sign a corporate certificate.

[openssl.org #3026] Possible BUG in OpenSSL 1.0.1c regarding string types

2013-03-28 Thread Stephen Henson via RT
On Thu Mar 28 14:33:41 2013, joseb...@hotmail.com wrote: Hello, I´m using OpenSSL 1.0.1c as a CA to sign a corporate certificate. OpenSSL is configured as follows: # This sets a mask for permitted string types. There are several options. # default: PrintableString, T61String, BMPString. #

Re: OCB Authenticated Encryption

2013-03-28 Thread Matt Caswell
On 27 March 2013 21:03, Ben Laurie b...@links.org wrote: The OSF is not actually the one that would benefit from such a licence, so the whole idea that it (or we) should pay for one seems weird to me. Well, I wasn't actually suggesting that the OSF should pay for it itself, merely that the OSF

Re: CPU Software Engine

2013-03-28 Thread Jan Just Keijser
Hi, Costas Stasimos wrote: Hi Jan By applying the cryptodev patch in openssl, all the applications that use openssl (postfix, tomcat etc) are automatically executed at hardware. As far as it concerns the openssl speed, we can avoid the hardware acceleration by using the evp parameter. My

RE: [openssl.org #3025] Patch for 2012-A-0070 (UNCLASSIFIED)

2013-03-28 Thread Ken Montagna
Try http://www.apachehaus.com You will find what you need -Original Message- From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On Behalf Of Ramkelawan, Dennis P CTR via RT Sent: Thursday, March 28, 2013 8:31 AM Cc: openssl-dev@openssl.org Subject: [openssl.org

Supporting IPv6 literals in s_client?

2013-03-28 Thread Dan Mahoney, System Admin
Hey there, Apparently supporting ipv6 literals like [openssl s_client -connect '[2001:4f8:0:2::d]:443' in s_client is oft-asked for but never-implemented, to the point where there are blog articles like this out there: https://lwn.net/Articles/486369/, and most OSes that want to support