[openssl.org #2178] FW: [PATCH] (HEAD 0.9.8 and 1.0.0) eng_cryptodev patch

2010-03-01 Thread Stephen Henson via RT
> [brendan.kenn...@intel.com - Tue Mar 02 00:49:24 2010]: > > Sending the patch without the copyright – we don’t require it to be >there for small code changes. > Fix now applied, thanks for the report. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support

[openssl.org #2180] RE: [PATCH] (HEAD 0.9.8 and 1.0.0) eng_cryptodev patch

2010-03-01 Thread Kennedy, Brendan via RT
Sending the patch without the copyright – we don’t require it to be there for small code changes. Regards, Brendan -- Intel Shannon Limited Registered in Ireland Registered Office: Collinstown Industrial Park, Leixlip, County Kildare

Re: VMS build of the oncomming 0.9.8 release

2010-03-01 Thread Steven M. Schweda
An OpenSSL 0.9.8m kit which appears to work on VMS should be available at: http://antinode.info/ftp/openssl/0_9_8m/openssl-0_9_8m_s1.zip I believe that that kit is entirely UNIX-compatible (case-preserved, symlinks, and so on). Notes and "gdiff -ru" output: http://antinode.inf

Re: [openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Dr. Stephen Henson
On Mon, Mar 01, 2010, Kern Sibbald via RT wrote: > Hello, > > On Monday 01 March 2010 17:30:37 Stephen Henson via RT wrote: > > An alternative if you really want to keep changes to a minimum is to use > > the renamed functions EVP_PKEY_encrypt_old and EVP_PKEY_decrypt_old but > > you'd need versi

Re: [openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Kern Sibbald via RT
Hello, On Monday 01 March 2010 17:30:37 Stephen Henson via RT wrote: > An alternative if you really want to keep changes to a minimum is to use > the renamed functions EVP_PKEY_encrypt_old and EVP_PKEY_decrypt_old but > you'd need version dependence in that case. > Thank you for the very fast res

[openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Stephen Henson via RT
An alternative if you really want to keep changes to a minimum is to use the renamed functions EVP_PKEY_encrypt_old and EVP_PKEY_decrypt_old but you'd need version dependence in that case. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see:

Re: genrsa with engine uses software mode

2010-03-01 Thread Dr. Stephen Henson
On Mon, Mar 01, 2010, Jan C. wrote: > Hello, > I have an engine which implements the rsa_generate_key method. When I > want to generate a private key with the genrsa command, the key is > generated in software mode: > > > openssl genrsa -engine myengine -out /tmp/priv.pem 1024 > > I see that

[openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Stephen Henson via RT
I suppose it's just not my day today, third time lucky... OK here's the portable example: /* EVP_PKEY structure pkey */ RSA *trsa = EVP_PKEY_get1_RSA(pkey); ret = RSA_public_encrypt(key_len, key, encrypted_key, trsa, RSA_PKCS1_PADDING); RSA_free

[openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Stephen Henson via RT
> [steve - Mon Mar 01 14:57:21 2010]: > Darn message got cut short... continued. > > You can do this: > > ret = RSA_public_encrypt(key_len, key, encrypted_key, key->pkey.rsa, > RSA_PKCS1_PADDING); > Which is a drop in replacement for what you already in there. It accesses the internals of "k

[openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Stephen Henson via RT
> [k...@sibbald.com - Mon Mar 01 13:38:48 2010]: > > Hello, > > This is something between a request for information and a bug report. > > Background: > We have been using OpenSSL for many years in Bacula, which has created > a > number of license problems because we are GPL. > > Problem: > Our

Re: [openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Dr. Stephen Henson
On Mon, Mar 01, 2010, Dr. Stephen Henson wrote: > > Can you give me a pointer to where to see this code and I can give some more > information about how to address this. > Ah scrub that I've just spotted the code. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech

Re: [openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Dr. Stephen Henson
On Mon, Mar 01, 2010, Kern Sibbald via RT wrote: > Hello, > > This is something between a request for information and a bug report. > > Background: > We have been using OpenSSL for many years in Bacula, which has created a > number of license problems because we are GPL. > > Problem: > Our u

[openssl.org #2179] OpenSSL 1.0

2010-03-01 Thread Kern Sibbald via RT
Hello, This is something between a request for information and a bug report. Background: We have been using OpenSSL for many years in Bacula, which has created a number of license problems because we are GPL. Problem: Our users are reporting that Bacula no longer compiles under Fedora 12 beca

[openssl.org #2178] FW: [PATCH] (HEAD 0.9.8 and 1.0.0) eng_cryptodev patch

2010-03-01 Thread Stephen Henson via RT
> [brendan.kenn...@intel.com - Mon Mar 01 09:24:24 2010]: > > Hi All, > Note that due to this copyright notice: # Copyright(c) 2007,2008,2009 Intel Corporation. All rights reserved. # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modific

Re: [openssl.org #2177] New CFB block length breaks old encrypted data

2010-03-01 Thread Peter Waltenberg
I'm not sure the old code was wrong either. It's unintuitive, but it is at least possible to pass the NIST compliance tests with the old code - are you sure that's going to be possible with the new code ? Yes, I'm aware that there have been a lot of complaints about CFB in the past - but it was at

genrsa with engine uses software mode

2010-03-01 Thread Jan C.
Hello, I have an engine which implements the rsa_generate_key method. When I want to generate a private key with the genrsa command, the key is generated in software mode: > openssl genrsa -engine myengine -out /tmp/priv.pem 1024 I see that in the rsa_gen.c file the rsa structure, does not p

[openssl.org #2178] FW: [PATCH] (HEAD 0.9.8 and 1.0.0) eng_cryptodev patch

2010-03-01 Thread Kennedy, Brendan via RT
Hi All, Attached is a patch to the OpenSSL cryptodev engine (crypto/engine/eng_cryptodev.c). It was initially tested against OpenSSL0.9.8g, however before sending this email I validated the changes with the latest 1.0.0 and 0.9.8 stable snapshots. I include a description of each change bel

[openssl.org #2177] New CFB block length breaks old encrypted data

2010-03-01 Thread Kurt Roeckx via RT
Hi, With version 0.9.8m we're unable to read encrypted data written by older versions. The commit that breaks it has this changelog: The "block length" for CFB mode was incorrectly coded as 1 all the time. It should be the number of feedback bits expressed in bytes. For CFB1 mode set