Re: we have an issue: bad mac

2011-10-18 Thread Martin Robbins
Dave Thompson dthompson@... writes: From: owner-openssl-users@... On Behalf Of Johnson, Chris E (OGA) Sent: Wednesday, 10 August, 2011 11:45 I typed in a term window in a linux machine the following command. $ openssl s_client -connect rsa6.fema.gov:7004

EVP_CipherUpdate Out Buffer Size

2011-10-18 Thread Nico Flink
Hello, I have a question concerning the size of the out buffer filled by EVP_CipherUpdate() and EVP_CipherFinal(). The evp man page gives the following description: EVP_EncryptUpdate() encrypts inl bytes from the buffer in and writes the encrypted version to out. [...] The amount of

RE: Revocation with a renewed/rekeyed Root CA

2011-10-18 Thread Steffen DETTMER
- U1, U2, U3 are end-user certificates, issued by CA1 - U1 is revoked, and the CRL is published (lets call it CRLg1) The problem here is that you can't trust a CRL when its signature key is compromised. I think that this is not the reason. If a signature key is compromised but used

length of RSA_public_encrypt out buffer

2011-10-18 Thread Jonas Schnelli
Hi I search the mailarchives as well as stackoverflow for a answer. No success. I just want to know how large my out-buffer must be when doing a RSA_public_encrypt. In the docs i read the size must be RSA_size(RSA *). In my case i'd like to encrypt files. So i read the whole file into a

Re: Differences between RSA and ECDSA - Conceptual and Practical

2011-10-18 Thread Bruce Stephens
Jakob Bohm jb-openssl-Ov0D3Su7/I/qt0dzr+a...@public.gmane.org writes: [...] As explained above, 192 bit DSA and ECDSA only works with 192 bit hashes (and only one hash algorithm is allowed for each private/public key pair). You can use larger digests (SHA-512, for example), but the digest

Re: Differences between RSA and ECDSA - Conceptual and Practical

2011-10-18 Thread Jakob Bohm
On 10/18/2011 2:18 PM, Bruce Stephens wrote: Jakob Bohmjb-openssl-Ov0D3Su7/I/qt0dzr+a...@public.gmane.org writes: [...] As explained above, 192 bit DSA and ECDSA only works with 192 bit hashes (and only one hash algorithm is allowed for each private/public key pair). You can use larger

Re:length of RSA_public_encrypt out buffer

2011-10-18 Thread Ziyu Liu
RSA_size(RSA *) told you the max length of every RSA encryption needed. RSA encryption is not designed to encrypt the large files because of its high cost.It is common to use a symmetric algorithm to encrypt the large data and the RSA algorithm is used to encrypt the key that the symmetric

Re: Differences between RSA and ECDSA - Conceptual and Practical

2011-10-18 Thread Bruce Stephens
Jakob Bohm jb-openssl-Ov0D3Su7/I/qt0dzr+a...@public.gmane.org writes: [...] I did mention that in passing under my item 2 (where I mentioned use of 192-bit-truncated-SHA-224 as one allowed 192 bit hash algorithm for use with ECDSA-192). OK, sorry, I missed that. I don't remember if the

Problem with signature verification on microchip embedded controller

2011-10-18 Thread TSCOconan
Hi, I'm trying to implement certificate signature verification (certificates are generated and signed using OpenSSL) on a Microchip pic controller. The Microchip PIC controller doesn't support OpenSSL libraries, but it does have an encryption/decryption function. I was successful in getting

Re: EVP_CipherUpdate Out Buffer Size

2011-10-18 Thread Jeffrey Walton
On Tue, Oct 18, 2011 at 6:47 AM, Nico Flink fl...@coolux.de wrote: I have a question concerning the size of the out buffer filled by EVP_CipherUpdate() and EVP_CipherFinal(). The evp man page gives the following description: EVP_EncryptUpdate() encrypts inl bytes from the buffer in and

OpenSSL and Solaris zones

2011-10-18 Thread Jorge Medina
I don't have much information, but maybe someone has had a similar problem. I am building my distribution of Apache Web Server (and Tomcat). I include in my tarball a compiled version of openssl, apr, apr-util and apache with several modules including mod_jk I build the components above in a

RE: Problem with signature verification on microchip embedded controller

2011-10-18 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of TSCOconan Sent: Tuesday, 18 October, 2011 14:57 I'm trying to implement certificate signature verification snip on a Microchip pic controller. snip After reading PKCS#1 V2.1 snip I realized that encryption is essentially the same

Re: OpenSSL and Solaris zones

2011-10-18 Thread Garick Hamlin
On Tue, Oct 18, 2011 at 04:08:17PM -0400, Jorge Medina wrote: I don't have much information, but maybe someone has had a similar problem. I am building my distribution of Apache Web Server (and Tomcat). I include in my tarball a compiled version of openssl, apr, apr-util and apache with

SSL documentation

2011-10-18 Thread Mohan Radhakrishnan
Hi, Is there any material available that shows flows of one-way/two-ssl and different types of CA architectures ? We use two-way SSL and generate CSR's and update expired certificates and we are aware of the basic points. I have browsed the NIST website. Thanks, Mohan