[openssl-users] Building a DLL that includes the FIPS static libraries

2014-12-09 Thread Perrow, Graeme
I am trying to build a Windows DLL that includes the static OpenSSL FIPS libraries. I built the FIPS libraries using the perl Configure fips --with-fipslibdir=... -no-shared and then nmake -f ms\nt.mak. I'm using openssl-fips-2.0.5, openssl-1.0.1j, and MS Visual Studio 2010. Now I'm trying to

Re: [openssl-users] Strange SSL_read behavior: 1/N-1

2014-12-09 Thread Michael Wojcik
From: openssl-users [mailto:openssl-users-boun...@openssl.org] On Behalf Of Dave Thompson Sent: Monday, December 08, 2014 20:02 To: openssl-users@openssl.org Subject: Re: [openssl-users] Strange SSL_read behavior: 1/N-1 But given that SSL/TLS is a stream service and any implementation

[openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Amarendra Godbole
So Adam Langley writes SSLv3 decoding function was used with TLS, then the POODLE attack would work, even against TLS connections. on his the latest POODLE affecting TLS 1.x. (https://www.imperialviolet.org/). I also received a notification from Symantec's DeepSight, that states: OpenSSL

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Salz, Rich
I also received a notification from Symantec's DeepSight, that states: OpenSSL CVE-2014-8730 Man In The Middle Information Disclosure Vulnerability. Did Symantic really label it an OpenSSL CVE? That's wrong. OpenSSL does not have this defect. /r$

[openssl-users] Help with using a dynamic engine with SSL_CTX

2014-12-09 Thread Brian Watson
Hi, I am doing the following: 1. I have a dynamic engine that I would like to use to produce random numbers on Android (aosp). 2. I can successfully load the dynamic engine by using the Android OpenSSLEngine.getInstance() which takes care of loading the engine and I can see that the binding is

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Mitra, Rituparna (STSD)
Hi, OpenSSL does not have this defect. Does this mean that openssl is not vulnerable to this issue even if TLS 1.0/TLS 1.1 are enabled? Are all versions of openssl (0.9.8* and 1.0.1*) free from impact? Thanks, RMitra -Original Message- From: openssl-users

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Salz, Rich
Does this mean that openssl is not vulnerable to this issue even if TLS 1.0/TLS 1.1 are enabled? Are all versions of openssl (0.9.8* and 1.0.1*) free from impact? OpenSSL does not have this defect. ___ openssl-users mailing list

Re: [openssl-users] Freeze to mailing list memberships

2014-12-09 Thread Alvaro Herrera
Kurt Roeckx wrote: Kurt ___ openssl-users mailing list openssl-users@openssl.org https://mta.opensslfoundation.net/mailman/listinfo/openssl-users The footer still says mta.opensslfoundation.net ... is this intentional? -- Álvaro Herrera

Re: [openssl-users] Freeze to mailing list memberships

2014-12-09 Thread Salz, Rich
openssl-users mailing list openssl-users@openssl.org https://mta.opensslfoundation.net/mailman/listinfo/openssl-users The footer still says mta.opensslfoundation.net ... is this intentional? Yes, until we make some more DNS changes as we move our infrastructure forward.

Re: [openssl-users] Help with using a dynamic engine with SSL_CTX

2014-12-09 Thread Dmitry Belyavsky
Hello! Do you set your RNG as default when the engine is loaded? On Tue, Dec 9, 2014 at 10:44 PM, Brian Watson bwats9...@gmail.com wrote: Hi, I am doing the following: 1. I have a dynamic engine that I would like to use to produce random numbers on Android (aosp). 2. I can successfully

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Arthur Tsang
Hi Rich, do we have some formal announcement that openssl is not vulnerable for POODLE in TLS? or can you explain why Openssl is not affected? if symantec is issuing notification like that, i guess, a lot of management will demand explanations. Thanks, Thanks, Arthur On Tue, Dec 9, 2014 at

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Jeffrey Walton
On Tue, Dec 9, 2014 at 2:07 PM, Amarendra Godbole amarendra.godb...@gmail.com wrote: So Adam Langley writes SSLv3 decoding function was used with TLS, then the POODLE attack would work, even against TLS connections. on his the latest POODLE affecting TLS 1.x. (https://www.imperialviolet.org/).

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Salz, Rich
Ask Symantec why they labeled it as an openssl CVE; it is not. Read AGL’s blog post[1]. Two specific implementations are identified and a different crypto library (NSS) is implicated. This is about as formal a statement as you’re going to get. ☺ [1]

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Amarendra Godbole
On Tue, Dec 9, 2014 at 11:26 AM, Salz, Rich rs...@akamai.com wrote: I also received a notification from Symantec's DeepSight, that states: OpenSSL CVE-2014-8730 Man In The Middle Information Disclosure Vulnerability. Did Symantic really label it an OpenSSL CVE? That's wrong. OpenSSL does

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Matt Caswell
On 09/12/14 20:30, Arthur Tsang wrote: Hi Rich, do we have some formal announcement that openssl is not vulnerable for POODLE in TLS? or can you explain why Openssl is not affected? if symantec is issuing notification like that, i guess, a lot of management will demand explanations.

Re: [openssl-users] Help with using a dynamic engine with SSL_CTX

2014-12-09 Thread Brian Watson
I thought that's what the following does: ENGINE_set_default(engine, ENGINE_METHOD_RAND). I'm also trying to figure out in rand_lib.c and RAND_get_rand_method() what causes default_RAND_meth to change. Thanks, BW On Tue, Dec 9, 2014 at 1:52 PM, Dmitry Belyavsky beld...@gmail.com wrote:

[openssl-users] Please unsubscribe me from these emails.

2014-12-09 Thread Olson, Tina S
Tina Olson Systems Integration Analyst-Staff, EBS Lockheed Martin Corporation Telecommuter - Valley Forge, PA O 484-369-6001 | M 484-557-1003 | E tina.s.ol...@lmco.com ___ openssl-users mailing list openssl-users@openssl.org

Re: [openssl-users] CVE-2014- and OpenSSL?

2014-12-09 Thread Arthur Tsang
thanks for the clarification. On Tue, Dec 9, 2014 at 1:00 PM, Matt Caswell m...@openssl.org wrote: On 09/12/14 20:30, Arthur Tsang wrote: Hi Rich, do we have some formal announcement that openssl is not vulnerable for POODLE in TLS? or can you explain why Openssl is not affected? if

Re: [openssl-users] Help with using a dynamic engine with SSL_CTX

2014-12-09 Thread Dmitry Belyavsky
Hello Brian, Do you call ENGINE_set_RAND function? On Tue, Dec 9, 2014 at 11:19 PM, Brian Watson bwats9...@gmail.com wrote: I thought that's what the following does: ENGINE_set_default(engine, ENGINE_METHOD_RAND). I'm also trying to figure out in rand_lib.c and RAND_get_rand_method() what