Re: CRL validation must be skipped for certs with no CRLDPs

2011-03-19 Thread Jeff Saremi
I'm not sure how you read this. I read it like a programmer. In programming primitives, the spec would be coded like this: Here's the spec: This algorithm begins by assuming that the certificate is not revoked For each distribution point (DP) in the certificate's CRL distribution points

elicptic Curve Key Generation

2011-03-19 Thread Strecker, Dean A.
Hello, I'm using the OpenSSL Crypto library to perform Elliptic Curve key generation and signature generation/verification. Actually, I don't have any problem creating a key (EC_KEY) and generating signatures and verifying signatures using pure OpenSSL. The challenge I'm having is that I'm

Re: elicptic Curve Key Generation

2011-03-19 Thread Dr. Stephen Henson
On Fri, Mar 18, 2011, Strecker, Dean A. wrote: Hello, I'm using the OpenSSL Crypto library to perform Elliptic Curve key generation and signature generation/verification. Actually, I don't have any problem creating a key (EC_KEY) and generating signatures and verifying signatures using

SEGV in engine_table_select

2011-03-19 Thread John Hascall
I'm getting a frequent (but not always) crash in the engine_table_select() routine at offset +206 (a full stack trace is below) in openssl-0.9.8q (as called by curl-7.21.4) under NetBSD 3.1.1. I have attempted to line up the C source with the object code as disassembled by GDB, and it appears

Re: elicptic Curve Key Generation

2011-03-19 Thread Sander Temme
On Mar 18, 2011, at 3:57 PM, Strecker, Dean A. wrote: I'm using the OpenSSL Crypto library to perform Elliptic Curve key generation and signature generation/verification. Actually, I don't have any problem creating a key (EC_KEY) and generating signatures and verifying signatures using pure

Re: CRL validation must be skipped for certs with no CRLDPs

2011-03-19 Thread Bruce Stephens
Jeff Saremi jsar...@morega.com writes: [...] Here's the code: cert.status = NOT_REVOKED; for (i = 0; i cert.crldp.size; ++i) { /* some processing loops */ if(cert.status == UNDETERMINED) { /* do what Bruce Stephens suggested */ } } No, I think RFC5280 is saying that you