Re: [openssl-users] OCSP signature verification

2015-12-09 Thread Wouter Verhelst
On 01-12-15 14:58, Verhelst Wouter (Consultant) wrote: Hi folks, I'm trying to write an application that needs to verify the validity of data on a smartcard. That data is signed with an RSA key for which a certificate exists on the card; but if the card is stolen or lost, the certificate will

Re: [openssl-users] [openssl-dev] Removing obsolete crypto from OpenSSL 1.1 - seeking feedback

2015-12-09 Thread Emilia Käsper
To close off this thread: OpenSSL will not be making any changes. The team voted on moving a set of algorithms to maintenance mode, and removing the corresponding assembly implementations from libcrypto, but the vote did not pass. Emilia On Fri, Nov 27, 2015 at 10:19 AM, Tim Hudson

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2015-12-09 Thread Jakob Bohm
Could you extract the disassembly of one of the failed calls to constant_time_eq_8() in the test program, perhaps the compiler generates incorrect code for this deeply nested group of near-edge arithmetic operations? On 09/12/2015 12:44, Jayalakshmi bhat wrote: Hi Matt, I could build and

Re: [openssl-users] openssl fipsalgtest

2015-12-09 Thread Steve Marquess
On 12/09/2015 12:06 AM, xxiao8 wrote: > I'm trying to run the algorithm tests under linux for fips 2.0.10 + > openssl 1.0.1e, using the fips-2.0-tv.tar.gz from openssl website, and > saw quite some errors, anything am I missing? fipsalgtest.pl is a utility of value only for performing formal CAVP

[openssl-users] Response from server is lost on close

2015-12-09 Thread Anty Rao
Hi : ALL Using non-blocking openssl , after detecting underlying TCP is broken, i invoke SSL_read to attempting reading response. *sometimes* response from server is lost, sometimes not. But tcpdump show that response is always send back to me. what is special is that RST packages come next the

Re: [openssl-users] Response from server is lost on close

2015-12-09 Thread Michael Wojcik
(Sorry for the delay in replying - I was tied up with other things.) Yes, you're correct. I was misremembering, and should have checked references first. The BSD implementation that Gary Wright and Rich Stevens describe in TCP/IP Illustrated v. 2 drops queued outbound data (on both sides) and

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2015-12-09 Thread Benjamin Kaduk
On 12/09/2015 05:04 PM, Matt Caswell wrote: > > On 09/12/15 11:44, Jayalakshmi bhat wrote: >> Hi Matt, >> >> I could build and execute the constant_time_test. I have attached the .c >> file and test results. 34 tests have failed. All failures are >> around constant_time_eq_8. This is the function

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2015-12-09 Thread Matt Caswell
On 09/12/15 11:44, Jayalakshmi bhat wrote: > Hi Matt, > > I could build and execute the constant_time_test. I have attached the .c > file and test results. 34 tests have failed. All failures are > around constant_time_eq_8. This is the function I had mentioned in the > earlier mails. Not quite

Re: [openssl-users] Response from server is lost on close

2015-12-09 Thread Anty Rao
Hi Michael, Thanks for your reply, and appreciate your answer which clear many of my doubts. Currently i'm stuck with this problem, can't find a way out,let me give more context of my problem. I use non-blocking openssl to interact with Apple's APNS server to send notifications to Iphone

Re: [openssl-users] CBC ciphers + TLS 1.0 protocol does not work in OpenSSL 1.0.2d

2015-12-09 Thread Viktor Dukhovni
On Wed, Dec 09, 2015 at 11:04:35PM +, Matt Caswell wrote: > unsigned char c = op(a, b); > if (is_true && c != CONSTTIME_TRUE_8) { > printf( "Test failed for %s(%du, %du): expected %u " > "(TRUE), got %u at line %d\n", op_name, a, b, > CONSTTIME_TRUE_8,