Re: openssl fips patch for RSA Key Gen (186-4)

2021-01-05 Thread Marcus Meissner
On Tue, Jan 05, 2021 at 04:34:36PM +, Matt Caswell wrote: > > > On 05/01/2021 11:41, y vasavi wrote: > > > > Hi All, > > > > We currently FOM 2.0 module for FIPS certification. > > It doesn't have support for RSA Key generation(186-4) > > > > Are there any patches available ? > >

Re: [openssl-users] What does this error mean?

2018-04-16 Thread Marcus Meissner
On Mon, Apr 16, 2018 at 02:27:17PM -0400, Rob Marshall wrote: > Hi, > > It may not be relevant, but I'm running SLES 10 SP3 which is a very > old version of the OS and I can't upgrade it due to some installed > products. When I try to do a wget I'm seeing the error: > > OpenSSL:

Re: [openssl-users] Openssl FIPS 186-4 Patch

2017-10-10 Thread Marcus Meissner
Hi, On Mon, Oct 09, 2017 at 05:24:17PM +0530, murugesh pitchaiah wrote: > Hi, > > Thanks for the comment. > > I know that openSSL is not 186-4 compliant. That is why I am looking > for anybody have the patch for the same. > > I see there are some works in Fedora: >

Re: [openssl-users] [FIPS compliance] ssl reneg when counter overflows(AES_GCM)

2016-11-04 Thread Marcus Meissner
On Fri, Nov 04, 2016 at 10:03:21AM +0530, Akshar Kanak wrote: > Dear team > as per the documnet http://csrc.nist.gov/groups/ > STM/cmvp/documents/fips140-2/FIPS1402IG.pdf > page 150 , Its mentioned > The implementation of the nonce_explicit management logic inside the > module shall

Re: [openssl-users] CVE-2016-2108 and openssl 0.9.8zf

2016-08-25 Thread Marcus Meissner
1c, 1.0.1b, > 1.0.1a, 1.0.1) > * Fixed in OpenSSL 1.0.2c (Affected 1.0.2b, 1.0.2a, 1.0.2) > > > -- > openssl-users mailing list > To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users -- Marcus Meissner,SUSE LINUX GmbH; Maxfeldstrasse 5; D-9

Re: [openssl-users] RSA and FIPS 186-4 in OpenSSL 1.0.1e/fips-2.0.9

2015-12-17 Thread Marcus Meissner
On Thu, Dec 17, 2015 at 04:26:21PM -0500, jonetsu wrote: > Hello, > > > I have read about the use of FIPS_rsa_x931_generate_key_ex() for 186-4 > compliance.  We are using OpenSSL 1.0.1e with the fips-2.0.9 module.    Would > it make functional sense using those versions to patch 

Re: [openssl-users] Is RC4-MD5 disabled on Openssl-1.0.1h

2015-03-26 Thread Marcus Meissner
On Thu, Mar 26, 2015 at 10:42:21AM +0530, Mukesh Yadav wrote: HI, I have a query for SSl cipher on Openssl-1.0.1h Have an application which is using library compiled with openssl-1.0.1h. Application is failing in func SSL_CTX_set_cipher_list() when input is RC4-MD5+RC4-SHA and it gets

Re: [openssl-users] FIPS Linux kernel documentation ?

2015-03-26 Thread Marcus Meissner
On Thu, Mar 26, 2015 at 10:57:28AM -0400, Steve Marquess wrote: On 03/25/2015 06:26 PM, jone...@teksavvy.com wrote: On Wed, 25 Mar 2015 17:03:04 -0400 Steve Marquess marqu...@openssl.com wrote: I wasn't aware the Linux kernel (the real one, not proprietary commercial derivatives) had a

Re: [openssl-users] OpenSSL FIPS mode system integration

2015-02-19 Thread Marcus Meissner
On Thu, Feb 19, 2015 at 05:19:37AM -0500, jone...@teksavvy.com wrote: Hello, Could you please comment on the following ? Any suggestion, insight, hint, is greatly appreciated. In FIPS mode, the OS, the device, must be aware of crypto errors, and adopt a certain behaviour when one occurs.

Re: [openssl-users] Using FIPS mode and modifying apps

2015-01-15 Thread Marcus Meissner
On Thu, Jan 15, 2015 at 05:46:22AM -0500, jone...@teksavvy.com wrote: On Tue, 13 Jan 2015 21:33:49 -0500 jone...@teksavvy.com jone...@teksavvy.com wrote: So basically every app that uses libssl will have to be modified to add a FIPS_mode_set() call near the beginning. Is that right ?

Re: Openssl IPv6 Support

2014-11-05 Thread Marcus Meissner
On Wed, Nov 05, 2014 at 08:28:40AM +, Mody, Darshan (Darshan) wrote: Hi, Does Openssl support IPv6 officially?. AFAIK the libssl and libcrypto libraries do not use sockets at all, these are left to the applications/libraries using them. So openssl does neither support ipv4 nor ipv6.

Re: Openssl IPv6 Support

2014-11-05 Thread Marcus Meissner
On Wed, Nov 05, 2014 at 08:45:55AM -0800, Quanah Gibson-Mount wrote: --On November 5, 2014 at 10:10:26 AM +0100 Marcus Meissner meiss...@suse.de wrote: On Wed, Nov 05, 2014 at 08:28:40AM +, Mody, Darshan (Darshan) wrote: Hi, Does Openssl support IPv6 officially?. AFAIK

Re: CVE-2014-5139 patch

2014-08-25 Thread Marcus Meissner
On Mon, Aug 25, 2014 at 02:27:27PM +0530, sandeep umesh wrote: Hello users, NVD vulnerability database confirms the below link as the patch for CVE-2014-5139 - https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=80bd7b41b30af6ee96f519e629463583318de3b0 This is indicating to

Re: Duration of rsa key generation process

2014-07-03 Thread Marcus Meissner
On Thu, Jul 03, 2014 at 12:46:05AM -0700, phildoch wrote: I tested the generation of a certificate with a keypair RSA 4096 bit on two different platforms. The openssl command I used is: /openssl req -newkey rsa:4096 -keyout clientKey.pem -out clientReq.pem/ There was a huge difference

Re: What is the underlying algorithm in RAND_bytes() function?

2014-05-12 Thread Marcus Meissner
On Mon, May 12, 2014 at 03:00:23AM -0700, harika_n wrote: I am using RAND_bytes function to generate cryptographically secure random numbers. I want to know if it uses Hash based DRBG or HMAC based DRBG. If it uses Hash based DRBG what is the underlying hash function used? I looked at the