Re: DTLS PSK in FIPS mode

2013-11-03 Thread Dr. Stephen Henson
On Fri, Oct 25, 2013, Fredrik Jansson wrote: I am trying to use DTLS with PSK (cipher: SSL_TXT_PSK). Everything works well if I don't set OpenSSL in FIPS mode (FIPS_mode_set(1)). Can you reproduce this using s_client and s_server? If so can you give details of the command lines you used?

Re: SSL/TLS encryption algorithms

2013-11-03 Thread Walter H.
On 01.11.2013 23:12, Viktor Dukhovni wrote: $ openssl ciphers -v DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 $ openssl ciphers -v AES128-SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128)

Re: SSL/TLS encryption algorithms

2013-11-03 Thread Viktor Dukhovni
On Sun, Nov 03, 2013 at 06:18:38PM +0100, Walter H. wrote: how would I define forward-secrecy on Apache webserver? If the server negotiated both ciphers, it already supports forward-secrecy (aka PFS) if the client does too. What about a browser that shows this SSL_CIPHER=RC4-MD5

Re: SSL/TLS encryption algorithms

2013-11-03 Thread Walter H.
On 03.11.2013 18:27, Viktor Dukhovni wrote: On Sun, Nov 03, 2013 at 06:18:38PM +0100, Walter H. wrote: how would I define forward-secrecy on Apache webserver? If the server negotiated both ciphers, it already supports forward-secrecy (aka PFS) if the client does too. What about a browser