PBKDF2 file encryption in perl

2010-03-17 Thread Anthony Thyssen
Is there any way to access the OpenSSL PKCS5_PBKDF2_HMAC_SHA1() function from a Perl Script or the command line. I can't seem to find any way to access this function except from C or other API's. And how does this function differ from EVP_BytesToKey() expecially when given a large iterative

Problem with ENGINE_cleanup with OpenSSL and PKCS11 engine

2010-03-17 Thread Cesar Henrique Keiti Kuroiwa
Hello We are trying to use the PKCS11 engine for OpenSSL to interface with a smart card reader Gemplus GemPC Twin 00 00. We are having some trouble when trying to retrieve the private from a smart card to decrypt some data. The problem arises when the wrong PIN number is given,

Re: Problem with ENGINE_cleanup with OpenSSL and PKCS11 engine

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Cesar Henrique Keiti Kuroiwa wrote: Hello We are trying to use the PKCS11 engine for OpenSSL to interface with a smart card reader Gemplus GemPC Twin 00 00. We are having some trouble when trying to retrieve the private from a smart card to decrypt some

Backward compatibility of private key files?

2010-03-17 Thread Mark Spruiell
Using OpenSSL 1.0b5, I generated a self-signed CA certificate and then created a key pair using commands like this: openssl req -config ssl.cnf -newkey rsa:1024 -passout pass:password \ -keyout key.pem -keyform PEM -out tmp/req.pem openssl ca -config ssl.cnf -batch -in tmp/req.pem -out

Re: Problem with ENGINE_cleanup with OpenSSL and PKCS11 engine

2010-03-17 Thread John R Pierce
Dr. Stephen Henson wrote: On Wed, Mar 17, 2010, Cesar Henrique Keiti Kuroiwa wrote: Hello We are trying to use the PKCS11 engine for OpenSSL to interface with a smart card reader Gemplus GemPC Twin 00 00. We are having some trouble when trying to retrieve the private from a

Re: Backward compatibility of private key files?

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Mark Spruiell wrote: Using OpenSSL 1.0b5, I generated a self-signed CA certificate and then created a key pair using commands like this: openssl req -config ssl.cnf -newkey rsa:1024 -passout pass:password \ -keyout key.pem -keyform PEM -out tmp/req.pem openssl ca

Re: Problem with ENGINE_cleanup with OpenSSL and PKCS11 engine

2010-03-17 Thread Cesar Henrique Keiti Kuroiwa
Hello again, We've made some progress with our tests. As it turns out, the main problem was with the call to ENGINE_finish, which we eliminated from our code for now. Now we seem to be facing a new issue that comes up when a wrong PIN is entered and then the card is removed from the reader.

Re: Problem with ENGINE_cleanup with OpenSSL and PKCS11 engine

2010-03-17 Thread John R Pierce
Cesar Henrique Keiti Kuroiwa wrote: Now we seem to be facing a new issue that comes up when a wrong PIN is entered and then the card is removed from the reader. After that, we can no longer do anything with the card after it is re-inserted. Not even by cleaning and reloading all the

how do you create signatures in OpenSSL?

2010-03-17 Thread Thomas Anderson
According to http://linuxmanpages.com/man1/rsautl.1.php, you can sign data with OpenSSL. My question is how? I tried to sign my private key and got the following error: ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt -out sig Enter pass phrase for rsa.txt: RSA operation error

way to get X509 cert from CMS

2010-03-17 Thread Chris Bare
Is there a API to extract the X509 cert(s) from a CMS_ContentInfo object? Looking at the implementation of CMS_add0_cert() I see how to reach them, but that function depends on things defined in cms_lcl.h, so I can't re-implement it in my code. Any suggestions? -- Chris Bare ch...@bareflix.com

how do you create signatures in OpenSSL?

2010-03-17 Thread Thomas Anderson
According to http://linuxmanpages.com/man1/rsautl.1.php, you can sign data with OpenSSL. My question is how? I tried to sign my private key and got the following error: ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt -out sig Enter pass phrase for rsa.txt: RSA operation error

Re: Backward compatibility of private key files?

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Mark Spruiell wrote: Thanks, that seems to fix it. One more thing: when I was looking for a solution to this issue, I tried to convert the private key into the old format. I thought I could do it with a command like this: openssl pkcs8 -in key.pem -out oldkey.pem

Re: Backward compatibility of private key files?

2010-03-17 Thread Mark Spruiell
Thanks, that seems to fix it. One more thing: when I was looking for a solution to this issue, I tried to convert the private key into the old format. I thought I could do it with a command like this: openssl pkcs8 -in key.pem -out oldkey.pem -passout pass:password However, it seems as if the

Re: What is RAND_screen for ?

2010-03-17 Thread Mathieu Malaterre
On Tue, Mar 16, 2010 at 6:25 PM, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 16, 2010, Mathieu Malaterre wrote: Hi there,  I am looking at an old piece of code: http://cpansearch.perl.org/src/SAMPO/smime-0.7/smimeutil.c ... #ifdef WINDOWS   LOG_PRINT(RAND_screen...);  

Re: way to get X509 cert from CMS

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Chris Bare wrote: Is there a API to extract the X509 cert(s) from a CMS_ContentInfo object? Looking at the implementation of CMS_add0_cert() I see how to reach them, but that function depends on things defined in cms_lcl.h, so I can't re-implement it in my code. You

Re: how do you create signatures in OpenSSL?

2010-03-17 Thread Sander Temme
On Mar 17, 2010, at 2:05 PM, Thomas Anderson wrote: According to http://linuxmanpages.com/man1/rsautl.1.php, you can sign data with OpenSSL. My question is how? I tried to sign my private key and got the following error: ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt

Re: What is RAND_screen for ?

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Mathieu Malaterre wrote: On Tue, Mar 16, 2010 at 6:25 PM, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 16, 2010, Mathieu Malaterre wrote: Hi there,  I am looking at an old piece of code: http://cpansearch.perl.org/src/SAMPO/smime-0.7/smimeutil.c

Re: how do you create signatures in OpenSSL?

2010-03-17 Thread Dr. Stephen Henson
On Wed, Mar 17, 2010, Thomas Anderson wrote: According to http://linuxmanpages.com/man1/rsautl.1.php, you can sign data with OpenSSL. My question is how? I tried to sign my private key and got the following error: ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt -out sig

Re: how do you create signatures in OpenSSL?

2010-03-17 Thread Martin Kaiser
Hi Thomas, Thus wrote Thomas Anderson (zeln...@gmail.com): ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt -out sig Enter pass phrase for rsa.txt: RSA operation error 1543:error:0406C06E:rsa routines:RSA_padding_add_PKCS1_type_1:data too large for key size:rsa_pk1.c:73:

How to enable null cipher in openssl library build config?

2010-03-17 Thread Vishal Rao
Hello openssl-users, I am trying to have eNULL (null cipher) enabled while compiling openssl from source. I've tried with 0.9.8g source and providing the enable-cipher option to the configure script with no luck. I've tried combinations like enable-null, enable-eNULL, enable-null-md5, etc with

Re: How to enable null cipher in openssl library build config?

2010-03-17 Thread Victor Duchovni
On Thu, Mar 18, 2010 at 08:49:54AM +0530, Vishal Rao wrote: Hello openssl-users, I am trying to have eNULL (null cipher) enabled while compiling openssl from source. It is always enabled, no special compilation flags required. I finally just edited SSL_DEFAULT_CIPHER_LIST in ssl.h to get