1.0.0o no fallback to SSLv2?

2010-08-13 Thread Stefan de Konink
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hello, I have a very odd problem with respect to my recent upgrade to 1.0.0; In principle this is the problem: openssl s_client -connect server.db.kvk.nl:443 -debug CONNECTED(0003) write to 0x1180ea0 [0x1180f20] (211 bytes => 211 (0xD3)) -

Session Secrete Keys

2010-08-13 Thread Sam Jantz
To whom it may concern, First I have to say that I am sorry for any lack of detail that I post do to non disclosure agreements, and also I swear that I am not trying to do anything malicious here. That being said, I am looking for a way to recover the agreed upon session secret key, and a

Re: Cipher selection

2010-08-13 Thread Alex Chen
The command 'openssl ciphers -v DEFAULT' gives the following ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-D

Re: My custom engine_finish method does not get called through ENGINE_finish

2010-08-13 Thread Jeff Saremi
I fixed the problem. I'm listing it here in case someone else runs into this: In the loadEngine() I call ENGINE_set_default(). I have to the opposite when unloading my engine. Unfortunately, I could not find any "ENGINE_unset_default()" or "ENGINE_unregister_all()" so I had to explicitly unregist

Looking for quick answer from you

2010-08-13 Thread Long.Wei
Hi! My Dear OpenSSL friends, I am developing code to sign and verify the signature of a DLL or SO module/image by using the public key and hash scheme. I got it work on Windows. Now I am coding the Linux part. I am looking for a set of functions from OpenSSL Crypto lib that make same or similar

RE: SSL/TLS with server names picked from DNS

2010-08-13 Thread Richardson, David
Hi. I'm not an expert, but I'm wondering if you used a Public/Private key pair to replace the username/password login to your servers would it help with your security. If you can control the distribution of the public key to restrict it to your servers (where it is stored in the user's file sp

Re: SSL/TLS with server names picked from DNS

2010-08-13 Thread Patrick Patterson
Hi there: It would seem that the solution to this is inherent in how you built this. If the client is in control of which trust anchors are used (and uses a restricted set, instead of the "anything goes" list that you get with most distributions and or Operating systems), then you SHOULD be abl

My custom engine_finish method does not get called through ENGINE_finish

2010-08-13 Thread Jeff Saremi
I'm trying to use my custom engine however I cannot get it to clean up nicely. For the initialization i used the sample in openssl ENGINE(3) documentation. Here's how it goes: ENGINE *loadEngine() { ENGINE *e; e = ENGINE_by_id(MY_ENGINE_ID); if(!e) ENG

Re: SSL/TLS with server names picked from DNS

2010-08-13 Thread Ludwig Nussel
sandeep kiran p wrote: > Ours is an LDAP client application that fetches LDAP server names on the fly > using DNS SRV Resource Records. We then randomly pick one the servers > returned from DNS, establish an SSL/TLS connection with that server and then > perform a bind operation using user credenti