SHA-2 Directive

2011-01-21 Thread Welling, Conrad Gerhart
My team just received a directive from our customer to start using SHA-2 immediately. Yes, in effect, the directive is that vague, and, no, details have not been forthcoming! So, I intend to tell my superiors that our product - which uses HTTPS provided by libCurl built with OpenSSL to xfer

Re: SHA-2 Directive

2011-01-21 Thread Jeffrey Walton
On Thu, Jan 20, 2011 at 5:01 PM, Welling, Conrad Gerhart conrad.gerhart.well...@saic.com wrote: My team just received a directive from our customer to start using SHA-2 immediately.  Yes, in effect, the directive is that vague, and, no, details have not been forthcoming!  So, I intend to tell

Re: Got X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY when there was a root in the store.

2011-01-21 Thread Karthik Ravikanti
Can anybody help me with this? On Wed, Jan 19, 2011 at 10:42 AM, Karthik Ravikanti karthik.ravika...@gmail.com wrote: I created a self signed certificate and used it to sign a server's certificate. I put root in the client's store, using a custom X509_LOOKUP, overriding the get_by_subject()

Re: Reduce the openssl library/image size

2011-01-21 Thread Muneeswaran Raju
Hi, I tried the option. Also I used [ invoked ] only RSA private/puplic key generation, RSA sign/verification, SHA256, SHA1 digest. But still I get huge final image size in linux-X86 platform. I want to use memory very optimum. Probably i have only 50KB-100KB for my image size. Please find below

Re:Re: Reduce the openssl library/image size

2011-01-21 Thread lzyzizi
As i know,RSA module mainly depends BN,ASN1,RAND(ASN1 may need other module such as stack,buf). ASN1 is a small parser to parse the asn1 strings,which is a little big to you. if you do not use i2d_PublicKey ,d2i_xxx, you may not even need the ASN1 module. SHA is a independent module,which needs

Re: Got X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY when there was a root in the store.

2011-01-21 Thread Karthik Ravikanti
To overcome this, in my get_by_subject lookup method, I'm returning the certificate whose subject when printed with X509_NAME_print_ex() matches with the one being asked for. Before returning however, I'm overwriting the subject and issuer fields by the queried subject. I know this is stupid, so

Re: Let's talk about HTTPS Everywhere

2011-01-21 Thread Steffen DETTMER
* S Mathias wrote on Wed, Jan 19, 2011 at 03:29 -0800: Ok. It's a Firefox Add-on: https://www.eff.org/https-everywhere 3) Can someone trust this Add-on? Is it safe to install/use? It isn't 100% safe. There always is a risk. 4) If it's so great why isn't it more prevalent? What's youre

Loading a CRL from RAM (and not from file or directory)

2011-01-21 Thread Graham Leggett
Hi all, I am trying to load a CRL, and currently my options seem to be choosing one of the following: X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()) X509_STORE_add_lookup(certstore, X509_LOOKUP_file()) The dilemma I face is that I need to do this in a non blocking fashion in an

Re: Loading a CRL from RAM (and not from file or directory)

2011-01-21 Thread Dr. Stephen Henson
On Fri, Jan 21, 2011, Graham Leggett wrote: Hi all, I am trying to load a CRL, and currently my options seem to be choosing one of the following: X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()) X509_STORE_add_lookup(certstore, X509_LOOKUP_file()) The dilemma I face is that I

Re: Loading a CRL from RAM (and not from file or directory)

2011-01-21 Thread Graham Leggett
On 21 Jan 2011, at 7:20 PM, Dr. Stephen Henson wrote: You can read the CRL into an X509_CRL stucture using d2i_X509_CRL() or the PEM functions using a memory BIO. Once you have the X509_CRL structure you can add the CRL with X509_STORE_add_crl(). When reading a CRL in a directory, is it