Re: Regarding Getting tlsv1 alert decrypt error

2012-08-16 Thread Saurabh Pandya
As per my knowledge such thing man not happen.. may something go wrong with your code.. share your code if someone can look at up, Thanks, Saurabh On 8/16/12, venkataragavan vijayakumar wrote: > Hi All, > > We are running load through the openssl 1.0 DTLS connection , It is working > fine for

Re: How to extend key usage

2012-08-16 Thread Saurabh Pandya
You need to get familiar yourself with openssl and (SSL). Best way to start is documentation (SSL API) and use demos provided with openssl source code. On 8/16/12, Eric Fowler wrote: > I am a relative OpenSSL newbie, and I have had a task assigned to me > which entails some SSL knowledge. > > My

Re: Unregister an index registered with RSA_get_ex_new_index

2012-08-16 Thread Dr. Stephen Henson
On Thu, Aug 16, 2012, Felipe Blauth wrote: > Dear all, > > Im writing an OpenSSL engine and I have some internal data to manage via > ex_data functions. > > What I've been doing so far is using RSA_get_ex_new_index(0, NULL, NULL, > NULL, ), at the initialization of the engine to register > a fre

Re: RSA OAEP with sha256

2012-08-16 Thread Mounir IDRASSI
Hi Martin, In OpenSSL implementation of OAEP, MGF1 is hardcoded with SHA-1 (look at the end of the file rsa_oaep.c). Moreover, the function RSA_padding_add_PKCS1_OAEP is using explicitly SHA-1 as the unique possible hash. That's why your results are incorrect. Personally, I overcame these li

Re: RSA OAEP with sha256

2012-08-16 Thread Dr. Stephen Henson
On Thu, Aug 16, 2012, Martin Kaiser wrote: > Dear all, > > I'd like to encrypt some bytes using RSA OAEP with MGF1. Both OAEP and > MGF1 should use sha256 instead of the default sha1. > > Does openssl support this at all? I tried something along the lines of > >size_t outlen; >int ret;

RSA OAEP with sha256

2012-08-16 Thread Martin Kaiser
Dear all, I'd like to encrypt some bytes using RSA OAEP with MGF1. Both OAEP and MGF1 should use sha256 instead of the default sha1. Does openssl support this at all? I tried something along the lines of size_t outlen; int ret; EVP_PKEY_CTX *ctx; unsigned char in[] = { some byte

Unregister an index registered with RSA_get_ex_new_index

2012-08-16 Thread Felipe Blauth
Dear all, Im writing an OpenSSL engine and I have some internal data to manage via ex_data functions. What I've been doing so far is using RSA_get_ex_new_index(0, NULL, NULL, NULL, ), at the initialization of the engine to register a free function for structures allocated when the method ENGINE_l

Re: [openssl-users] OpenSSL OCSP

2012-08-16 Thread Erwann Abalea
Le 16/08/2012 18:38, adrien pisarz a écrit : Ps: does anyone know why the engine option is not available with ocsp and the private key must be in a file instead of store securely in a HSM ? As said by Dr Henson, this is only a testing tool, not a production service. If you need a production-gr

How to extend key usage

2012-08-16 Thread Eric Fowler
I am a relative OpenSSL newbie, and I have had a task assigned to me which entails some SSL knowledge. My task is to take existing code, and add to it one of the capabilities in the table. I have a X509V3_CTX struct and it has been passed to X509V3_set_ctx(). I suspect the next step involves X509

Re: Elliptic Curve key generation help

2012-08-16 Thread Mohammad khodaei
Hi, Thanks for the response. I still have a small problem regarding ECDSA key generation. I have the following code to generate ECDSA public/private key pair:    EC_KEY *ecKey = EC_KEY_new(); >    if (ecKey == NULL)  >        return ERR_CODE_ECDSA_EC_KEY_NEW_EXCEPTION; > > > >    EC_GROUP *group

RE: [openssl-users] OpenSSL OCSP

2012-08-16 Thread adrien pisarz
Hi, The tests were made on a 0.9.8 version. I will update to a 1.0 or higher and keep you inform. regardsadrien Ps: does anyone know why the engine option is not available with ocsp and the private key must be in a file instead of store securely in a HSM ?From: smad...@adobe.com To: openssl-

Re: X509 certificate algorithm

2012-08-16 Thread Dr. Stephen Henson
On Thu, Aug 16, 2012, Kenneth Goldman wrote: > I call these: > > d2i_X509() > X509_print_fp() > > which calls > pkey_set_type() > EVP_PKEY_asn1_find() > and that call fails. > > I've traced the following error down to the rsaOAEP algorithm, which has a > nid of 919. I

X509 certificate algorithm

2012-08-16 Thread Kenneth Goldman
I call these: d2i_X509() X509_print_fp() which calls pkey_set_type() EVP_PKEY_asn1_find() and that call fails. I've traced the following error down to the rsaOAEP algorithm, which has a nid of 919. I've included both the openssl and dumpasn1 dump of the X509 certificat

Re: How do session accept timeout with OpenSSL

2012-08-16 Thread Holger Weiß
* Charles Mills [2012-08-15 17:31]: > Every OpenSSL example I have seen uses BIO, but there is no need to use > BIO, right (unless one wants I/O-type-independence). That's right, though the socket BIO methods also abstract away quite a few obscure platform specifics. > I have eliminated all of m