OCSP Response problem

2010-07-11 Thread Wockenfuß , Frank
Hi all, I'm writing a program to check a certificate with OCSP in C++. I'm doing all in the same way as in ocsp.c from the OpenSSL-App, but I get no useful return from OCSP_RESPONSE* pOCSPResponse = NULL; nRet = OCSP_sendreq_nbio( &pOCSPResponse, pOCSPContext ); nRet is 0 and pO

Re: RSA_generate_key_ex documentation

2010-07-11 Thread Ger Hobbelt
The new API is called RSA_generate_key_ex() and has a different interface. To convert from the older to the newer, see attached files: these are from a local __patched__ openssl tree, which means the BN_value_RSA_F4() API is mine, not OpenSSL's. Attached files: - a patched copy of demos/eay/load

RSA_generate_key_ex documentation

2010-07-11 Thread Ian Pilcher
I've been looking all over for this, and I can't find it. Background - I'm trying to build stunnel on a platform that doesn't include RSA_generate_key, so I need to modify it to use the newer API. At the very least, I need to know how to check the return value of the new API. Thanks! -- ===

RE: question about max length string to encrypt with rsa 2048

2010-07-11 Thread David Schwartz
Chuck Pareto wrote: > My group is using RSA with a key thats 2048 in size. > We want to encrypt strings that are longer then this > key size gives. > If we switch to a key that is 4096 what is the max > string length we can encrypt? is it double? No, no! You are doing this all wrong! RSA is an

temp buffer used with ssl_write

2010-07-11 Thread Amit Ben Shahar
Hi, Does anyone know if a buffer passed to ssl_write (or any other method) must remain valid (i.e not freed) for any period. for example, if i have this code: // allocate buffer char* tmpBuff = (char*)malloc(1024); // .. some code to put data in buff // write buffer to ssl ssl_write

Re: RPMBuild for FIPS OpenSSL

2010-07-11 Thread Steve Marquess
William A. Rowe Jr. wrote: > On 7/9/2010 9:05 AM, Steve Marquess wrote: > >> Mark Parr wrote: >> >>> Use of the FIPS OpenSSL is a mandated thing and not just something that we >>> are looking to do for the fun of it. In fact, the base OpenSSL was working >>> fine using the "FIPS AES 256 en