Re: OpenSSL and CRIME

2012-10-24 Thread Tomas Mraz
On Tue, 2012-10-23 at 20:18 +0200, Dr. Stephen Henson wrote: On Tue, Oct 23, 2012, Tomas Hoger wrote: On Thu, 18 Oct 2012 23:55:41 +0200 Andrey Kulikov wrote: OpenSSL enables zlib by default. Could you please advice for what version and platform this is true?

Re: OpenSSL and CRIME

2012-10-23 Thread Tomas Hoger
On Thu, 18 Oct 2012 23:55:41 +0200 Andrey Kulikov wrote: OpenSSL enables zlib by default. Could you please advice for what version and platform this is true? openssl-1.0.1c for linux-elf has no-zlib configured by default. Sorry, I asked the wrong way. OpenSSL, when compiled with zlib

Re: OpenSSL and CRIME

2012-10-23 Thread Dr. Stephen Henson
On Tue, Oct 23, 2012, Tomas Hoger wrote: On Thu, 18 Oct 2012 23:55:41 +0200 Andrey Kulikov wrote: OpenSSL enables zlib by default. Could you please advice for what version and platform this is true? openssl-1.0.1c for linux-elf has no-zlib configured by default. Sorry, I

Re: OpenSSL and CRIME

2012-10-18 Thread Andrey Kulikov
Hi, OpenSSL enables zlib by default. Could you please advice for what version and platform this is true? openssl-1.0.1c for linux-elf has no-zlib configured by default.

Re: OpenSSL and CRIME

2012-10-10 Thread Ben Laurie
On Mon, Oct 8, 2012 at 5:13 PM, Tomas Hoger tho...@redhat.com wrote: Hi! Are there any plans to apply any changes to OpenSSL related to the recent CRIME attack? Unlike other libraries (e.g. GnuTLS or NSS), OpenSSL enables zlib by default. Is there a plan to change the default in response

OpenSSL and CRIME

2012-10-08 Thread Tomas Hoger
Hi! Are there any plans to apply any changes to OpenSSL related to the recent CRIME attack? Unlike other libraries (e.g. GnuTLS or NSS), OpenSSL enables zlib by default. Is there a plan to change the default in response to the published attack? I'm aware of the existing SSL_OP_NO_COMPRESSION