RE: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Leon Brits
Thanks for clarifying that for my. Using the example code at http://www.fredriks.se/?p=23, I've duplicated everything of the GCM mode for the CCM mode with the addition of setting the tag length in the beginning of the encryption function. The encryption succeed BUT the decryption fails.

RE: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Leon Brits
Just want to add that I do set the data sizes before EncryptUpdate and DecryptUpdate and mentioned in the CCM section of the OpenSSL support page. This page does answer both my questions (appologies), but I still fail to decrypt. Regards, Leon Brits Senior Design Engineer Parsec Work +27 12

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Dr. Stephen Henson
On Tue, Mar 05, 2013, Leon Brits wrote: Just want to add that I do set the data sizes before EncryptUpdate and DecryptUpdate and mentioned in the CCM section of the OpenSSL support page. This page does answer both my questions (appologies), but I still fail to decrypt. I'll add an example

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Matt Caswell
Hi Steve On 4 March 2013 14:22, Dr. Stephen Henson st...@openssl.org wrote: CMAC needs a separate API because it doesn't behave like a normal cipher. Check out the CMAC_* functions. They behave in a very similar way to the HMAC_* functions except they take a cipher instead of a digest

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Dr. Stephen Henson
On Tue, Mar 05, 2013, Matt Caswell wrote: Hi Steve On 4 March 2013 14:22, Dr. Stephen Henson st...@openssl.org wrote: CMAC needs a separate API because it doesn't behave like a normal cipher. Check out the CMAC_* functions. They behave in a very similar way to the HMAC_* functions

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Matt Caswell
On 5 March 2013 14:13, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 05, 2013, Leon Brits wrote: Just want to add that I do set the data sizes before EncryptUpdate and DecryptUpdate and mentioned in the CCM section of the OpenSSL support page. This page does answer both my

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Dr. Stephen Henson
On Tue, Mar 05, 2013, Matt Caswell wrote: On 5 March 2013 14:13, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 05, 2013, Leon Brits wrote: Just want to add that I do set the data sizes before EncryptUpdate and DecryptUpdate and mentioned in the CCM section of the OpenSSL

Re: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Matt Caswell
On 5 March 2013 18:36, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 05, 2013, Matt Caswell wrote: On 5 March 2013 14:13, Dr. Stephen Henson st...@openssl.org wrote: On Tue, Mar 05, 2013, Leon Brits wrote: Just want to add that I do set the data sizes before

Re: [openssl] OpenSSL source code branch master updated. e942c15451e1dedbe3a86e0e21a5312e5c43403e

2013-03-05 Thread Ben Laurie
Hey - why not make this a test? On 5 March 2013 18:31, Dr. Stephen Henson st...@openssl.org wrote: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project OpenSSL source code. The branch,

Are Openssl Random Number Generator NIST compliant ?

2013-03-05 Thread Nayna Jain
Hi all, Are RAND_seed(), RAND_add() NIST SP 800-151A compliant ? NIST SP 800-151A compliant enforces that RBGs specified in SP 800-90 (HASH, HMAC, CTR, DUAL_EC) and ANS X9.62-2005 (HMAC) are acceptable standards I think this depends on the engine being loaded. HOwever, not sure what engine is

RE: AES modes in FIPS and non-FIPS modes

2013-03-05 Thread Leon Brits
Dr. Henson and Matt, Thanks a lot for all the help - my code is also now working. I simply had to not do the DecryptFinal(). The fact that one can call the xxxUpdate() only once is a problem for using our engine. For now a size limit will have to be a limitation on this AES mode. Regards,