[openssl.org #3253] Compile issues - Solaris 10

2014-02-03 Thread Richard Basch via RT
I use a complex CC setting, when I compile, to use gcc but with static libgcc (gcc -m64 -static-libgcc), but when I pass this in via the environment, the updated Makefile.org in the 1.0.1f distribution chokes with /bin/sh: bad substitution on Solaris 10 (x86). The line in Makefile.org which is

[openssl.org #3253] Compile issues - Solaris 10

2014-02-03 Thread Stephen Henson via RT
On Mon Feb 03 10:10:53 2014, ba...@alum.mit.edu wrote: I use a complex CC setting, when I compile, to use gcc but with static libgcc (gcc -m64 -static-libgcc), but when I pass this in via the environment, the updated Makefile.org in the 1.0.1f distribution chokes with /bin/sh: bad substitution

Re: FIPS certification

2014-02-03 Thread Steve Marquess
On 02/03/2014 09:30 AM, Leon Brits wrote: Steve, Thanks for your help so far. Q: How is this certification of the algorithms done? Our device only has a USB interface acting like a smartcard so will the lab (or OSF) use our cryptoki/CSP interface(s) to validate the algorithms or should

Using AF_ALG with openssl

2014-02-03 Thread tera tellence
Dear All, i am trying to built the AF_ALG API to access kernel cryptographic API on an ubuntu machine. I donwloaded the aF_ALG open SOurce code and followed the instructions to compile it. I then copied the shared library in the openssl engine path. But I have the following error when I tried to

[PATCH] Disable RC4 for TLS v1.1+ (server-side).

2014-02-03 Thread Piotr Sikora
(this was originally sent to rt@, but it never made it through) Hello, considering that RC4 is pretty much broken by now, I don't think there is a good reason for using it in TLS v1.1+. Attached patch stops servers from negotiating RC4-based cipher suites on connections using TLS v1.1+. This is

RE: [PATCH] Disable RC4 for TLS v1.1+ (server-side).

2014-02-03 Thread Watson, Patrick
While no longer using RC4 might be a good idea, I'm not certain that OpenSSL should /force/ it as long as the cipher is still a valid choice. This seems like a job for SSL_CTX_set_cipher_list (http://www.openssl.org/docs/ssl/SSL_CTX_set_cipher_list.html). A good server would be calling this