private key extractipon from ecdsapriv.pem file
Hi , I run the below two command and generated the private key for ecdsa sign . But i thinks its not the correct lenght that why my signature creation is failing. 1.openssl ecparam -out ec_key.pem -name secp224r1 -genkey 2. openssl req -newkey ec:ec_key.pem -x509 -nodes -days 365 -keyout ecdsapriv.pem -out ecdsapublic.x509 cat ecdsapriv.pem -BEGIN PRIVATE KEY- MHgCAQAwEAYHKoZIzj0CAQYFK4EEACEEYTBfAgEBBBz5PninGQKcwsfBzSdQwL8Z sofs53EyzZPLWvzHoTwDOgAEipOs1lPyOKrz4D/WGLdh6yE0WhewJIPxoDP1Rf0V 6D2I5SBwV8Bv28zpitRviKIJTp8st1j9iGg= -END PRIVATE KEY- can anybody guide me which the private key here I am use for signing the data. Private ekey lenght should be 28 bytes for secp224r1 this curve. Thanks jeet __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: Openssl default_ca values while using HSM - LunaCA3
Hi Patrick ,
I did create the private key using sautil and tagged a label while creating
it ( "root-ca" ). I am working with my Safenet representative but the
documentation is lacking when it comes to integration with openssl command
line. I figured - ask the openssl experts here. Any help would be much
appreciated.
Thanks.
- Simon Charles -
> Subject: Re: Openssl default_ca values while using HSM - LunaCA3
> From: ppatter...@carillon.ca
> Date: Thu, 13 Dec 2012 13:54:11 -0500
> To: openssl-users@openssl.org; charlessi...@hotmail.com
>
> Hello Simon,
>
> The correct way is to have a "key pointer" file that you can use 'sautil' to
> create. Your SafeNet representative should be able to point you in the right
> direction.
>
> Best Regards,
>
> Patrick.
> On 2012-12-13, at 1:40 PM, simon charles wrote:
>
> >
> > Dr. Stephen ,
> > Thank you for your reply - here is the output of your recommended
> > command line
> >
> > /usr/local/openssl/ssl/bin/openssl ca -config CA.cnf -engine LunaCA3
> > -keyfile "root-ca" -keyform ENGINE -in test-svr-010req.pem -out
> > test-svr-010.pem -batch
> > Using configuration from CA.cnf
> > engine "LunaCA3" set.
> > unable to load certificate
> > 3086288524:error:02001002:system library:fopen:No such file or
> > directory:bss_file.c:169:fopen('root-ca','r') *
> > 3086288524:error:2006D080:BIO routines:BIO_new_file:no such
> > file:bss_file.c:172:
> > 3086288524:error:0906D06C:PEM routines:PEM_read_bio:no start
> > line:pem_lib.c:696:
> >
> > * Looks like it is trying to read the key from disk on not from the HSM.
> >
> > Thanks.
> >
> > - Simon Charles -
> >
> >
> >> Date: Thu, 13 Dec 2012 15:48:09 +0100
> >> From: st...@openssl.org
> >> To: openssl-users@openssl.org
> >> Subject: Re: Openssl default_ca values while using HSM - LunaCA3
> >>
> >> On Wed, Dec 12, 2012, simon charles wrote:
> >>
> >>> Sorry for the duplicate post - was not signed up with the forum and might
> >>> have missed a response to my question . Please resend your answers if you
> >>> have already replied to my query.
> >>>
> >>>
> >>> All ,
> >>> What would the default_ca section look like while using
> >>> LunaCA3 HSM for storing CA private key. Openssl looks for certificate
> >>> and private_key on disk - how do i make openssl ca routine aware of
> >>> private keys on the HSM ( LunaCA3 )
> >>>Thanks.
> >>>
> >>
> >> Currently you cannot set the ENGINE parameters in the configuration file.
> >> You
> >> can however set them on the command line with:
> >>
> >> openssl ca -engine -keyform e -keyfile
> >>
> >>
> >> --
> >> Dr Stephen N. Henson. OpenSSL project core developer.
> >> Commercial tech support now available see: http://www.openssl.org
> >> __
> >> OpenSSL Project http://www.openssl.org
> >> User Support Mailing Listopenssl-users@openssl.org
> >> Automated List Manager majord...@openssl.org
> >
>
> ---
> Patrick Patterson
> President and Chief PKI Architect
> Carillon Information Security Inc.
> http://www.carillon.ca
>
> tel: +1 514 485 0789
> mobile: +1 514 994 8699
> fax: +1 450 424 9559
>
>
>
>
>
> __
> OpenSSL Project http://www.openssl.org
> User Support Mailing Listopenssl-users@openssl.org
> Automated List Manager majord...@openssl.org
RE: openssl AES decrypt problem
>From: owner-openssl-us...@openssl.org On Behalf Of Hailei Hu >Sent: Thursday, 13 December, 2012 06:27 >Thanks to your reply. >The first solution: >"you can set the length parameter on the decrypt operation to be 16 which will >provide you with a result that is your original 10 bytes plus 6 bytes of >zeros, which you can then remove" >I think it may be a problem when the file is encrypted by other person, >because I do not konw the original size, and thus >I do not know how many bytes to remove. That's what padding schemes are for. Padding with zeros, if that's indeed what you have, only works for data that never ends with zeros, so you strip all trailing zeros (up to a block). Precisely because this doesn't work for all data it has fallen out of favor. The popular padding today (and the default for EVP) is PKCS#5/7, which is unambiguous for any data. http://en.wikipedia.org/wiki/Padding_(cryptography) >The second one I think would be a great solution.Thanks again. >On Wed, Dec 12, 2012 at 10:25 PM, engineereeyore wrote: > The problem is that aes_cbc is a block cipher and works on 16-byte blocks, > typically. By default, any data block that is less than this size is > padded, as is the case for you. Since you're only sending in 10 bytes, your > 10 bytes are being padded with zeros to make the block 16 bytes. > So, to answer your question, you can do one of two things. First, you can > set the length parameter on the decrypt operation to be 16 which will > provide you with a result that is your original 10 bytes plus 6 bytes of > zeros, which you can then remove. The better approach would be to specify > "no padding" in your structure. This can be done using the function > EVP_CIPHER_CTX_set_padding. Set the padding parameter to zero and your > output should always be the same length as your inputs. Only works if the data is (always) an exact multiple of the block size. If that's the case, yes, it preserves the size. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: Need help in loading private key for ECDSA
> From: owner-openssl-us...@openssl.org On Behalf Of Jeffrey Walton > Sent: Thursday, 13 December, 2012 16:31 > On Thu, Dec 13, 2012 at 12:34 AM, jeetendra gangele > wrote: > I have not really been following this thread, so please forgive my > dumb questions. > > Are you using a NIST curve? If I recall correctly, OpenSSL only > supports some (all?) NIST curves. If you are trying to use Bernstein's > Curve-25519 (or an arbitrary curve), I don't believe it will work. > OP's code in some places uses secp224r1 and in some places sect163k1. It's not clear which (if either?) is correct. IIRC both of these are in the NIST subset, but just SECG is enough to be standard. libcrypto EC_*, and thus EVP_*, supports both named/standard curves and "explicit" ones. I believe that includes cert verification as relevant to SSL/TLS, but haven't tested. libssl *for key exchange* only supports named curves. > How did you generate the private key (the exponent) and public key > (point on the curve)? > OP apparently didn't generate any key, he's trying to use key values he got from someplace that appear bogus. Nit: the primitive operation in ECC is called addition and the iterated form multiplication, so the privatekey value is called a multiplicand. Unlike RSA and DH, where multiplication in Z_n is iterated to give exponentiation. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
[PATCH] for openssl v102snap20121213 for WCE 420/WM5/WM6 target platform, to fix compilation issues, resubmitted
g is /ML, not /MC
* opt_cflags: /O1i replaced by /O1 /Oi, more clear...and because
grouping options is not clearly allowed in MS doc
* ex_libs: now includes winsock2 for wce (available since wce 4.1 !
dixit MS docs)
* ex_libs now includes explicitely COREDLL.LIB CORELIBC.LIB and
REJECT anyother default lib (such as libc!)
because other DO NOT make sense on wce, although MS doc says so,
and do not even exist ! (there is no libc in wce 420 sdk).
* multitarget/ multiple build support:
now I put a reference to wcecompat/lib/$(TARGETCPU)/wcecompatex.lib,
that EXPLICITELY contains TARGETCPU,
this allows easy multiple build, ie for multiple CPU, for WCE.
I adapted Essemer/wcecompat accordingly, you can download my patched
version here :
http://delaage.pierre.free.fr/contrib/wcecompat/wcecompat12_patched2X86.zip
util/ssleay.num :
regenerated with perl util/mkdef.pl crypto ssl update
bacause 3 symbols were missing to compile ssltest :
SSL_CTX_get_authz_data r
SSL_CTX_use_authz_file
SSL_SESSION_get_tlsext_authz_server_audit_proof
CREATED mywcebuild.bat : helper script to compile for every targetcpu
for WCE, this follows the general path
described in INSTALL.WCE. Just type commands like these :
mywcebuild ARMV4
mywcebuild ARMV4 clean
or with X86 as target etc...
to have what you want, without renaming or recompiling everything
when switching between various CPU.
Avoid repetitive pollution of environment when repeteadly run with
the same target.
CREATED myw32build.bat : helper script to compile for every targetcpu
for W32, this follows the general path
described in INSTALL.W32. Just type commands like these :
myw32build
myw32build clean
Avoid repetitive pollution of environment when repeteadly run.
THOSE TWO SCRIPTS are put in the attached zip, because bat files were
rejected by rt_openssl mail system.
NOTE 2 : just in case it may help, precompiled (patched) versions of
PREVIOUS
openssl v100a and stunnel v434 for ARMV4 processors/WCE420 platform,
are available at http://delaage.pierre.free.fr.
The v100a patch is described here :
http://rt.openssl.org/index.html?q=2350
THERE IS NOT YET precompiled V102snap for WCE at that time on my
webpage. It will come later.
But if my patch is included in the openssl mainstream, my webpage
will be useless (and it will be good like this).
The result works fine for HTC WM6 smartphones, and should work for WM5
phones.
Thank you very much for your work.
Yours sincerely,
Pierre Delaage
p
diff -ur orig/apps/apps.c patch1/apps/apps.c
--- orig/apps/apps.c2012-12-04 19:00:52.0 +0100
+++ patch1/apps/apps.c 2012-12-13 20:15:19.477399000 +0100
@@ -118,7 +118,7 @@
#include
#include
#include
-#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(NETWARE_CLIB)
+#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(OPENSSL_SYSNAME_WINCE) &&
!defined(NETWARE_CLIB) /* pdelaage 20121213 */
#include
#endif
#include
diff -ur orig/apps/apps.h patch1/apps/apps.h
--- orig/apps/apps.h2011-11-13 22:55:41.0 +0100
+++ patch1/apps/apps.h 2012-12-13 20:15:38.237917000 +0100
@@ -202,7 +202,8 @@
# endif
#endif
-#ifdef OPENSSL_SYSNAME_WIN32
+/* pdelaage 20121213 #ifdef OPENSSL_SYSNAME_WIN32 */
+#if defined(OPENSSL_SYSNAME_WIN32) || defined(OPENSSL_SYSNAME_WINCE)
# define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
#else
# define openssl_fdset(a,b) FD_SET(a, b)
diff -ur orig/crypto/bio/bss_dgram.c patch1/crypto/bio/bss_dgram.c
--- orig/crypto/bio/bss_dgram.c 2012-08-14 12:00:24.0 +0200
+++ patch1/crypto/bio/bss_dgram.c 2012-12-13 14:33:30.746096500 +0100
@@ -1896,10 +1896,44 @@
static void get_current_time(struct timeval *t)
{
#ifdef OPENSSL_SYS_WIN32
+#ifndef OPENSSL_SYSNAME_WINCE /* pdelaage 20121213: for WCE, ftime does not
exist. */
+/* pdelaage 20121213: for openssl team: this code can be replaced by the WCE
code below, but I will not take that decision myself: as much as possible I
only deal with wce port without modiying existing code */
struct _timeb tb;
_ftime(&tb);
t->tv_sec = (long)tb.time;
t->tv_usec = (long)tb.millitm * 1000;
+#else /* pdelaage 20121213: WCE, code THAT IS OK with ALL WIN32 Os,, this is a
msg for ANdy Poliakov ap...@openssl.org*/
+/* pdelaage 20121213:: Andy, GetSystemTimeAsFileTime is not available on WCE,
but my code does the same */
+
+ SYSTEMTIME stmToday_l, stm19700101_l;
+ FILETIME ftmToday_l, ftm19700101_l;
+ ULARGE_INTEGER uliToday_l, uli19700101_l, uliElapsed_l;
+
+ stm19700101_l.wYear = 1970;
+ stm19700101_l.wMonth= 1;
+ stm19700101_l.wDay= 1;
+ stm19700101_l.wHour =0;
+ stm19700101_l.wMinute = 0;
+ stm19700101_l.wSecond =0;
+ stm19700101_l.wMilliseconds = 0;
+
+ GetLocalTime(&stmToday_l);
+
+ SystemTimeToFileTime(&stm197001
Re: Help in loading EC_KEY
On Thu, Dec 13, 2012 at 4:04 AM, jeetendra gangele wrote:
> HI,
>
> I am trying to sign the data using EC-DSA algorithm.
> i have the private key to sign the data and I could load using
> EC_KEY_set_private_key.
> But when check the loaded key its failing with the error code below.
> error:100B1043:lib(16):func(177):reason(67)
> EC_KEY_check_key failed:
>
> That means key not proper.
> I am trying to use the curve NID_secp224r1.
...
> 37 if(NULL == pub_key)
> 38 printf("pub failed");
> 39
> 40 if (!EC_KEY_check_key(pkey)) {
> 41 printf("EC_KEY_check_key failed:\n");
> 42 printf("%s\n",ERR_error_string(ERR_get_error(),NULL));
> 43 }
Is it pub_key or pkey?
Jeff
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: Need help in loading private key for ECDSA
On Thu, Dec 13, 2012 at 12:34 AM, jeetendra gangele wrote: > Hi i tried to load private key into 224 curve for ecdsa and I am > getting below error. > > EC_KEY_check_key failed: > error:100B1043:lib(16):func(177):reason(67). > > Bleow is my fun to load key. > > Can anybody guide me? $ openssl errstr 100B1043 error:100B1043:elliptic curve routines:EC_KEY_check_key:passed a null parameter I have not really been following this thread, so please forgive my dumb questions. Are you using a NIST curve? If I recall correctly, OpenSSL only supports some (all?) NIST curves. If you are trying to use Bernstein's Curve-25519 (or an arbitrary curve), I don't believe it will work. How did you generate the private key (the exponent) and public key (point on the curve)? Jeff __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: NIST Special Publication 800-56A Compliance
Steve, Thank you very much for your response. > If you can get that lab to publish the details, please do :-) I will check. Thanks, John On Thu, Dec 13, 2012 at 7:53 AM, Steve Marquess < marqu...@opensslfoundation.com> wrote: > On 12/12/2012 06:17 PM, John Corbin wrote: > > Is there a document that lists the appropriate 800-56a standards the > > OpenSSL FIPS module conforms to and for each applicable section listed in > > the 800-56a standard as conforming, is there a listing for all statements > > that are not "shall" (that is, "shall not", "should", and "should not")? > If > > the included functionality is indicated as "shall not" or "should not" in > > the 800-56a standard, then is there a document providing rationale for > why > > this will not adversely affect the security policy implemented by the > > OpenSSL FIPS module. Is any omission of functionality related to "shall" > or > > “should” statements described? > > > > I have looked at the document OpenSSL FIPS Object Module Version 2.0.2 > and > > looked at table 4a but did not find a detailed discussion on how it > > satisfies the 800-56a standard. > > There is no such document. We have already published what we can. In the > course of that validation (#1747) we responded to many questions from > the test lab about SP 800-56A, but that correspondence is strewn across > many months. That test lab presumably has an internal analysis summary > but if so it has not been made available to us or to the public. > > Note it is the function of the accredited test lab to perform a review > of all aspects of FIPS 140-2, in particular the Derived Test > Requirements, but the test lab is not obligated to release the details > of such assessments, and in my experience none of them do. Those details > are treated as a trade secret. The FIPS 140-2 validation process is not > an open one; we've done what we could to open it up but there is much > that the prospective vendor seeking a new independent validation must > revisit. > > I will note that, to the extent I have been privy to details on that > type of internal test lab analysis, different test labs often take very > different approaches. So an analysis done by lab A may be of minimal use > to lab B. The same basic OpenSSL FIPS Object code has now been validated > many times by multiple test labs, so we know that there are one or more > correct answers to every question that arises in the course of a > validation, but those individual answers are not necessarily consistent > from one validation to another. You'll need to work with your test lab > to develop your own set of internally consistent answers. > > If you can get that lab to publish the details, please do :-) > > -Steve M. > > -- > Steve Marquess > OpenSSL Software Foundation, Inc. > 1829 Mount Ephraim Road > Adamstown, MD 21710 > USA > +1 877 673 6775 s/b > +1 301 874 2571 direct > marqu...@opensslfoundation.com > marqu...@openssl.com >
Re: Openssl default_ca values while using HSM - LunaCA3
Hello Simon,
The correct way is to have a "key pointer" file that you can use 'sautil' to
create. Your SafeNet representative should be able to point you in the right
direction.
Best Regards,
Patrick.
On 2012-12-13, at 1:40 PM, simon charles wrote:
>
> Dr. Stephen ,
> Thank you for your reply - here is the output of your recommended command
> line
>
> /usr/local/openssl/ssl/bin/openssl ca -config CA.cnf -engine LunaCA3
> -keyfile "root-ca" -keyform ENGINE -in test-svr-010req.pem -out
> test-svr-010.pem -batch
> Using configuration from CA.cnf
> engine "LunaCA3" set.
> unable to load certificate
> 3086288524:error:02001002:system library:fopen:No such file or
> directory:bss_file.c:169:fopen('root-ca','r') *
> 3086288524:error:2006D080:BIO routines:BIO_new_file:no such
> file:bss_file.c:172:
> 3086288524:error:0906D06C:PEM routines:PEM_read_bio:no start
> line:pem_lib.c:696:
>
> * Looks like it is trying to read the key from disk on not from the HSM.
>
> Thanks.
>
> - Simon Charles -
>
>
>> Date: Thu, 13 Dec 2012 15:48:09 +0100
>> From: st...@openssl.org
>> To: openssl-users@openssl.org
>> Subject: Re: Openssl default_ca values while using HSM - LunaCA3
>>
>> On Wed, Dec 12, 2012, simon charles wrote:
>>
>>> Sorry for the duplicate post - was not signed up with the forum and might
>>> have missed a response to my question . Please resend your answers if you
>>> have already replied to my query.
>>>
>>>
>>> All ,
>>> What would the default_ca section look like while using
>>> LunaCA3 HSM for storing CA private key. Openssl looks for certificate
>>> and private_key on disk - how do i make openssl ca routine aware of
>>> private keys on the HSM ( LunaCA3 )
>>>Thanks.
>>>
>>
>> Currently you cannot set the ENGINE parameters in the configuration file. You
>> can however set them on the command line with:
>>
>> openssl ca -engine -keyform e -keyfile
>>
>>
>> --
>> Dr Stephen N. Henson. OpenSSL project core developer.
>> Commercial tech support now available see: http://www.openssl.org
>> __
>> OpenSSL Project http://www.openssl.org
>> User Support Mailing Listopenssl-users@openssl.org
>> Automated List Manager majord...@openssl.org
>
---
Patrick Patterson
President and Chief PKI Architect
Carillon Information Security Inc.
http://www.carillon.ca
tel: +1 514 485 0789
mobile: +1 514 994 8699
fax: +1 450 424 9559
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
RE: Openssl default_ca values while using HSM - LunaCA3
/usr/local/openssl/ssl/bin/openssl version
OpenSSL 1.0.0e 6 Sep 2011
- Simon Charles -
> Date: Thu, 13 Dec 2012 19:53:40 +0100
> From: st...@openssl.org
> To: openssl-users@openssl.org
> Subject: Re: Openssl default_ca values while using HSM - LunaCA3
>
> On Thu, Dec 13, 2012, simon charles wrote:
>
> >
> > Dr. Stephen ,
> > Thank you for your reply - here is the output of your recommended
> > command line
> >
> > /usr/local/openssl/ssl/bin/openssl ca -config CA.cnf -engine LunaCA3
> > -keyfile "root-ca" -keyform ENGINE -in test-svr-010req.pem -out
> > test-svr-010.pem -batch
> > Using configuration from CA.cnf
> > engine "LunaCA3" set.
> > unable to load certificate
> > 3086288524:error:02001002:system library:fopen:No such file or
> > directory:bss_file.c:169:fopen('root-ca','r') *
> > 3086288524:error:2006D080:BIO routines:BIO_new_file:no such
> > file:bss_file.c:172:
> > 3086288524:error:0906D06C:PEM routines:PEM_read_bio:no start
> > line:pem_lib.c:696:
> >
> > * Looks like it is trying to read the key from disk on not from the HSM.
> >
>
> Weird. What version of OpenSSL is that?
>
> I checked the source and it *should* be passing the key format parameter to
> the load_key function. Can you check under a debugger?
>
> Steve.
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
> __
> OpenSSL Project http://www.openssl.org
> User Support Mailing Listopenssl-users@openssl.org
> Automated List Manager majord...@openssl.org
Re: Openssl default_ca values while using HSM - LunaCA3
On Thu, Dec 13, 2012, simon charles wrote:
>
> Dr. Stephen ,
> Thank you for your reply - here is the output of your recommended
> command line
>
> /usr/local/openssl/ssl/bin/openssl ca -config CA.cnf -engine LunaCA3
> -keyfile "root-ca" -keyform ENGINE -in test-svr-010req.pem -out
> test-svr-010.pem -batch
> Using configuration from CA.cnf
> engine "LunaCA3" set.
> unable to load certificate
> 3086288524:error:02001002:system library:fopen:No such file or
> directory:bss_file.c:169:fopen('root-ca','r') *
> 3086288524:error:2006D080:BIO routines:BIO_new_file:no such
> file:bss_file.c:172:
> 3086288524:error:0906D06C:PEM routines:PEM_read_bio:no start
> line:pem_lib.c:696:
>
> * Looks like it is trying to read the key from disk on not from the HSM.
>
Weird. What version of OpenSSL is that?
I checked the source and it *should* be passing the key format parameter to
the load_key function. Can you check under a debugger?
Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
RE: Openssl default_ca values while using HSM - LunaCA3
Dr. Stephen ,
Thank you for your reply - here is the output of your recommended command
line
/usr/local/openssl/ssl/bin/openssl ca -config CA.cnf -engine LunaCA3 -keyfile
"root-ca" -keyform ENGINE -in test-svr-010req.pem -out test-svr-010.pem -batch
Using configuration from CA.cnf
engine "LunaCA3" set.
unable to load certificate
3086288524:error:02001002:system library:fopen:No such file or
directory:bss_file.c:169:fopen('root-ca','r') *
3086288524:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:172:
3086288524:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:
* Looks like it is trying to read the key from disk on not from the HSM.
Thanks.
- Simon Charles -
> Date: Thu, 13 Dec 2012 15:48:09 +0100
> From: st...@openssl.org
> To: openssl-users@openssl.org
> Subject: Re: Openssl default_ca values while using HSM - LunaCA3
>
> On Wed, Dec 12, 2012, simon charles wrote:
>
> > Sorry for the duplicate post - was not signed up with the forum and might
> > have missed a response to my question . Please resend your answers if you
> > have already replied to my query.
> >
> >
> > All ,
> > What would the default_ca section look like while using
> > LunaCA3 HSM for storing CA private key. Openssl looks for certificate
> > and private_key on disk - how do i make openssl ca routine aware of
> > private keys on the HSM ( LunaCA3 )
> > Thanks.
> >
>
> Currently you cannot set the ENGINE parameters in the configuration file. You
> can however set them on the command line with:
>
> openssl ca -engine -keyform e -keyfile
>
>
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
> __
> OpenSSL Project http://www.openssl.org
> User Support Mailing Listopenssl-users@openssl.org
> Automated List Manager majord...@openssl.org
Re: loading public point
Thanks for your reply.
I just random value i have given.
how did you calculate that ?.
like for 224 curve point will be 56 byte long?
what about private key for 224 it will be 28 byte long?.
Ya i observed i am not able to calculate these test values thats why
its failing.
Can you give me any point value for 224 ,also for private key value.
if possible can you guide me where can i read these details.
test values where can i get.
> The hex should be 04|x|y which would be 43 bytes, so string whats is the
> meaning of this line?
On 13 December 2012 23:05, Douglas E. Engert wrote:
> Where did you get the hex version of the point?
> It does not look correct, its the wrong length.
> For the curve you picked, The field size is 21 bytes.
> The hex should be 04|x|y which would be 43 bytes, so string
> should be 86 bytes with a leading 04.
>
>
>
> On 12/13/2012 12:23 AM, jeetendra gangele wrote:
>>
>> Hi
>> I have written below code but it always failed with
>>
>> EC_KEY_check_key failed:
>> error:100A0066:lib(16):func(160):reason(102)
>>
>>
>> 1#include
>>2 #include "openssl/sha.h"
>>3 #include
>>4
>>5 #include
>>6 #include
>>7 #include
>>8 #include
>>9 #include
>> 10 #include
>> 11 #include
>> 12 #include
>> 13 int main()
>> 14 {
>> 15 EC_KEY*key = NULL;
>> 16 EC_POINT *pub_key;
>> 17 const EC_GROUP *group;
>> 18
>> 19
>> 20 key = EC_KEY_new_by_curve_name(NID_sect163k1);
>> 21 group = EC_KEY_get0_group(key);
>> 22 pub_key = EC_POINT_new(group);
>> 23
>> 24 EC_POINT_hex2point(group,
>> 25
>> "369368AF243193D001E39CE76BB1D5DA08A9BC0A63307AB352338E5EA5C0E05A0C2531866F3E3C2702",
>> pub_key, NULL);
>> 26
>> 27 EC_KEY_set_public_key(key, pub_key);
>> 28
>> 29 if (!EC_KEY_check_key(key)) {
>> 30 printf("EC_KEY_check_key failed:\n");
>> 31 printf("%s\n",ERR_error_string(ERR_get_error(),NULL));
>> 32 } else {
>> 33 printf("Public key verified OK\n");
>> 34 }
>> 35 return 1;
>> 36 }
>> __
>> OpenSSL Project http://www.openssl.org
>> Development Mailing List openssl-...@openssl.org
>> Automated List Manager majord...@openssl.org
>>
>>
>
> --
>
> Douglas E. Engert
> Argonne National Laboratory
> 9700 South Cass Avenue
> Argonne, Illinois 60439
> (630) 252-5444
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: NIST Special Publication 800-56A Compliance
On 12/12/2012 06:17 PM, John Corbin wrote: > Is there a document that lists the appropriate 800-56a standards the > OpenSSL FIPS module conforms to and for each applicable section listed in > the 800-56a standard as conforming, is there a listing for all statements > that are not "shall" (that is, "shall not", "should", and "should not")? If > the included functionality is indicated as "shall not" or "should not" in > the 800-56a standard, then is there a document providing rationale for why > this will not adversely affect the security policy implemented by the > OpenSSL FIPS module. Is any omission of functionality related to "shall" or > “should” statements described? > > I have looked at the document OpenSSL FIPS Object Module Version 2.0.2 and > looked at table 4a but did not find a detailed discussion on how it > satisfies the 800-56a standard. There is no such document. We have already published what we can. In the course of that validation (#1747) we responded to many questions from the test lab about SP 800-56A, but that correspondence is strewn across many months. That test lab presumably has an internal analysis summary but if so it has not been made available to us or to the public. Note it is the function of the accredited test lab to perform a review of all aspects of FIPS 140-2, in particular the Derived Test Requirements, but the test lab is not obligated to release the details of such assessments, and in my experience none of them do. Those details are treated as a trade secret. The FIPS 140-2 validation process is not an open one; we've done what we could to open it up but there is much that the prospective vendor seeking a new independent validation must revisit. I will note that, to the extent I have been privy to details on that type of internal test lab analysis, different test labs often take very different approaches. So an analysis done by lab A may be of minimal use to lab B. The same basic OpenSSL FIPS Object code has now been validated many times by multiple test labs, so we know that there are one or more correct answers to every question that arises in the course of a validation, but those individual answers are not necessarily consistent from one validation to another. You'll need to work with your test lab to develop your own set of internally consistent answers. If you can get that lab to publish the details, please do :-) -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct marqu...@opensslfoundation.com marqu...@openssl.com __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: genrsa question how secure is the random creation
On Tue, Dec 11, 2012 at 8:06 PM, Michael Sierchio wrote: > - Select an interval near the desired size [ 2^1023 + 1^1022 + 1 , 2^1024 - 1 ] > - Sieve out composites divisible by small primes > - Select two probable primes such that (p - q) is reasonably large > (2^100 or so) to defeat the difference-of-squares method Before testing for primality, make sure that p mod e != 1, where e is the public exponent > - Perform enough primality tests to convince yourself they're prime ;-) > - other common criteria aren't really helpful - e.g. strong primes > (they were never necessary for RSA), restrictions on p-1 and q-1 > (Elliptic Curve Method factoring makes those obsolete) __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Regarding OpenSSL on metro app
On 12 December 2012 13:07, Mamillapalli, Balachandra wrote: > · Does OpenSSL compatible with Windows 8 Metro App? 1.yes it requires perl software 2.no its not __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Openssl default_ca values while using HSM - LunaCA3
On Wed, Dec 12, 2012, simon charles wrote: > Sorry for the duplicate post - was not signed up with the forum and might > have missed a response to my question . Please resend your answers if you > have already replied to my query. > > > All , > What would the default_ca section look like while using > LunaCA3 HSM for storing CA private key. Openssl looks for certificate > and private_key on disk - how do i make openssl ca routine aware of > private keys on the HSM ( LunaCA3 ) > Thanks. > Currently you cannot set the ENGINE parameters in the configuration file. You can however set them on the command line with: openssl ca -engine -keyform e -keyfile -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Openssl ca parameters while using HSM
All , What would the default_ca section look like while using LunaCA3 HSM for storing CA private key. Openssl looks for certificate and private_key on disk - how do i make openssl ca routine aware of private keys on the HSM ( LunaCA3 ) Thanks. - Simon Charles -
Regarding OpenSSL on metro app
Hello, Currently I am trying to port one of our C++ application to metro app. Our source is dependent on OpenSSL library. Just like to know, * Does OpenSSL requires to install Perl software? * Does OpenSSL compatible with Windows 8 Metro App? Thanks.
OpenSSL openssl-fips-2.0.2 and private label
Hi All, I had one question regarding usage of openssl-fips-2.0.2. I want to use openssl-fips-2.0.2 to get NIST compliance for some crypto functionality*.* I don't want to go for FIPS 140-2 certification/validation. Still can I use some parts of openssl-fips-2.0.2 module along with OpenSSL library to use FIPS 140-2 functionality. Is it mandatory to get a private label if I make any changes to openssl-fips-2.0.2 module or if I want to use part of openssl-fips-2.0.2 module. Regards BR
Re: Set up the protocol
Le 12/12/2012 20:12, Alex Chen a écrit : Another question is how to enforce the 'server' side preference of the cipher suite selection? Is it also part of the SSL_CTX_set_options() Isn't this what you are looking for ? : SSL_OP_CIPHER_SERVER_PREFERENCE in http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
