Re: AES256 encryption using EVP APIs on iOS

I did try it but not on iOS . It was on linux.. On Tue, Oct 9, 2012 at 11:37 PM, Taraniteja Vishwanatha taranit...@gmail.com wrote: Hey guys, I am trying to use AES256 cbc mode for encryption on iOS. I found some useful resources online http://saju.net.in/code/misc/openssl_aes.c.txt. I am

Re: id-aes256-GCM command line encrypt+decrypt fail

I am guessing that 'special handling' is linked to the 'no additional authentication data' issue discussed in : http://incog-izick.blogspot.fr/2011_08_01_archive.html Le 11/10/2012 22:33, Erik Tkal a écrit : I think Steve posted a while back that those ciphers require special handling and do

Mac OS X and SSL Client Certitficates

I have successfully generated SSL client certs (generated with openssl 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus IE 9 on Windows, but I cannot get successful access with either Safari or Firefox on Mac OS X. When I try on Mac/Safari I get the error: The server did

Re: Mac OS X and SSL Client Certitficates

On 12 Oct 2012, at 3:59 PM, Tom Browder tom.brow...@gmail.com wrote: I have successfully generated SSL client certs (generated with openssl 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus IE 9 on Windows, but I cannot get successful access with either Safari or Firefox

Re: Mac OS X and SSL Client Certitficates

On Fri, Oct 12, 2012 at 9:10 AM, Graham Leggett minf...@sharp.fm wrote: On 12 Oct 2012, at 3:59 PM, Tom Browder tom.brow...@gmail.com wrote: I have successfully generated SSL client certs (generated with openssl 1.0.1c) used by Safari, Firefox, and Chrome on Linux and Windows plus IE 9 on

Re: Firefox unhappy with my self signed Cert

So I think you were right. I used a command to view the CSR that I generated with the following: openssl req -new -nodes -subj /CN=www.myserver.com -out /tmp/file.csr -keyout /tmp/privkey.csr -config /my/openssl.cnf when I do this though, I noticed that my subject line, which I view with

Re: id-aes256-GCM command line encrypt+decrypt fail

On Fri, Oct 12, 2012, Michel wrote: I am guessing that 'special handling' is linked to the 'no additional authentication data' issue discussed in : http://incog-izick.blogspot.fr/2011_08_01_archive.html It's to do with the fact that additional parameters are required with GCM and how the

Re: PKCS7 open and extract signature

Tried to find documentation and examples ( which includes searching the forum) for using a PKCS7 standard in context to what I am trying to do for best practices when using a signature to verify a document received. Basically I have a document file (100k) called BackgroundCheck.doc

Re: Best practice for client cert name checking

On Thu, Oct 11, 2012 at 6:47 PM, Charles Mills charl...@mcn.org wrote: Thanks. My boss is not technical. I am the CTO of this product. Our customers are your basic commercial customers. Yes, I picture that they would be their own CA. Why pay Verisign if you don't have a bunch of people

Re: FIPS seed_pid issue

On Fri, Oct 12, 2012, Kumar Ghanta wrote: Hi, Earlier versions of openssl-fips (versions 1.1.2 etc) have the following checks in the fips_rand.c. It looks this check is being removed in the later versions. I just want to know whether we need this check in earlier versions as per the NIST

Re: PKCS7 open and extract signature

On Fri, Oct 12, 2012, redpath wrote: Tried to find documentation and examples ( which includes searching the forum) for using a PKCS7 standard in context to what I am trying to do for best practices when using a signature to verify a document received. Basically I have a document file

Inconsistent behavior between FIPS and non-FIPS AES

Hi, I've noticed an inconsistency between the behavior of AES_CTR in FIPS and non-FIPS modes. I am using openssl-1.0.1c and openssl-fips-2.0.  The following code demonstrates the issue:   1 #include stdio.h   2 #include string.h   3 #include openssl/evp.h   4    5 #define MSG_SIZE 14   6 const

RE: Firefox unhappy with my self signed Cert

From: owner-openssl-us...@openssl.org On Behalf Of Derek Cole Sent: Friday, 12 October, 2012 11:22 So I think you were right. I used a command to view the CSR that I generated with the following: openssl req -new -nodes -subj /CN=www.myserver.com -out /tmp/file.csr -keyout /tmp/privkey.csr

Re: Firefox unhappy with my self signed Cert

Interesting. While I was playing around with this, I actually noticed that if I use the -subj option on the CSR, I am not able to do this. I was able to get it working by adding the common name on the actual cert generation from that CSR. The config file was modified so that for my priority_match,

Re: Inconsistent behavior between FIPS and non-FIPS AES

Hi aunt.jomamma, You have ignored every return value. You should probably start by checking all return values. If you check all return values *and* assert all the checks, you will have self debugging code. I find self debugging code the best code of all, but I'm kind of lazy. 2) Is there

Re: Inconsistent behavior between FIPS and non-FIPS AES

Hi Jeff, Thanks for the response ... all the return values are 1, including setting the FIPS mode. I had removed the checks in this stripped down example code to get to my point and try to show the relevant portions, and minimize the code for someone to look at. -AJ - Original Message

Encryption algorithm

The 'openssl cipher -v' command shows the following cipher suites: $ openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256)