RE: Seeking permission to use openssl in a product name

2005-03-14 Thread Ted Mittelstaedt
[EMAIL PROTECTED] wrote: I am working on an cryptographic abstraction layer for Qt, imaginatively called the Qt Cryptographic Architecture (QCA). One of the back-end plugins that is in development links to OpenSSL. Right now, the directory name is qca-openssl. When it gets released, each

Re: Seeking permission to use openssl in a product name

2005-03-14 Thread Brad Hards
On Mon, 14 Mar 2005 07:27 pm, Ted Mittelstaedt wrote: Hmm - well this doesen't look to me like a request for permission, merely a request for opinion of whether or not you need to request permission. Sorry, that wasn't the intent. So, in answer to that, no.  You must request permission to do

Re: [openssl-users] Can't compile my small program on Cygwin

2005-03-14 Thread Erwann ABALEA
Bonjour, Hodie pr. Id. Mar. MMV est, [EMAIL PROTECTED] scripsit: [EMAIL PROTECTED] ~/Projekte/SSL $ gcc -lcrypto -lssl -Wall foo.c -o foo gcc -Wall -o foo foo.c -lcrypto -lssl The order is important. -- Erwann ABALEA [EMAIL PROTECTED]

SSL error: decryption failed or bad record mac (pg as Samba backend)

2005-03-14 Thread Fernando Schapachnik
Hi, I posted the following message to the PostgreSQL mailing list, and one of the main developers answered: I think you need to find some SSL hackers; this is below libpq's level too. - Original message - I'm trying to use an SSL-enabled (OpenSSL 0.9.7d) Postgres 7.3.9 as database

SSL_ERROR_SYSCALL

2005-03-14 Thread vijay basav
hi i have written a code for simple secure client server communication. i compile it on cygwin and run it on mips. SSL_connect returns -1 and ERR_get_error(..) returns 0. and the error is SYS_ERROR_SYSCALL. errno is also 0. could someone tell me why is this happening? and how can i access the

Re: The breaking of SHA1

2005-03-14 Thread alok
I doubt many people would actually use it if they know it can be easily broken.. Like someone said on the list hey everyone uses it, it must be secure is the mental genere. -A Ted Mittelstaedt wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of

Re: The breaking of SHA1

2005-03-14 Thread Brian Hurt
On Mon, 14 Mar 2005, alok wrote: I doubt many people would actually use it if they know it can be easily broken.. Like someone said on the list hey everyone uses it, it must be secure is the mental genere. Most people, including a depressingly large number of programmers, would probably

Re: The breaking of SHA1

2005-03-14 Thread alok
Personally, I'd like to see OpenSSL start using private key crypto as hashing functions. The reason that work on dedicated hashing algorithms kinda died off after MD[45]/SHA* came out was that people figured out that they were the equivelent of private key encryption. IIRC, you can turn any

Re: The breaking of SHA1

2005-03-14 Thread Brian Hurt
On Mon, 14 Mar 2005, alok wrote: IIRC, you can turn any private key crypto system into a hasing algorithm. Given an encryption function c = f(k, p) where c is the resulting ciphertext, k is the private key, and p is the plaintext, you can use it as a hash function s' = h(t, s) where s' is the

Re: The breaking of SHA1

2005-03-14 Thread alok
Yeah, you need large key sizes- 128 bits keys just aren't enough (they allow birthday attacks to be computationally feasible). But I note that all the AES finalists went to 256 bit key sizes. This would put a birthday attack at about 128 bits of complexity- sufficient. Anything less than

Re: The breaking of SHA1

2005-03-14 Thread Alicia da Conceicao
Hi everybody: Bruce Schneier said it best on his blog (dated 18 Feb 2005): == Earlier this week, three Chinese cryptographers showed that SHA-1 is not collision-free. That is, they developed an algorithm for finding

Re: The breaking of SHA1

2005-03-14 Thread Brian Hurt
Lecture warning. On Mon, 14 Mar 2005, alok wrote: Yeah, you need large key sizes- 128 bits keys just aren't enough (they allow birthday attacks to be computationally feasible). But I note that all the AES finalists went to 256 bit key sizes. This would put a birthday attack at about 128 bits

Re: The breaking of SHA1

2005-03-14 Thread Brian Hurt
My point exactly. We don't need to panic- but I do think we need to start looking for alternatives. On Mon, 14 Mar 2005, Alicia da Conceicao wrote: Bruce Schneier said it best on his blog (dated 18 Feb 2005): Brian __ OpenSSL

Re: [openssl-users] Re: The breaking of SHA1

2005-03-14 Thread Erwann ABALEA
Bonsoir, Hodie pr. Id. Mar. MMV est, Alicia da Conceicao scripsit: Of course, having a method in 2^69 calculations that find a second message that has the same SHA1 hash as a first message does not mean that the second message would be of any use to an attacker/forger. This is not the result

RE: [openssl-users] Re: The breaking of SHA1

2005-03-14 Thread Ferdinand Prantl
Hi, you may want to read yet another paper, where a different, faster method is introduced, than the chinese one (english): http://cryptography.hyperlink.cz/md5/MD5_collisions.pdf Ferda -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erwann ABALEA

RE: [openssl-users] Re: The breaking of SHA1

2005-03-14 Thread Brian Hurt
On Mon, 14 Mar 2005, Ferdinand Prantl wrote: Hi, you may want to read yet another paper, where a different, faster method is introduced, than the chinese one (english): http://cryptography.hyperlink.cz/md5/MD5_collisions.pdf Careful. This is with MD5, a different (but still related) algorithm

RE: The breaking of SHA1

2005-03-14 Thread Brant Thomsen
To determine the probability of a birthday pairing, you need the probability of each birthday pairing not having the same birthday taken to the exponent of the number of pairings. The probability of no birthday pairings for 27 people is (364/365)^(27*26/2)=38%, or a 62% chance that there is at

RC4 Compatibility with WinBlows.

2005-03-14 Thread John Draper
Hi, I'm using the OpenSSL cryptlib encryption tools shipped with the Mac OS-X. I'm unable to decrypt a text file encrypted on a Windows XP, using the CryptEncrypt functon, an API in windows. The file was encrypted with a 16 byte key (128 bits) on the Windows. Using RC4 stream cypher. Yea, I

Re: Diagnosing a Double-Free

2005-03-14 Thread cmb
Thank you, duh, turning on debug for config cleared up all my stack trace problems. Here is the excerpt of a stack trace that is double freeing: #11 0x081a39db in CRYPTO_free (str=0x0) at mem.c:378 #12 0x081b1fa6 in ERR_get_state () at err.c:605 #13 0x081b2023 in get_error_values (inc=1, top=0,

Re: RC4 Compatibility with WinBlows.

2005-03-14 Thread Dr. Stephen Henson
On Mon, Mar 14, 2005, John Draper wrote: Hi, I'm using the OpenSSL cryptlib encryption tools shipped with the Mac OS-X. I'm unable to decrypt a text file encrypted on a Windows XP, using the CryptEncrypt functon, an API in windows. The file was encrypted with a 16 byte key (128 bits)

Re: Diagnosing a Double-Free

2005-03-14 Thread Dr. Stephen Henson
On Mon, Mar 14, 2005, cmb wrote: Thank you, duh, turning on debug for config cleared up all my stack trace problems. Here is the excerpt of a stack trace that is double freeing: #11 0x081a39db in CRYPTO_free (str=0x0) at mem.c:378 #12 0x081b1fa6 in ERR_get_state () at err.c:605 #13

Problems with SSL and OpenLDAP

2005-03-14 Thread Pupeno
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I'm trying to get OpenLDAP to work with SSL. This is the error I get when I try to search the server: # ldapsearch -x -H ldaps://master.pupeno.com ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL