Re: OpenSSL 1.0.0 and FIPS

2010-03-30 Thread Steve Marquess
Gatewood (Woody) Green wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I noticed in trying to build OpenSSL 1.0.0 that Configure no longer accepts the fips and --with-fipslibdir= arguments (as does all 0.9.8 version since j for building in conjunction and with inclusion of

Re: OpenSSL 1.0.0 and FIPS

2010-03-30 Thread Gatewood (Woody) Green
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Given the response... Is there intention that the 0.9.8 branch be maintained past the 'n' patch release for any future discovered security issues either in openssl-0.9.8 code or SSL/TLS protocols as implemented on 0.9.8? I assume the 2010 limit

S/MIME interop issue with Outlook 2010 beta

2010-03-30 Thread Michael Ströder
HI! Someone sent me an encrypted S/MIME message which I could not decrypt in Mozilla's Seamonkey. Trying to determine the cause for that I wanted to look at the RecipientInfos structure with OpenSSL 0.9.8k shipped with openSUSE Linux 11.2 and and also tried with OpenSSL 1.0.0 (self-compiled).

Re: OpenSSL 1.0.0 and FIPS

2010-03-30 Thread Dr. Stephen Henson
On Tue, Mar 30, 2010, Gatewood (Woody) Green wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Given the response... Is there intention that the 0.9.8 branch be maintained past the 'n' patch release for any future discovered security issues either in openssl-0.9.8 code or

Re: S/MIME interop issue with Outlook 2010 beta

2010-03-30 Thread Dr. Stephen Henson
On Tue, Mar 30, 2010, Michael Strder wrote: HI! Someone sent me an encrypted S/MIME message which I could not decrypt in Mozilla's Seamonkey. Trying to determine the cause for that I wanted to look at the RecipientInfos structure with OpenSSL 0.9.8k shipped with openSUSE Linux 11.2 and and

Re: OpenSSL 1.0.0 released

2010-03-30 Thread Kenneth Goldman
Is there any significance to the 1.0.0.value other than it's the next number after 0.9.9? (Hoping that someone will answer that openssl will guarantee backward compatibility from here on.) -- Ken Goldman kg...@watson.ibm.com 914-784-7646 (863-7646)

Re: OpenSSL 1.0.0 and FIPS

2010-03-30 Thread Steve Marquess
Gatewood (Woody) Green wrote: ... I assume the 2010 limit on new validations is the impending finalization of 140-3. Actually no, FIPS 140-3 will be another issue to address further in the future. See the discussion of SP 800-131 at http://www.openssl.org/docs/fips/fipsnotes.html.

openssl ciphers fails when using !

2010-03-30 Thread Ben DJ
does @v1.0.0 'openssl ciphers -v ...' still support ! notation, as in 'openssl ciphers -v !RSA' ? man page says it does, man ciphers | grep Each cipher -A5 Each cipher string can be optionally preceded by the characters !, - or +. If ! is used then the ciphers are

Cryptographic message syntax

2010-03-30 Thread Randy Turner
Hi I was curious if OpenSSL supports the creation of a CMS container and also supports receiving and parsing a CMS container? Thanks!! Randy __ OpenSSL Project http://www.openssl.org User

Re: OpenSSL 1.0.0 released

2010-03-30 Thread Victor Duchovni
On Tue, Mar 30, 2010 at 12:25:02PM -0400, Kenneth Goldman wrote: Is there any significance to the 1.0.0.value other than it's the next number after 0.9.9? (Hoping that someone will answer that openssl will guarantee backward compatibility from here on.) From the list archives, in response

Re: openssl ciphers fails when using !

2010-03-30 Thread Bruce Stephens
Ben DJ bendj095124367913213...@gmail.com writes: [...] but, openssl ciphers -v HIGH:!RSA returns, RSA: Event not found. I think that's your shell, not openssl. __ OpenSSL Project

Re: Cryptographic message syntax

2010-03-30 Thread Kyle Hamilton
The just-released OpenSSL 1.0.0 does. 'openssl cms' for the syntax. -Kyle H On Tue, Mar 30, 2010 at 9:43 AM, Randy Turner rtur...@amalfisystems.com wrote: Hi I was curious if OpenSSL supports the creation of a CMS container and also supports receiving and parsing a CMS container? Thanks!!

Re: openssl ciphers fails when using !

2010-03-30 Thread Kyle Hamilton
On Tue, Mar 30, 2010 at 10:06 AM, Ben DJ bendj095124367913213...@gmail.com wrote: does @v1.0.0 'openssl ciphers -v ...' still support ! notation, as in 'openssl ciphers -v !RSA' ? man page says it does,  man ciphers | grep Each cipher -A5       Each cipher string can be optionally preceded

Re: S/MIME interop issue with Outlook 2010 beta

2010-03-30 Thread Michael Ströder
Dr. Stephen Henson wrote: On Tue, Mar 30, 2010, Michael Strder wrote: Someone sent me an encrypted S/MIME message which I could not decrypt in Mozilla's Seamonkey. Trying to determine the cause for that I wanted to look at the RecipientInfos structure with OpenSSL 0.9.8k shipped with openSUSE

Re: S/MIME interop issue with Outlook 2010 beta

2010-03-30 Thread Dr. Stephen Henson
On Tue, Mar 30, 2010, Michael Strder wrote: Dr. Stephen Henson wrote: On Tue, Mar 30, 2010, Michael Strder wrote: Someone sent me an encrypted S/MIME message which I could not decrypt in Mozilla's Seamonkey. Trying to determine the cause for that I wanted to look at the RecipientInfos

Re: S/MIME interop issue with Outlook 2010 beta

2010-03-30 Thread Dr. Stephen Henson
On Tue, Mar 30, 2010, Dr. Stephen Henson wrote: On Tue, Mar 30, 2010, Michael Strder wrote: Dr. Stephen Henson wrote: On Tue, Mar 30, 2010, Michael Strder wrote: Someone sent me an encrypted S/MIME message which I could not decrypt in Mozilla's Seamonkey. Trying to determine the

Random Numbers

2010-03-30 Thread Anthony Gabrielson
Hello, I've been searching around and I'm not finding much on OpenSSL and random numbers. I'm trying to figure out how to best use RAND_bytes and RAND_pseudo_bytes; do I still need to worry about entropy or does OpenSSL take care of it for me these days? If I do need to worry

RE: Random Numbers

2010-03-30 Thread P Kamath
At one point of time, we had used tt800.c random number generator (available on the net - a small file sized 2kB), and sha'd or md5'd the output into a stream. From the output, we filtered out weak keys, if any. _ From: owner-openssl-us...@openssl.org

Re: Random Numbers

2010-03-30 Thread Victor Duchovni
On Tue, Mar 30, 2010 at 07:43:39PM -0700, P Kamath wrote: At one point of time, we had used tt800.c random number generator (available on the net - a small file sized 2kB), and sha'd or md5'd the output into a stream. From the output, we filtered out weak keys, if any. I hope nobody else does