Re: Strange OpenSSL error when my server accepts a new OpenSSL connection while existing ones are active

2013-10-10 Thread Viktor Dukhovni
On Wed, Oct 09, 2013 at 10:46:35PM -0700, Jeremy Friesner wrote: With SSL sessions created via SSLv23_method(), use of this primitive will lead to the failure in question when invoked before the SSL session has switched to SSLv3, TLSv1, ? Aha! Yes, that appears to be my problem. As a

Re: Strange OpenSSL error when my server accepts a new OpenSSL connection while existing ones are active

2013-10-10 Thread Jeremy Friesner
On Oct 9, 2013, at 10:59 PM, Viktor Dukhovni openssl-us...@dukhovni.org wrote: A better solution is to not call SSL_pending() until the SSL handshake completes. For now you should keep track of whether SSL_accept() has completed for a given session, and refrain from SSL_pending() until then.

Re: 050 + at the beginning of verified signature

2013-10-10 Thread aqueelmirza
Hi I tried replacing strlen(reply) with 20 but we are getting same result as before. I am attaching reference files with this message. While trying this solution, sometimes we were getting following error as well. RSA operation error 140735121490396:error:0406706C:rsa

TLS 1.1 and 1.2 support in openssl-fips 1.2

2013-10-10 Thread Anil Kumar K K
Hi OpenSSL experts, I have been trying to find out whether TLS verion 1.1 and 1.2 are supported in openssl package openssl-fips 1.2. Version string in the code says only TLS 1.o is supported.#define TLS1_VERSION0x0301 But change log listed in the below link talks about TLS 1.2 also

Re: TLS 1.1 and 1.2 support in openssl-fips 1.2

2013-10-10 Thread Dr. Stephen Henson
On Thu, Oct 10, 2013, Anil Kumar K K wrote: Hi OpenSSL experts, I have been trying to find out whether TLS verion 1.1 and 1.2 are supported in openssl package openssl-fips 1.2. Version string in the code says only TLS 1.o is supported.#define TLS1_VERSION0x0301 But change

SSL_Connect blocking for 25 sec for the first connection

2013-10-10 Thread Madupuvenkatesh Arun-PJH784
I have a situation where my application is trying to open 5000 SSL connections with server, one after another, I see the very first ssl connect is blocking nearly 25seconds and times out. (Interestingly this blocking time is in proportion to the number of connections im intending to open. For

OpenSSL version 1.0.1c - Error: ASN1_D2I_READ_BIO:not enough data

2013-10-10 Thread Helen Du
Hi, I'm using version 1.0.1c, and I'm getting this error randomly: ASN1_D2I_READ_BIO:not enough data. I know this error is fixed in version 1.0.1a. Does it also fixed in v1.0.1c? Any suggestions about who to debug this random error? Should I down grade my OpenSSL from v1.0.1c to v1.0.1a?

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Angelin Lalev
I forgot to state the version of OpenSSL I'm using. It's 1.0.1e On Thu, Oct 10, 2013 at 6:50 PM, Angelin Lalev lalev.ange...@gmail.com wrote: Greetings, I could use some help. I'm getting segmentation fault from this code: /* Init the openssl library */

Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Angelin Lalev
Greetings, I could use some help. I'm getting segmentation fault from this code: /* Init the openssl library */ SSL_load_error_strings(); SSL_library_init(); ctx=SSL_CTX_new(SSLv3_client_method()); The backtrace looks like this: Program received signal SIGSEGV,

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Jeff Trawick
On Thu, Oct 10, 2013 at 11:50 AM, Angelin Lalev lalev.ange...@gmail.comwrote: Greetings, I could use some help. I'm getting segmentation fault from this code: /* Init the openssl library */ SSL_load_error_strings(); SSL_library_init();

Updating key size - security related questions

2013-10-10 Thread int0x80
Hi, I've been asking this on the OpenVPN mailinglist, but didn't get an answer so far. Therefore I hope you can help me. We use OpenVPN in our company with the default cipher suite, which should be: DHE_RSA_BF_CBC_SHA So RSA is used for authentication, Blowfish in CBC mode for symmetric

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Angelin Lalev
(gdb) r Starting program: /home/ventsi/fing/fing Program received signal SIGSEGV, Segmentation fault. 0x0086d1fc in read () (gdb) info threads Id Target Id Frame * 1process 13262 fing 0x0086d1fc in read () On Thu, Oct 10, 2013 at 7:19 PM, Jeff Trawick

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Jeff Trawick
On Thu, Oct 10, 2013 at 12:54 PM, Angelin Lalev lalev.ange...@gmail.comwrote: (gdb) r Starting program: /home/ventsi/fing/fing Program received signal SIGSEGV, Segmentation fault. 0x0086d1fc in read () (gdb) info threads Id Target Id Frame * 1process 13262 fing

Increasing key size from 1024 to 2048?

2013-10-10 Thread int0x80
Hi, I've been asking this on the OpenVPN mailinglist, but didn't get an answer so far. Therefore I hope you can help me. We use OpenVPN in our company with the default cipher suite, which should be: DHE_RSA_BF_CBC_SHA So RSA is used for authentication, Blowfish in CBC mode for symmetric

Re: [openssl-users] Updating key size - security related questions

2013-10-10 Thread Erwann Abalea
Bonjour, Le 10/10/2013 18:29, int0...@safe-mail.net a écrit : Hi, I've been asking this on the OpenVPN mailinglist, but didn't get an answer so far. Therefore I hope you can help me. We use OpenVPN in our company with the default cipher suite, which should be: DHE_RSA_BF_CBC_SHA So RSA is

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Angelin Lalev
SOLVED: The very basic thing that get's the whole thing broken seems to be VERY BASIC understanding of C. I did cut out only the initialization code in a separate program and it worked fine. Somewhere in the program before the initialization of openssl I'm having pointer problems of some sort.

Re: Hi, I need help with initialization of OpenSSL

2013-10-10 Thread Angelin Lalev
Just to clear everything and finish up. I had global int variable named read... On Thu, Oct 10, 2013 at 8:33 PM, Angelin Lalev lalev.ange...@gmail.com wrote: SOLVED: The very basic thing that get's the whole thing broken seems to be VERY BASIC understanding of C. I did cut out only the

Re: Increasing key size from 1024 to 2048?

2013-10-10 Thread Eric S. Eberhard
Just curious -- what line of work is your company in? If you were CIA or NASA or something I'd see the need. If you are just a business -- wow! E On 10/10/2013 1:37 AM, int0...@safe-mail.net wrote: Hi, I've been asking this on the OpenVPN mailinglist, but didn't get an answer so far.

Abort after free() of non-allocated pointer

2013-10-10 Thread Daode
Hello! Am i right here? It's actually hard to believe the error is on the OpenSSL side, and i definetely should look deeper before sending this, but on the other hand this is so deep down in the OpenSSL code... ?0[steffen@sherwood src]$ openssl version OpenSSL 1.0.1e 11 Feb 2013

Broken implementation of OpenSSL

2013-10-10 Thread Tim Legg
Hello, I was following a HOWTO document: http://www.howtoforge.com/perfect-server-ubuntu-12.04-lts-apache2-bind-dovecot-ispconfig-3 In the last step, I should have a control panel application (ISPConfig 3) launching when accessed with https://www.example.com:8080 but instead, I get a

Re: Broken implementation of OpenSSL

2013-10-10 Thread Tim Legg
I may have figured it out (it's been a 3 hour ordeal so far.) I was using netcat to test 443 using LAN and WAN machines, and all was going well. At some point a few minutes ago, I realized that this software uses port 8080, not the standard 443. I think maybe it's time to jump in a freezing

How does one use fipstests.sh to generate scripts for use with Windows CE [OpenSSL FIPS]

2013-10-10 Thread Eichenberger, John
I see that there is a -win32 command line value. But I would have thought that should not necessarily be the same as what one uses for Windows-CE. I've tried a few thing at random, I was hoping for someone who had done this before to show me the way? -Ike- John Eichenberger Principal Engineer:

Re: 050 + at the beginning of verified signature

2013-10-10 Thread Dave Thompson
From: owner-openssl-us...@openssl.org on behalf of aqueelmirza aqueelmi...@gmail.com Sent: Thursday, October 10, 2013 06:43 I tried replacing strlen(reply) with 20 but we are getting same result as before. Yes, a sha1 hash should be 20 bytes, but see below. I am attaching reference files