Problem porting from OpenSSL 0.9.7e to 0.9.8
Hello All, I used OpenSSL 0.9.7e on Tru64 Unix 5.1A.I could generate the Certificate even without /dev/random or /dev/urandom Or EGD daemons. But now I am using OpenSSL 0.9.8 in the same environment and I am getting an error PRNG not seeded. I would like to know if any changes have been done in 0.9.8 to make it mandatory to have PRNG devices. Please reply me back. Thanks, Rajesh R -- This space intentionally left non-blank. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
X509_NAME_get_text_by_NID fails with accent?
Hello I have a problem with the function X509_NAME_get_text_by_NID. To get the last name of the subject of a certificate I use this call: i = X509_NAME_get_text_by_NID(X509_get_subject_name(x), NID_givenName, buf, lenbuf); usually it works fine but with this certificate (see the attachment) it fails returning the last character of the surname (ò). The function returns: i = 6 buf (hex) = 4d 61 72 69 c3 b2 but the buffer 'buf' should contain the given name 'Mariò' (hex: 4d 61 72 69 f2) while I find the string Mariò (hex: 4d 61 72 69 c3 b2). Thanks for your help. Massimo CertificatoAccento.cer Description: application/x509-ca-cert
Re: X509_NAME_get_text_by_NID fails with accent?
Massimo Rando [EMAIL PROTECTED] writes: The function returns: i = 6 buf (hex) = 4d 61 72 69 c3 b2 but the buffer 'buf' should contain the given name 'Mariò' (hex: 4d 61 72 69 f2) while I find the string Mariò (hex: 4d 61 72 69 c3 b2). ò in UTF-8 is 0xc3 0xb2. ò in ISO-8859-1 is 0xf2. I guess the string is encoded as UTF8String in the certificate. If you want your output in ISO-8859-1, you have to convert it from UTF-8. -- Jostein Tveit [EMAIL PROTECTED] __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: building openssl0.9.8a fails
I found the cause of evil. The error message (see original post) refers to /usr/local/include/unistd.h. I found it peculiar that the build would use headers that are in /usr/local/... Looking further, I found that there are more copies of unistd.h around, which all reside under /usr/include, one of which directly. I also found the copy in /usr/local/include to be as of 1998, whilst the other copies were much newer. After having removed /usr/local/include/unistd.h , the build went smoothly. My problem has been resolved. Thanks for your direction. I still wonder though why openssl managed to pick a copy under /usr/local/include while another one is available in /usr/include. Could this be an issue regarding the configuration of my Linux system, or is this an issue with the build configuration? Erik Leunissen == __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: How to encrypt a large file by a public key?
Just curious: Putting speed aside, what is the security risk by encrypting a large file chunk by chunk using RSA public key? (e.g. using chain mode like what is done in symmetric block cipher) On 12/14/05, Amir (sent by Nabble.com) [EMAIL PROTECTED] wrote: Thank you for your reply, I do not undrestand the last paragraph very well. I know how to encrypte a file using a symmetric algorithm. But i dont know what do you mean by then encrypting with the RSA key Encrypting by by a symmetric al will give me a file with the same size. I all want to do is to give a public key to someone to encrypt large files and send it to me. Amir -- Sent from the OpenSSL - Userhttp://www.nabble.com/OpenSSL---User-f981.htmlforum at Nabble.com: Re: How to encrypt a large file by a public key?http://www.nabble.com/How-to-encrypt-a-large-file-by-a-public-key--t724858.html#a1951256 OK, this is what you want to do: Imagine that you want your friend to send you an arbitrarily large file F encrypted. We assume that your friend has your public key PubK. He proceeds as follows: 1) Randomly generate a key K to be used with some symmetric algorithm, e.g. AES. 2) Encrypt F with AES (not RSA) and key K. 3) Encrypt K with RSA, using key PubK. 4) Send the encrypted F and K to you. You would proceed as follows: 1) Decrypt the encrypted K with RSA, using your private key PrK. 2) Decrypt the encrypted F with AES, using the K just decrypted. Your friend could potentially use RSA to encrypt the whole F. This, however, would be terribly inefficient: not only would he have to do the encryption in chunks, as described in my previous note, but, in addition, RSA is hundreds of times slower than AES. On your side, things would be even worse, for the RSA private key operation is an order of magnitude slower than its public key counterpart. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: How to encrypt a large file by a public key?
On Tue, Dec 20, 2005 at 10:48:57AM -0500, [EMAIL PROTECTED] wrote: Just curious: Putting speed aside, what is the security risk by encrypting a large file chunk by chunk using RSA public key? (e.g. using chain mode like what is done in symmetric block cipher) RSA is not intended for this. Various known/chosen plaintext/ciphertext issue are likely to compromise your keys. Do not do this. Only encrypt/decrypt/sign/verify appropriately structured session keys/message digests. -- Viktor. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: How do I correctly handle SSL_shutdown?
I think I understand but I still seem to have an issue with my code.
1). Server opens an SSL port for a client to connect to
2). Client connects to this port and SSL_read and Write stuff.
3). Client Calls SSL_shutdown( sslSocket );
4). Server Calls SSL_get_shutdown( sslSocket ), If shutdown is equal to
SSL_RECEIVED_SHUTDOWN the server will
then call SSL_shutdown( sslSocket );
So if the above is correct? I am doing the following to close the
connection and my server does not seem to ever see SSL_RECEIVED_SHUTDOWN
? Could some one please tell me what I am doing wrong?
( Blocking IO )
1). Client sends shutdown
/* Client code to close SSL connection */
if( (SSL *)NULL != sslSocket )
{
if( SSL_ST_OK == SSL_state( sslSocket ) )
{
status = SSL_shutdown( sslSocket );
if( status == 0 )
{
status = SSL_shutdown( sslSocket );
}
}
fd = SSL_get_fd( sslSocket );
close( fd );
SSL_free( sslSocket );
sslSocket = (SSL *)NULL;
}
2). Server checks for shutdown and sends shutdown if SSL_RECEIVED_SHUTDOWN is
returned.
/* Server code to close SSL connection */
if( (SSL *)NULL != sslSocket )
{
if( SSL_RECEIVED_SHUTDOWN == SSL_get_shutdown( sslSocket ) )
{
SSL_shutdown( sslSocket );
}
fd = SSL_get_fd( sslSocket );
close( fd );
SSL_free( sslSocket );
sslSocket = (SSL *)NULL;
}
Thanks,
Perry
Gayathri Sundar wrote:
Hi.,
I think that depends on the mode of SSL meaning blocking/non blocking,
If its the latter then you need to select again before calling the
2nd ssl shutdown and check whether the close notify from the peer is
received by checking the ssl_received_shutdown flag. If this flag is not
set, then you should cleanup or select for a timeout.
This code snippet is true for blocking sockets.
Thanks
--Gayathri
I am confused.
If SSL_shutdown returns 0 then I need to call SSL_shutdown again? So
would I do something like this on the client side?
/* Client code to close SSL connection */
if( (SSL *)NULL != *sslSocket )
{
if( SSL_ST_OK == SSL_state( *sslSocket ) )
{
status = SSL_shutdown( *sslSocket );
if( status == 0 )
{
status = SSL_shutdown( *sslSocket );
}
}
SSL_free( *sslSocket );
*sslSocket = (SSL *)NULL;
}
--
If this is the case what do I do on the server side do I need to uses
SSL_state to check for some shutdown state?
Thanks,
Perry
Victor Duchovni wrote:
On Mon, Dec 19, 2005 at 11:22:11AM -0500, Perry L. Jones wrote:
I have some questions about shutting down an SSL connection.
The correct use of SSL_shutdown() is described in the SSL_shutdown
manpage. Read the whole thing, and pay specific attention to:
When the application is the first party to send the close notify
alert, SSL_shutdown() will only send the alert and the set the
SSL_SENT_SHUTDOWN flag (so that the session is considered good and
will
be kept in cache). SSL_shutdown() will then return with 0. If a
unidi-
rectional shutdown is enough (the underlying connection shall be
closed
anyway), this first call to SSL_shutdown() is sufficient. In order to
complete the bidirectional shutdown handshake, SSL_shutdown() must be
called again. The second call will make SSL_shutdown() wait for the
peer's close notify shutdown alert. On success, the second call to
SSL_shutdown() will return with 1.
If the peer already sent the close notify alert and it was already
processed implicitly inside another function (SSL_read(3)), the
SSL_RECEIVED_SHUTDOWN flag is set. SSL_shutdown() will send the
close
notify alert, set the SSL_SENT_SHUTDOWN flag and will immediately
return with 1. Whether SSL_RECEIVED_SHUTDOWN is already set can be
checked using the SSL_get_shutdown() (see also SSL_set_shutdown(3)
call.
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
(export control) AES 128 bit
I would like to implement a C++ program that will use openssl to encrypt packets using AES 128 bit key. However, the problem is that I live in the US. Does this mean that I will be breaking the export control law if I put the program on a server for others to download? I have look at various sources but could not find the answer to my question. thanks! __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
secure code guidance
Hi Team, This might be dev topic, but let me ask. Is there any coding guidance for the core team and application developer? Is anybody doing the source code review like open bsd team does for their code? Thanks! With Best Regards, Kiyoshi Kiyoshi Watanabe __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: (export control) AES 128 bit
Dudue Doo wrote: I would like to implement a C++ program that will use openssl to encrypt packets using AES 128 bit key. However, the problem is that I live in the US. Does this mean that I will be breaking the export control law if I put the program on a server for others to download? I have look at various sources but could not find the answer to my question. You *really* should have a lawyer guide you, but if you look on the BIS website with respect to open source code, there are certain TSU exemptions for open source software, and alternate policies w.r.t. commercial applications that rely on open source cryptography modules, relying on some basic notifications to the BIS at time of publication. Not saying it's not an issue, just that it's one you can probably address without too much hand wringing or cost. Bill __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: How do I correctly handle SSL_shutdown?
If the server is unable to see the SSL_RECEIVED_SHUTDOWN, then probably
the close notify did not go on the wire, i.e client failed sending it?
Can you check the wire to see if it actually went out?
Try calling ssl_get_error to see the status on the error queue.
Also by any chance have you set the quiet shutdown mode in ur ctx?
if that is set, then the alert will not be sent on the wire..
This is what I get from man SSL_shutdown
SSL_shutdown() tries to send the close notify shutdown alert to the
peer. Whether the operation succeeds or not, the SSL_SENT_SHUTDOWN
flag is set and a currently open session is considered closed and good
and will be kept in the session cache for further reuse.
I think I understand but I still seem to have an issue with my code.
1). Server opens an SSL port for a client to connect to
2). Client connects to this port and SSL_read and Write stuff.
3). Client Calls SSL_shutdown( sslSocket );
4). Server Calls SSL_get_shutdown( sslSocket ), If shutdown is equal to
SSL_RECEIVED_SHUTDOWN the server will
then call SSL_shutdown( sslSocket );
So if the above is correct? I am doing the following to close the
connection and my server does not seem to ever see SSL_RECEIVED_SHUTDOWN
? Could some one please tell me what I am doing wrong?
( Blocking IO )
1). Client sends shutdown
/* Client code to close SSL connection */
if( (SSL *)NULL != sslSocket )
{
if( SSL_ST_OK == SSL_state( sslSocket ) )
{
status = SSL_shutdown( sslSocket );
if( status == 0 )
{
status = SSL_shutdown( sslSocket );
}
}
fd = SSL_get_fd( sslSocket );
close( fd );
SSL_free( sslSocket );
sslSocket = (SSL *)NULL;
}
2). Server checks for shutdown and sends shutdown if SSL_RECEIVED_SHUTDOWN
is returned.
/* Server code to close SSL connection */
if( (SSL *)NULL != sslSocket )
{
if( SSL_RECEIVED_SHUTDOWN == SSL_get_shutdown( sslSocket ) )
{
SSL_shutdown( sslSocket );
}
fd = SSL_get_fd( sslSocket );
close( fd );
SSL_free( sslSocket );
sslSocket = (SSL *)NULL;
}
Thanks,
Perry
Gayathri Sundar wrote:
Hi.,
I think that depends on the mode of SSL meaning blocking/non blocking,
If its the latter then you need to select again before calling the
2nd ssl shutdown and check whether the close notify from the peer is
received by checking the ssl_received_shutdown flag. If this flag is not
set, then you should cleanup or select for a timeout.
This code snippet is true for blocking sockets.
Thanks
--Gayathri
I am confused.
If SSL_shutdown returns 0 then I need to call SSL_shutdown again? So
would I do something like this on the client side?
/* Client code to close SSL connection */
if( (SSL *)NULL != *sslSocket )
{
if( SSL_ST_OK == SSL_state( *sslSocket ) )
{
status = SSL_shutdown( *sslSocket );
if( status == 0 )
{
status = SSL_shutdown( *sslSocket );
}
}
SSL_free( *sslSocket );
*sslSocket = (SSL *)NULL;
}
--
If this is the case what do I do on the server side do I need to uses
SSL_state to check for some shutdown state?
Thanks,
Perry
Victor Duchovni wrote:
On Mon, Dec 19, 2005 at 11:22:11AM -0500, Perry L. Jones wrote:
I have some questions about shutting down an SSL connection.
The correct use of SSL_shutdown() is described in the SSL_shutdown
manpage. Read the whole thing, and pay specific attention to:
When the application is the first party to send the close notify
alert, SSL_shutdown() will only send the alert and the set the
SSL_SENT_SHUTDOWN flag (so that the session is considered good and
will
be kept in cache). SSL_shutdown() will then return with 0. If a
unidi-
rectional shutdown is enough (the underlying connection shall be
closed
anyway), this first call to SSL_shutdown() is sufficient. In order to
complete the bidirectional shutdown handshake, SSL_shutdown() must be
called again. The second call will make SSL_shutdown() wait for the
peer's close notify shutdown alert. On success, the second call to
SSL_shutdown() will return with 1.
If the peer already sent the close notify alert and it was already
processed implicitly inside another function (SSL_read(3)), the
SSL_RECEIVED_SHUTDOWN flag is set. SSL_shutdown() will send the
close
notify alert, set the SSL_SENT_SHUTDOWN flag and will immediately
return with 1. Whether SSL_RECEIVED_SHUTDOWN is already set can be
checked using the SSL_get_shutdown() (see also SSL_set_shutdown(3)
call.
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
rsa certificate and private key question
dear all: by using the following openssl cli, i generate a rsa private key key and a self signed certificate file. $ openssl genrsa -out key.pem 1024 $ openssl req -new -key key.pem -out request.pem $ openssl x509 -req -days 30 -in request.pem -signkey key.pem -out certificate.pem when i try to load the key file and certificate file to my ssl context, both SSL_CTX_use_certificate_file(ctx,keyfile,SSL_FILETYPE_PEM) and SSL_CTX_use_PrivateKey_file(ctx,keyfile,SSL_FILETYPE_PEM) returns 1. however, when i use SSL_CTX_check_private_key(ctx) to check if the key matchs the certificate, this function returns 0. what could be wrong here? it seems these are all standard simple operations. thanks a lot. chong peng __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
