Re: [openssl-dev] DRBG entropy

2016-07-27 Thread Paul Dale
John's spot on the mark here. Testing gives a maximum entropy not a minimum. While a maximum is certainly useful, it isn't what you really need to guarantee your seeding. A simple example which passes the NIST SP800-90B first draft tests with flying colours: seed = π - 3 for

Re: [openssl-dev] Session resume with different TLS version?

2016-07-27 Thread David Woodhouse
On Tue, 2016-07-26 at 23:52 +, David Benjamin wrote: > Ah, you've hit upon a slew of odd behaviors which only got fully fixed on the > master branch. Thanks for the comprehensive response. I'm not going to touch that with a barge-pole then. > (I'm not familiar with DTLS1_BAD_VER, but if

Re: [openssl-dev] Load secrets to context.

2016-07-27 Thread Dr. Stephen Henson
On Wed, Jul 27, 2016, john gloster wrote: > Hi, > > Can we use both the following APIs in the same application to load > certificate to the SSL context? > > *SSL_CTX_use_certificate_file()* > *SSL_CTX_use_certificate_chain_file()* > You should only use one. If you use

Re: [openssl-dev] [TLS1 PRF]: unknown algorithm

2016-07-27 Thread Dr. Stephen Henson
On Wed, Jul 27, 2016, Catalin Vasile wrote: > Hi, > > I'm trying to use the EVP_PKEY_TLS1_PRF interface. > > The first thing I do inside my code is: > pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); > But pctx is NULL after that call. > > I've watched test/evp_test.c and it does not

[openssl-dev] Load secrets to context.

2016-07-27 Thread john gloster
Hi, Can we use both the following APIs in the same application to load certificate to the SSL context? *SSL_CTX_use_certificate_file()* *SSL_CTX_use_certificate_chain_file()* If we can how to use them? Thanks in advance. -- openssl-dev mailing list To unsubscribe:

[openssl-dev] [TLS1 PRF]: unknown algorithm

2016-07-27 Thread Catalin Vasile
Hi, I'm trying to use the EVP_PKEY_TLS1_PRF interface. The first thing I do inside my code is: pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); But pctx is NULL after that call. I've watched test/evp_test.c and it does not seem it does anything special, but it successful in running the

Re: [openssl-dev] DRBG entropy

2016-07-27 Thread Leon Brits
John, Thanks for your reply. The SP800-90B test has different types of test but the test with the lowest output is used as the maximum entropy capability of the chip. That is how I understand it from the FIPS lab. For the FIPS validation, using a NDRNG, that source must feed the DRBG directly

[openssl-dev] Windows uplink override, PR 1356

2016-07-27 Thread Jim Carroll
I'm assisting with the port of the python package M2Crypto to use OpenSSL 1.1.0. The latest windows build of python 2.7.12 still does not include applink.c, which leaves us unable to use BIO_s_fd functions and those BIO_s_file functions that accept FILE objects. I'd like to offer patch #1356

Re: [openssl-dev] DRBG entropy

2016-07-27 Thread John Denker
On 07/27/2016 05:13 AM, Leon Brits wrote: > > I have a chip (FDK RPG100) that generates randomness, but the > SP800-90B python test suite indicated that the chip only provides > 2.35 bits/byte of entropy. According to FIPS test lab the lowest > value from all the tests are used as the entropy and

[openssl-dev] DRBG entropy

2016-07-27 Thread Leon Brits
Hi all, I have a chip (FDK RPG100) that generates randomness, but the SP800-90B python test suite indicated that the chip only provides 2.35 bits/byte of entropy. According to FIPS test lab the lowest value from all the tests are used as the entropy and 2 is too low. I must however make use of