RNG in SSL handshake

2010-05-19 Thread Paul Ohmart
Can anyone tell me what RNG is used in the SSL handshake in FIPS mode? Also what OpenSSL functions are called to get the random number. The Security Policy 1.1.1 documentation states that it is X9.31 but I am unable to locate where that happens in the source. I am trying to use OpenSSL to

DH-cipher suites and export cipher suites.

2010-05-19 Thread Ingela Andin
Hello! I use openSSL to test our own Erlang SSL/TLS implementation that also uses openssl crypto facilities. This all works out very good. I have two questions that are more on a principal level than a use of openssl questions, but I do not think they really fit in very good on any of the lists,

RSA-PSS

2010-05-19 Thread Bram Cymet
Hi, I have been able to use RSA-PSS to sign some data with OpenSSL. I am wondering if OpenSSL supports creating certs where the signature algorithm uses RSA-PSS. In other words, when viewing the properties of the cert you would get: Signature Algorithm: 1.2.840.113549.1.1.10 Thanks, -- Bram

Private Key Usage Period

2010-05-19 Thread Bram Cymet
Hi, I am wondering if with the latest version of Openssl it is possible to set the Private Key Usage Period extension and if so what is the format of the parameters? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

RE: Private Key Usage Period

2010-05-19 Thread Eisenacher, Patrick
Hi Bram, -Original Message- From: Bram Cymet I am wondering if with the latest version of Openssl it is possible to set the Private Key Usage Period extension and if so what is the format of the parameters? this is how I do it in my config file: [ ca_ext ] basicConstraints

Re: RSA-PSS

2010-05-19 Thread Martin Kaiser
Hello Bram, Thus wrote Bram Cymet (bcy...@cbnco.com): I have been able to use RSA-PSS to sign some data with OpenSSL. I am wondering if OpenSSL supports creating certs where the signature algorithm uses RSA-PSS. In other words, when viewing the properties of the cert you would get:

Re: openssl 1.0.0 - client-server programs/demos don't work anymore?

2010-05-19 Thread Mihai Militaru
Basically, what one has to do to reproduce the bug is to build the example in the source archive: openssl-1.0.0/demos/bio. It used to work, but it doesn't anymore. If someone is interested in a quick howto for reproducing it, to test on their machine, here it is: If anyone tests this, please

Re: RNG in SSL handshake

2010-05-19 Thread Dr. Stephen Henson
On Tue, May 18, 2010, Paul Ohmart wrote: Can anyone tell me what RNG is used in the SSL handshake in FIPS mode? Also what OpenSSL functions are called to get the random number. The Security Policy 1.1.1 documentation states that it is X9.31 but I am unable to locate where that happens in

Re: DH-cipher suites and export cipher suites.

2010-05-19 Thread Dr. Stephen Henson
On Wed, May 19, 2010, Ingela Andin wrote: From OpenSSL documentation: The non-ephemeral DH modes are currently unimplemented in OpenSSL because there is no support for DH certificates. Question: Why is this? Is it something that you plan to implement? Or is this functionallity something

Re: Private Key Usage Period

2010-05-19 Thread Dr. Stephen Henson
On Wed, May 19, 2010, Eisenacher, Patrick wrote: Hi Bram, -Original Message- From: Bram Cymet I am wondering if with the latest version of Openssl it is possible to set the Private Key Usage Period extension and if so what is the format of the parameters? this is how I

Re: RSA-PSS

2010-05-19 Thread Dr. Stephen Henson
On Wed, May 19, 2010, Martin Kaiser wrote: Hello Bram, Thus wrote Bram Cymet (bcy...@cbnco.com): I have been able to use RSA-PSS to sign some data with OpenSSL. I am wondering if OpenSSL supports creating certs where the signature algorithm uses RSA-PSS. In other words, when viewing

Re: [openssl-users] Re: Private Key Usage Period

2010-05-19 Thread Erwann ABALEA
Hodie XIV Kal. Iun. MMX, Dr. Stephen Henson scripsit: On Wed, May 19, 2010, Eisenacher, Patrick wrote: Hi Bram, -Original Message- From: Bram Cymet I am wondering if with the latest version of Openssl it is possible to set the Private Key Usage Period extension and