Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-01-02 Thread Ben Laurie
On 20 December 2013 18:51, Stephen Henson via RT r...@openssl.org wrote: On Fri Dec 20 19:04:32 2013, d...@fifthhorseman.net wrote: I can do whatever you think is most useful, but i need a bit more guidance to be sure i'm giving you what will be most useful for you. I've pulled the update

[openssl.org #3206] Bug: EVP_PBE_alg_add() registers PBEs with incorrect cipher NIDs

2014-01-02 Thread Gibbons, Lee D via RT
The following bug has been reproduced on RedHat Enterprise Linux with OpenSSL 1.0.1e. When upgrading from 0.9.8e to 1.0.1e we noticed that a call to PKCS12_parse() would sometimes fail with the following: 3073869560:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad

Re: Safe ECC curves

2014-01-02 Thread Dr. Stephen Henson
On Thu, Jan 02, 2014, Salz, Rich wrote: So Curve25519 needs a standard OID and some notes on the format to use for ASN.1. Does such a thing exist? I don't think so. Perhaps the TLS list is the place to discuss this? Should we (I?) start a thread there on a proposal to fit Curve25519

Re: Safe ECC curves

2014-01-02 Thread Manuel Pégourié-Gonnard
On 02/01/2014 01:44, Kyle Hamilton wrote: djb has a fixed-clock-cycle algorithm he wrote in GNU assembly for Athlon. I am unhappy with his insistence that nobody should try to implement it for other platforms, as though Athlon is the only platform anyone would ever need. I agree that a

Re: Safe ECC curves

2014-01-02 Thread Dr. Stephen Henson
On Thu, Jan 02, 2014, Daniel Kahn Gillmor wrote: On 01/02/2014 08:50 AM, Salz, Rich wrote: [Dr. Stephen Henson wrote:] So Curve25519 needs a standard OID and some notes on the format to use for ASN.1. Does such a thing exist? I don't think so. yes, i mentioned it up-thread:

Re: Safe ECC curves

2014-01-02 Thread Daniel Kahn Gillmor
On 01/02/2014 12:35 PM, Dr. Stephen Henson wrote: That's just TLS. To add more complete support to OpenSSL including storing private keys in PEM files and public keys in case we ever use it in ECDH certificates it needs an OID and some details on how the keys are encoded. But ECDHE doesn't

Re: Safe ECC curves

2014-01-02 Thread Kurt Roeckx
On Thu, Jan 02, 2014 at 12:59:39PM -0500, Daniel Kahn Gillmor wrote: On 01/02/2014 12:35 PM, Dr. Stephen Henson wrote: That's just TLS. To add more complete support to OpenSSL including storing private keys in PEM files and public keys in case we ever use it in ECDH certificates it needs an

Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-01-02 Thread Daniel Kahn Gillmor
On 01/02/2014 03:32 PM, Ben Laurie wrote: On 1 January 2014 21:39, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 01/01/2014 12:48 PM, Ben Laurie wrote: Pull requests on Github are quite useful - that way they also get tracked (so long as we remember to close them when applied, that

Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-01-02 Thread Daniel Kahn Gillmor via RT
On 01/02/2014 03:32 PM, Ben Laurie wrote: On 1 January 2014 21:39, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 01/01/2014 12:48 PM, Ben Laurie wrote: Pull requests on Github are quite useful - that way they also get tracked (so long as we remember to close them when applied, that

Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-01-02 Thread Ben Laurie via RT
On 1 January 2014 21:39, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 01/01/2014 12:48 PM, Ben Laurie wrote: Pull requests on Github are quite useful - that way they also get tracked (so long as we remember to close them when applied, that is!). OK, i've rebased the series against the

[openssl.org #3203] Normalize PFS key exchange labels

2014-01-02 Thread Stephen Henson via RT
On Mon Dec 30 22:47:32 2013, d...@fifthhorseman.net wrote: I don't mean to be impatient -- if it's just a matter of playing catchup over the close of the winter holiday, i can wait :) Yes that's pretty much it. I'll be looking reviewing the patches in the next few days. Steve. -- Dr Stephen

[openssl.org #2480] ... 3 recipients: generation error

2014-01-02 Thread Barry Allard via RT
I just encountered this issue with precisely the same error.  It appears with all configurations including 'no-des'. 1.0.1e tarball OSX 10.9.1 XCode 5.0.2 # minimal test-case  ./Configure no-des make depend make make test — Sent from Mailbox for iPhone