Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Brian Smith
On Sat, Oct 31, 2015 at 11:50 AM, Alessandro Ghedini via RT wrote: > In any case memset_s is not available anywhere anyway, so that doesn't > really > matter. > Is it available in some places, e.g. https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/memset_s.3.ht

Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Brian Smith via RT
On Sat, Oct 31, 2015 at 11:50 AM, Alessandro Ghedini via RT wrote: > In any case memset_s is not available anywhere anyway, so that doesn't > really > matter. > Is it available in some places, e.g. https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/memset_s.3.ht

Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Kurt Roeckx via RT
On Sat, Oct 31, 2015 at 09:58:50AM -1000, Brian Smith wrote: > Alessandro Ghedini via RT wrote: > > > I was also wondering whether it would make sense to just drop the asm > > implementations. Does the speed-up justify the added complexity? > > > > IMO, it should work like this: > * memset_s whe

Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Alessandro Ghedini via RT
On Sat, Oct 31, 2015 at 07:59:03PM +, Brian Smith via RT wrote: > Alessandro Ghedini via RT wrote: > > > I was also wondering whether it would make sense to just drop the asm > > implementations. Does the speed-up justify the added complexity? > > > > IMO, it should work like this: > * memse

Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Brian Smith via RT
Alessandro Ghedini via RT wrote: > I was also wondering whether it would make sense to just drop the asm > implementations. Does the speed-up justify the added complexity? > IMO, it should work like this: * memset_s when memset_s is available. * Otherwise, SecureZeroMemory, when SecureZeroMemory

Re: [openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Brian Smith
Alessandro Ghedini via RT wrote: > I was also wondering whether it would make sense to just drop the asm > implementations. Does the speed-up justify the added complexity? > IMO, it should work like this: * memset_s when memset_s is available. * Otherwise, SecureZeroMemory, when SecureZeroMemory

Re: [openssl-dev] [openssl.org #4115] [PATCH] Remove remaining FIPS code

2015-10-31 Thread Richard Levitte
On October 31, 2015 2:09:50 PM GMT+01:00, Steve Marquess wrote: >On 10/31/2015 09:01 AM, Richard Levitte wrote: >> Can't recall previous discussions on this, but would it be possible >to have a FIPS engine? > >Of a sort, yes. I'll let Steve Henson speak to the details, but it is >his hope (and

Re: [openssl-dev] [openssl.org #4115] [PATCH] Remove remaining FIPS code

2015-10-31 Thread Steve Marquess
On 10/31/2015 09:01 AM, Richard Levitte wrote: > Can't recall previous discussions on this, but would it be possible to have a > FIPS engine? Of a sort, yes. I'll let Steve Henson speak to the details, but it is his hope (and mine) that FIPS module support for 1.1 and beyond would be modular so

[openssl-dev] [openssl.org #4117] [PATCH] Remove useless locking code

2015-10-31 Thread Alessandro Ghedini via RT
Hi, in commit 070c233 I didn't notice that the CRYPTO_w_lock()/CRYPTO_w_unlock() calls are now useless, so I made a patch to fix that. See the following GitHub pull request: https://github.com/openssl/openssl/pull/454 Cheers ___ openssl-bugs-mod maili

[openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()

2015-10-31 Thread Alessandro Ghedini via RT
Hi, the current platform-generic implementation of OPENSSL_cleanse() is very weird and IMO overly complex (its initial intent was to cleanse with values other than 0, but AFAICT none of the asm implementations do it), so I reimplemented it in a simpler way. I was also wondering whether it would m

Re: [openssl-dev] [openssl.org #4115] [PATCH] Remove remaining FIPS code

2015-10-31 Thread Richard Levitte
Can't recall previous discussions on this, but would it be possible to have a FIPS engine? Cheers Richard Steve Marquess skrev: (31 oktober 2015 13:34:33 CET) >On 10/31/2015 08:26 AM, Alessandro Ghedini via RT wrote: >> Hi, >> >> I don't know what your intentions are with FIPS support in ma

Re: [openssl-dev] [openssl.org #4115] [PATCH] Remove remaining FIPS code

2015-10-31 Thread Steve Marquess
On 10/31/2015 08:26 AM, Alessandro Ghedini via RT wrote: > Hi, > > I don't know what your intentions are with FIPS support in master, ... We would like to continue to provide a FIPS validated module for the 1.1 (and subsequent) releases. Unfortunately the current module ("OpenSSL FIPS Object Modu

[openssl-dev] [openssl.org #4115] [PATCH] Remove remaining FIPS code

2015-10-31 Thread Alessandro Ghedini via RT
Hi, I don't know what your intentions are with FIPS support in master, but after the removal of most if the fips/ code, several bits and pieces of now broken code have remained in the codebase. IMO it'd be better to just remove it for now. See the following GitHub pull request: https://github.com

[openssl-dev] [openssl.org #4114] Continuous integration for Windows

2015-10-31 Thread Alessandro Ghedini via RT
Hi, the current Travis CI setup lacks support for proper Windows support, so I prepared a patch to add configuration for the AppVeyor service [0] which provides continuous integration on Windows. See the following GitHub pull request: https://github.com/openssl/openssl/pull/456 Cheers [0] http:

[openssl-dev] [openssl.org #4113] [PATCH] Cleanup and update README

2015-10-31 Thread Alessandro Ghedini via RT
Hi, the current README in master contains a lot of outdated information and some weird wording, so I prepared a patch to fix it. See the following GitHub pull request: https://github.com/openssl/openssl/pull/457 Cheers ___ openssl-bugs-mod mailing lis