Re: [openssl-users] How to override methods in EVP_PKEY_METHOD structure that is attached to a EVP_PKEY_CTX?

2017-02-24 Thread Dr. Stephen Henson
On Fri, Feb 17, 2017, Stephan M?hlstrasser wrote: > Hi, > > we use OpenSSL 1.0.2 together with PKCS#11 tokens by plugging > methods into the RSA_METHOD structure that interface with the > PKCS#11 token, and this works fine so far. However, for creating RSA > signatures with PSS padding this strat

Re: [openssl-users] RSA_method_set_sign

2017-02-24 Thread Dr. Stephen Henson
On Sat, Jan 14, 2017, Melvyn Sopacua wrote: > Hello all, > > Some background: I'd like to have a workstation that uses OpenSSL 1.1 > instead of a lower version. For that I'm porting various pieces of > software and quickly discovered that I was repeating myself. In addition > this teaches me m

Re: [openssl-users] Using RSASSA-PSS in command line smime / cms utility

2017-02-24 Thread Dr. Stephen Henson
On Mon, Feb 13, 2017, Harakiri via openssl-users wrote: > Can i set the padding RSASSA-PSS or alg ECDSA via command line when using > openssl smime or openssl cms command? > I can't find an option for it. You have to use the cms command and -keyopt rsa_padding_mode:pss check out the documentatio

Re: [openssl-users] Specify padding scheme with EVP_VerifyFinal

2017-02-24 Thread Dr. Stephen Henson
On Thu, Feb 23, 2017, open...@tuta.io wrote: > Hi Michel, > > it looks like what I am looking for, but the software uses EVP_VerifyInit_ex > which is a typedef for EVP_DigestInit_ex. How are those functions related to > EVP_DigestVerifyInit? Can I use EVP_DigestVerify* functions along with > E

Re: [openssl-users] Help with "tlsv1 alert insufficient security"

2017-02-24 Thread Matt Caswell
On 24/02/17 16:15, Joseph Southwell wrote: > We upgraded from 0.9.8 to 1.0.2 and now we are seeing that message when > we try connecting to a server that previously worked. What does it mean > and how can I figure out how to work around it? I can’t get the server > to change anything and I need t

Re: [openssl-users] Help with "tlsv1 alert insufficient security"

2017-02-24 Thread Salz, Rich
Later versions ratched up the security. Try -ciphers DEFAULT@SECLEVEL=0 -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] Help with "tlsv1 alert insufficient security"

2017-02-24 Thread Joseph Southwell
We upgraded from 0.9.8 to 1.0.2 and now we are seeing that message when we try connecting to a server that previously worked. What does it mean and how can I figure out how to work around it? I can’t get the server to change anything and I need to be able to continue connecting to it. openssl

Re: [openssl-users] DTLS for SCTP connections

2017-02-24 Thread Michael Tuexen
> On 24 Feb 2017, at 10:31, mahesh gs wrote: > > Hi, > > I did some more search regarding this problem and found that its a defect in > kernel SCTP. OS was built with linux kernel version 2.6 which is quite old. > > Defect Link : https://sourceforge.net/p/lksctp/mailman/message/27729264/ > >

Re: [openssl-users] DTLS for SCTP connections

2017-02-24 Thread mahesh gs
Hi, I did some more search regarding this problem and found that its a defect in kernel SCTP. OS was built with linux kernel version 2.6 which is quite old. Defect Link : https://sourceforge.net/p/lksctp/mailman/message/27729264/ I upgraded to RHEL 7.1 and the problem resolved. Thanks for your