Recall: Help needed on to compile OpenSSL with FIPS

2012-10-22 Thread Bhat, Jayalakshmi Manjunath
Bhat, Jayalakshmi Manjunath would like to recall the message, Help needed on to compile OpenSSL with FIPS.__ OpenSSL Project http://www.openssl.org Development Mailing List

How to uses FIPS 2.0.1 with OpenSSL 1.0.1

2012-10-22 Thread Bhat, Jayalakshmi Manjunath
Hi All, I wanted to know the procedure and steps for cross compiling OpenSSL on Linux along with FIPS? Regards Jaya

Re: Question on OpenSSL internals

2012-10-22 Thread Ben Laurie
On Sat, Oct 20, 2012 at 5:08 AM, Joe Pletcher joepletc...@gmail.com wrote: Hello all, I hope this question is more appropriate for this list. I tried openssl-users with no luck. If not, I apologize in advance. I'm working on an OpenSSL project, and I could use some help. I am writing a

Help needed on to compile OpenSSL with FIPS

2012-10-22 Thread Bhat, Jayalakshmi Manjunath
Hi All, I wanted to know how to cross compile OpenSSL with FIPS enabled? Regards Jaya

OpenSSL choosing inappropriate signature algorithm

2012-10-22 Thread Erik Tkal
Using OpenSSL 1.0.1c I notice that the client always sends the full set of supported signature algorithms in the clientHello, with no option to limit this at runtime. However, if using callbacks to choose a certificate and perform the private key operation via callback (the certificate is

RE: OpenSSL choosing inappropriate signature algorithm

2012-10-22 Thread Erik Tkal
It appears that the clientHello only indicates overall what the client supports. The server sends another such list in its certificateRequest message. I'm trying to find where in the client code the determination is made as to which algorithm to use...

RE: Interesting article about mitm attack to ssl

2012-10-22 Thread Eric Johanson
Yes, developers who use security APIs are generally uninformed. This is exacerbated by their managers who want software systems finished and shipped yesterday. So when you're implementing a secure system where millions of dollars are entrusted to your system's security, hire an expert security

RE: OpenSSL choosing inappropriate signature algorithm

2012-10-22 Thread Erik Tkal
It looks like the client sets the hash to use for each key type to the first matching algorithm sent by the server in the certificateRequest. These values are stored in a private structure with no apparent way for client code to modify this, and it seems both the client and server always send

Re: OpenSSL choosing inappropriate signature algorithm

2012-10-22 Thread Dr. Stephen Henson
On Mon, Oct 22, 2012, Erik Tkal wrote: It looks like the client sets the hash to use for each key type to the first matching algorithm sent by the server in the certificateRequest. These values are stored in a private structure with no apparent way for client code to modify this, and it