Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread jonetsu
From: Steve Marquess marqu...@openssl.com Date: 04/14/15 09:31 and note that of the 101 platforms (OEs) appearing there, most of those operating systems are neither CC certified nor have any other FIPS 140-2 validated crypto. Keep in mind that at Level 1 the validation applies to the

Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread Steve Marquess
On 04/13/2015 01:30 PM, Jakob Bohm wrote: .. With the very unique exception of the OpenSSL FIPS Object Module, there are no FIPS 140-2 validated cryptographic modules that can be obtained in source form and compiled by the end user. The fact that Red Hat (or whomever) has taken open source

Re: [openssl-users] OpenSSL 1.0.2 Solaris 32 bit build is broken

2015-04-14 Thread John Unsworth
Is no-one interested at all about this problem? Or do I need to send it to another place? Regards, John. From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of John Unsworth Sent: 10 April 2015 14:54 To: openssl-users@openssl.org Subject: Re: [openssl-users] OpenSSL 1.0.2

Re: [openssl-users] OpenSSL 1.0.2 Solaris 32 bit build is broken

2015-04-14 Thread Salz, Rich
You could mail it to RT and then it will at least be logged and not forgotten. But no response within four days isn't surprising. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread Steve Marquess
On 04/14/2015 09:42 AM, jonetsu wrote: From: Steve Marquess marqu...@openssl.com Date: 04/14/15 09:31 and note that of the 101 platforms (OEs) appearing there, most of those operating systems are neither CC certified nor have any other FIPS 140-2 validated crypto. Keep in mind that at

Re: [openssl-users] DTLS without sockets (or at least an unconnected socket)

2015-04-14 Thread Florian Weimer
On 04/14/2015 09:02 PM, Matt Caswell wrote: On 14/04/15 19:45, Florian Weimer wrote: Is it possible to use DTLS with some sort of non-socket BIO? Basically, I have datagrams which I know belong to a specific DTLS session, and I want to feed them to OpenSSL and get back further datagrams

Re: [openssl-users] DTLS without sockets (or at least an unconnected socket)

2015-04-14 Thread Matt Caswell
On 14/04/15 19:45, Florian Weimer wrote: Is it possible to use DTLS with some sort of non-socket BIO? Basically, I have datagrams which I know belong to a specific DTLS session, and I want to feed them to OpenSSL and get back further datagrams to send out in response. (This is similar to

[openssl-users] DTLS without sockets (or at least an unconnected socket)

2015-04-14 Thread Florian Weimer
Is it possible to use DTLS with some sort of non-socket BIO? Basically, I have datagrams which I know belong to a specific DTLS session, and I want to feed them to OpenSSL and get back further datagrams to send out in response. (This is similar to what SSLEngine does in OpenJDK, except there

Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread Kevin Fowler
Two things to consider with IPSec: key exchange mechanisms as provided by packages like StrongSwan, and the actual encryption/authentication of packets that is typically being done by the kernel stack and I believe is based on the Kernel Crypto API. So I believe to do IPSec you do need both crypto

Re: [openssl-users] DTLS without sockets (or at least an unconnected socket)

2015-04-14 Thread Matt Caswell
On 14/04/15 20:24, Florian Weimer wrote: On 04/14/2015 09:02 PM, Matt Caswell wrote: On 14/04/15 19:45, Florian Weimer wrote: Is it possible to use DTLS with some sort of non-socket BIO? Basically, I have datagrams which I know belong to a specific DTLS session, and I want to feed them

Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread Kevin Fowler
Two things to consider with IPSec: key exchange mechanisms as provided by packages like StrongSwan, and the actual encryption/authentication of packets that is typically being done by the kernel stack and I believe is based on the Kernel Crypto API. So I believe to do IPSec you do need both crypto

Re: [openssl-users] FIPS mode restrictions and DES

2015-04-14 Thread jonetsu
Salz, Rich wrote As the old joke goes, if you have to ask, you can't afford it. Well, exploration can be free. I noticed that Strongswan uses a plug-in architecture for crypto that seemingly allows the use of OpenSSL instead of the kernel for crypto operations, for use under FIPS. Does anyone