[openssl-users] Closing old tickets

Here is the list of old RT tickets that we are closing. We sent email to all of the originators, and it included the following text: If you still think it is important for us to consider, please open an issue on GitHub. Don't be shy! We are closing issues based purely on the date, and the fact

[openssl-users] Some policy changes: RT retiring; use GitHub

public." We're excited by these changes, and hope that they provide increased transparency, and increased engagement with our community. We hope you're excited too! -Rich Salz, Dev Team Member -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] [openssl.org #3804] BUG: OpenSSL 1.0.2 Solaris 32 bit build is broken

apparently a Sun library bug, closing this report as requested by the original poster. -- Rich Salz, OpenSSL dev team; rs...@openssl.org ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[openssl-users] The evolution of the 'master' branch

As we've already said, we are moving to making most OpenSSL data structures opaque. We deliberately used a non-specific term. :) As of Matt's commit of the other day, this is starting to happen now. We know this will inconvenience people as some applications no longer build. We want to work with

Please whitelist mta.opensslfoundation.net

In a day or two we will be moving the mailing list to mta.opensslfoundation.net Please add that host to any filtering rules you have. (Also note that openssl-cvs is being renamed to openssl-commits) This will also be the server for all openssl.org mail. We will also be adding reverse-DNS

[openssl.org #2419] Resolved: 1.0.0c build on Intel Core i3 ignores my "--prefix=" option, installs in /usr. How to fix?

According to our records, your request has been resolved. If you have any further questions or concerns, please respond to this message. __ OpenSSL Project http://www.openssl.org User Support Mailing

[openssl.org #2419] 1.0.0c build on Intel Core i3 ignores my "--prefix=" option, installs in /usr. How to fix?

Old release. Can't reproduce in current stuff. Closing ticket. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing

[openssl.org #1227] Runnning openssl test

you have to look at the exit code. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org

Re: X509 digest different after write and read to-from PEM

If there is a difference as small as one bit then the digests should be different. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com This address will be going away; please use [EMAIL PROTECTED

Re: X509

> Does anyone know why an X509 digest would be different after the X509 is > written out and read back into another X509 from PEM? Software bug. No other explanation. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.co

RE: Using OpenSSL over a high level peer-to-peer middleware

ly flawed. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com This address will be going away; please use [EMAIL PROTECTED] __ OpenSSL Project

Re: Using OpenSSL over a high level peer-to-peer middleware

TLS spec discusses some of the implications. You might also want to look at the "security" in SNMPv3. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/

Re: ECB, CBC, CFB, OFB, and when and where you would use them.

od trade-off for your team to make. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html

Re: BIO_READ and BASE64 Decode

> char *sBase64[21] // this variable contains the Base64 Encoded string That's not a char buffer. I don't know what you're trying to do, but your code doesn't make sense to me. Did you see the sample code I posted the other day? /r$ -- Rich Salz

RE: ECB, CBC, CFB, OFB, and when and where you would use them.

why not uses pgp -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html __ OpenSSL Project

Re: Base64 Help

now invalid! -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html __ OpenSSL Pro

Re: Licensing conditions in OpenSSL with proprietary software

e OpenSSL/SSLeay acknowledgement and copyright wherever you show your copyright and "ownership" statement. -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com

RE: Licensing conditions in OpenSSL with proprietary software

> Many other countries also restrict the export of encryption products. And some restrict the imports, as well. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.

Re: TPM support !!!

Are you padding your data out to the right size? The code in crypto/apps is a really good way to learn how to use the OpenSSL library. Learn the commands, find one that does what you want, and read the source for it. /r$ -- Rich Salz, Chief Security Architect DataPower Technology

Re: I have some question

export rules don't apply for this any more. -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html ___

Re: Reading from standard input

> Anyway, I don't know why I got different hashes The newline that echo adds. Try echo -n 1122 | openssl dgst -md5 -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/

Re: Threading OpenSSL

/r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html __ OpenSSL Project

Re: problems making Certificate Request

code. What is "Par" ? /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html _

Re: OCSP Apis

For example OCSP_CERTID_free is exported in libcrypto.so but I could not find it in the source code Look at asn1/asn1.h adn asn1/asn1t.h /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http

Re: Plan for OCSP verifier to LDAP?

"OCSP over LDAP" is documented? /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html __

Re: Plan for OCSP verifier to LDAP?

> Is there any plan to support OCSP verification over LDAP (or LDAP/s)? This question makes no sense. OCSP and LDAP are two differnet protocols. It's like saying "SMTP over HTTP" /r$ -- Rich Salz Chief Security Architect DataPower Tec

Re: difference between authenticode certificate and normal certificate?

Sorry if this is a bit OT, can someone explain what is the difference between an MS Authenticode certificate, a normal certificate, and a certificate for signing Netscape object? The values in the keyUsage and extendedKeyUsage extensions. /r$ -- Rich Salz, Chief Security Architect

Re: Investigating a leak

re calling OpenSSL. Do you get the same growth when openssl isn't used? Make sure you "xxx_free" every object you "xxx_new". /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40

Re: does openssl allocate memory with 16 bit alignment?

may return "three" extra bytes, knowing that they will be wasted by the cast. But then it has to allow for that in the implementation of free(), and that's very hard to do. So malloc returns a pointer that is already worst-case aligned. /r$ -- Rich Salz Chief

Re: Creating certs for others (without their private keys)

t;proof of possession" and is a common practice. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html

Re: Securing a CA

ents don't. our old local root to new local root transition was people who decided to mark the end-user certificate as trusted in their browsers rather than take the risk of trusting our root. "If you want PGP you know where to find it." /r$ -- Rich Salz, Chief Secur

Re: Securing a CA

t;(and get hte new root distirbuted and used)" would probably have been worth adding. At any rate, the key point is that if you anchor everything you do under a single root, than moving your tree underneath something else is a lot eaiser if only one "root" has to move, rather than

Re: Securing a CA

> I need some info about the protocols or standars for securing a CA Root At the risk of being immodest, you might find this column useful: http://webservices.xml.com/pub/a/ws/2003/12/09/salz.html /r$ -- Rich Salz Chief Security Architect DataPower Technol

Re: Securing small UDP transmissions

client. Second, attacker could be get a key because in first > connection it is going to client as plain text. The original posting said the clients/agenets were going to connect with SSL. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://ww

Re: how to generate one rsa key which size is 256 or less than 256

> yes,I am sure,can you give me any advice?:) Drop SSL. -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xml

Re: how to generate one rsa key which size is 256 or less than 256

> openssl's genrsa can't do this work,any other tool to do this work? Are you really sure that the RSA work is so great that you need such a ridiculously small key size? The security is so weak perhaps you should just drop SSL altogether. /r$ -- Rich Salz C

Re: Securing small UDP transmissions

r UDP, where packets can arrive out of order or not at all. > Each transmission here would probably be some 50-100 bytes, once a > minute, set to scale for a few thousand servers per tracker. Run some timing tests on your planned hardware, such as "openssl speed rsa" /r

Re: C code structure at OpenSSL

and you might be able to make some automated script that does a lot of the work for you. If you made that file, then submitted to the openssl developers, they might be willing to keep it current. -- Rich Salz Chief Security Architect DataPower Technology h

Re: Regarding all the spam...

Rich Salz wrote: Probably not worth supporting any more. Ben Laurie wrote: I disagree. Ben's voice carries way more weight than mine :) I stand down... /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Sec

Re: OpenSSL, socket and Kernel

Why not use IPsec. Why does it have to be in the kernel? It's hard to see what the security trade-offs are that make this necesary. -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapowe

Re: Regarding all the spam...

sed to be in the spirit of crypto open source (cypherpunkcs, etc) to allow anon posting because of the whoele ethos thing. Probably not worth supporting any more. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Securi

Re: revoking expired certificates

be in the CRL. The rules say that a revoked cert must appear in (at least?) one CRL after its expiration period. Without that, as you point out, there is a gap during which the cert could appear valid. /r$ -- Rich Salz, Chief Security Architect DataPower Technology

Re: revoking expired certificates

an expired certificate in order to handle this flow revoke crl-n expire crl-n+1 remove-from-crl-list make sense? /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products

Re: Hardware crypto speed anyone?

h hardware crypto, your CPU spends most of its time waiting for data to flow to/from the device (e.g., across the PCI bus). Try running 10 speed tests simultaneously in the background, or write a multi-threaded test, etc. /r$ -- Rich Salz, Chief Security Architect DataPower

Re: Alternative CRL formats

for financial support, so throwing a few bucks might be a cheap way to get the code done faster. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Secu

Re: "expired" CRL

Paradoxically, the more valuable the certs, the easier it should be to crank up the CA and sign CRL's. If you really care, have your CA issue a CRL-issuing-certs to someone else. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.

Re: The _min suffix for the req command

t least in spirit (provided the CSR builder and the CA operator use the same configuration file). I'll work on that. The advantage of _required is that I was also able to add it into add_attribute_object using the same "_required" technique. Understanding "policy" means tha

Re: help with data signing please.

or the bad guys to steal your information or defraud you or your clients. Lastly, thanks for tolerating my newbieness, it's much appreciated. :) Sure. Now that I look closer, apps/smime.c is really what you want to look it -- it shows how to call the PKCS7_xxx API. /r$ -- Rich Salz,

Re: The _min suffix for the req command

uot;-policy" argument to the req command? I could at least use match or supplied to mean "a required field". /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Secu

Re: help with data signing please.

lse I should be looking for/at? Given the cryptographic naivete of your questions, you are better of using standard mechanisms like PKCS#7; see apps/pkcs7.c, e.g. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security

The _min suffix for the req command

s on the policy of the CA, but since we support min/max it makes sense to be able to say something's required, too. I also have code that adds this to the attribute section. Should I send it to RT (and US export address?) /r$ -- Rich Salz, Chief Security Architect DataPower Technology

How to set up an enterprise PKI

ot signing ceremony, and so on. Links to working scripts and OpenSSL config files are included. Please post comments to the website. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.co

Re: Usage of AES question

i need to encrypt a file using AES, and I want to use some sort of private key which encrypts and decrypts, with a passphrase. You mean like PKCS#12? /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security

Re: Pop, imap cert

Randall Perry wrote: I've got separate key, cert files for apache. Do I need to embed the key and passphrase in the server to work with ipop3d? The server needs access to the private key that matches the cert. /r$ -- Rich Salz, Chief Security Architect DataPower Techn

Re: Pop, imap cert

te, for example. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/x

Re: How to convert Base-64 encoding into Url Encoding

Base-64 encoding mandates to have a '\n' after every 64 bytes. No, it doesn't. It's common practice, but it's not required. Add BIO_FLAGS_BASE64_NO_NL, as in BIO_set_flags(your_bio_object, BIO_FLAGS_BASE64_NO_NL); /r$ -- Rich Salz, Chief Security Archi

Re: Compiance with Browser Requirements

the certificate set-up. Is this correct? Yes. There are also "wildcard" names, which let you say things like "*.example.com". > Is the > file name of the certificate irrelevant? Yes. /r$ -- Rich Salz Chief Security Architect DataPower Techno

Re: CRL Extention Voodoo

I assume you've read RFC 3280. The real "king of the CRL world" is Entrust. They did lots of work creating all sorts of CRL concepts -- Delta, mostRecentCRL, etc. You can probably find some information around on their web pages. /r$ -- Rich Salz C

Re: Decrypting SSL packets with openSSL

vers have it. In the old days of US export control, there was a scheme where the server would only have a small RSA key, but it would generate a temporary-use key every 24 hours or so. Nowadays only legacy deployments are about this. /r$ -- Rich Salz Chief Security Architec

Re: To begin...

Yes, I'm using a comercial webserver and I can't get anykind of information in my providers site. Then OpenSSL will be of no help to you. To use openssl you need to reconfigure and rebuild the server. /r$ -- Rich Salz, Chief Security Architect DataPower Technology

Re: To begin...

I'm a php developer, but I never used OpenSSL. Can someone tell me the necessary/basic steps ? If you are using Apache 1.3.x, you need/want the mod_ssl module; see www.modssl.org. If you are using Apache 2.x, mod_ssl is part of the basic release. If you are using a commercial webserver, you pro

Re: Distributing OpenSSL and staying out of jail

forms. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/xmlsec

Re: Cert verify question

> something) I've realized that there is actually nothing in a > certificate that tells anyone exactly where to go to get the issuer's > certificate (i.e. walk the chain). Right. That's pretty much why all PKI protocols are client-push. /r$ -- Rich Salz

Re: diagram explaining encryption using openssl

;ve only wasted a day's worth of traffic. And you still haven't addressed the real bug in your diagram. Good luck with your project, I've run out of time here. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapowe

Re: diagram explaining encryption using openssl

se that's not what it is. Compare http://www.hyperdictionary.com/dictionary/one-way+hash+function and http://www.hyperdictionary.com/dictionary/checksum /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS

Re: diagram explaining encryption using openssl

n't a checksum, it's a Message Digest. It is disappointing to have had so many email exchanges and still see such fundamental errors. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://

Re: Dodgy "Microsoft fix" emails

It doesn't matter if I have it or not. You are missing the point. The list is a source of spreading the virus and therefore has a responsibility to take care of it. You're new to this internet thing, aren't you. -- Rich Salz, Chief Security Architect DataP

Re: diagram explaining encryption using openssl

> Signing does not have to be an application of hashing and encryption. Take > a look at DSA. Yes, of course. I simplified for the audience. I should have made that explicit. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapow

Re: diagram explaining encryption using openssl

age, then that adds 20 bytes (SHA1). Are you worried about data corruption such that an a non-signed hash is actually buying you anything? /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.

Re: diagram explaining encryption using openssl

> This is probably more than the OP needed to read... I think in the crypto world, "proof by intimidation" seems to have its place. :) /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security

Re: diagram explaining encryption using openssl

lic key. It signs a certificate. There is a difference. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http:/

Re: diagram explaining encryption using openssl

st? Etc. > I will take a look at the commands, and read the RFC. Is there something > specific I should be looking for? General knowledge. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway h

Re: Converting PEM cert to DER format

allocate; then you call it again with a valid buffer of the required size. The d2i_XXX functions do the inverse. The "trick" to using them, is you pass a pointer to the pointer, because they advance the pointer to the next DER element. -- Rich Salz, Chief Security Archi

Re: subjectAlternateName

ng. I wonder how useful it really is? The *semantics* are what count, not the *syntax.* And tools like dumpasn show that you can dump DER without having the ASN.1 around. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40

Re: FIPS mode

It is unfortunate that the process could not have been more open, but I considered the goal worth that sacrifice, Not a problem for me. :) This is great -- one of the most exciting things I've seen in a long time! /r$ -- Rich Salz, Chief Security Architect DataPower Techn

Re: RSA key size is 64 or 128?

> why I can't build certificate with one 64 or 128 bits size RSA key? Because it could be cracked almost immediately. :) You are probably confusing RSA keys (which are 1K 2K or 4K typically) with DES and RC4. /r$ -- Rich Salz Chief Security Architect D

Re: Saving SSL state / connections across processes

You might look at how mod_ssl does it, www.modssl.org. It integrates OpenSSL and the Apache 1.3 line, and provides several ways to "serialize" sessions so that they can be shared across multiple processes, using the hooks within OpenSSL. /r$ -- Rich Salz Chie

Re: OpenSSL denial of service

pre-computation, to avoid SSL DoS. I don't know if it expired, or never happened. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Sec

RE: memory leak with OpenSSL 0.9.7b

> Is there a reason you are running mod_ssl and openssl. > One is a complete replacement for the other You are very confused. mod_ssl is the "glue" that adds in OpenSSL to Apache 1.3.x. In Apache 2.0 mod_ssl is integrated into the apache core. /r$ -- Rich Salz

RE: FQDN

> There is no law that says the MITM must pass any traffic to any particular > party. Yes there is. The law of "definition of MITM" > If he can get plaintext out of A without sending anything ever to B, > then he has won and he's still a man in the middle. The key is that he can > intercep

RE: FQDN

hat the A:B comm channel has been attacked, than the protocol is *not* protected against MITM. Or, you must include the OOB information as part of the protocol. :) /r$ PS: 35 web sites either got the definition wrong, or weren't clear enough for you to understand? I'm not swaye

Re: FQDN

to write code that prevents MITM.) /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xml

Re: ???

/r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/xmlsec

Re: FQDN

Yes, it will be a big problem if someone spoof DNS, but it can prevent man-in-the-middle to some extent. If the DNS is sabotaged, what can we do? What should I believe? :-) The point is that if you trust the user -- you should, after all you are doing what they requested you to do -- than you don'

RE: Problem with X509_set_verify()

> Thanks for that. OK I'll just have to set to work with printf's ( and > returns, as currently it crashes so badly I don't get the printf's). This Try "setbuf(stdout, NULL)" in main. printfs might be getting lost due to standard i/o buffering. -- Rich

Re: need a RC4 128 bit certificate

/r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/xmlsecurity

RE: Exportability of software based on OpenSSL libraries

> > In my experience if you just refer to the SSL/TLS spec you're fine. > >Really? Even if you don't specify any algorithms or key lengths in detail? Yeah. We just said RSA key exchange (512 through 2048 bits typical) for symmetric encryption key. For details, see RFC . >Where did you get t

RE: Exportability of software based on OpenSSL libraries

ithms and > key lengths, so you won't have to weaken your export version, just exercise > more control. Agreed. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.dat

Re: certificate authentication

ing like "are signed by the same CA" ? /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/

Re: Exportability of software based on OpenSSL libraries

XML Encryption. /r$ -- Rich Salz, Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html XML Security Overview http://www.datapower.com/xmldev/x

Re: Exportability of software based on OpenSSL libraries

stem, their advice is irrelevant. If you are shipping statically-linked executable that has been stripped, their advice is probably irrelevant. Get an export lawyer. Get the legal department of your company to find one. /r$ -- Rich Salz, Chief Security Architect DataPower Technology

Re: What's the strongest encryption available

If the bits paramater in RSA_generate_key fuction equals 128, does this mean > I have created a 128 bit key? Yes. But that would be quite silly and insecure. Use 1Kbit or 2Kbit. /r$ -- Rich Salz Chief Security Architect DataPower Technology http://ww

Re: What's the strongest encryption available

> VeriSign claims its 128-bit $889 Secure Site Pro Certificate is > the strongest encryption available. Is this true? That's using 128bit RC4 for the bulk encryption of SSL/TLS traffic between server and client. > If so how is it possible to create a 1024 bit or greater RSA private key > with Op

Re: OpenSSL - Java [newbie]

e http://www.rtfm.com /r$ -- Rich Salz Chief Security Architect DataPower Technology http://www.datapower.com XS40 XML Security Gateway http://www.datapower.com/products/xs40.html _

Re: Certificats : chain

Not to be flip, but it's difference between theory and practice. The protocols and data structures are all set up to enable "the right thing." It just doesn't work that way. /r$ __ OpenSSL Project

Re: Certificats : chain

Ok let me rephrase my original question: Why would someone trust a cert chain of length 3 less then they would a cert chain of length 2? I see software (like apache) that have a tunable acceptable-cert-chain-length parameter. Why wouldn't you just trust any cert chain length? Because it's a great

Re: 2 questions

My question is, do I need to register these callbacks even if my own code will always call the openssl functions from a single thread of execution? no. My question is, what "cleanup stuff" do I need to call to free up resources claimed by SSL_library_init()? Look at the last dozen or so lines of m

Re: Leading zeros in serial numbers

OpenSSL follows the DER specifications: if the serial number is positive and the MSB is set then one leading zero is added. Anything else would break the standards. I think he means he wants serial numbers "001" "002" ... "010" ... etc. I dont think that's allowed; ASN.1 integers don't have leadin

Re: Export regulations

The basic question amounts to: Is there an exportable version of OpenSSL? I assume you mean exportable from the US (or by a US company). The short answer is that things have gotten more liberal -- there's no longer the concept of "no DES, only 512-bit RSA, only 40bit RC4" -- but there's more pap

Re: OCSP & CRL

On Tue, 18 Mar 2003, [EMAIL PROTECTED] asked: how does the CRL get from the CA to the OCSP responder There is no single answer. Possibilities include: -A "publication" plugin for the CA that sends it to the OCSP responder -The CA publishes to LDAP and the OCSP responder polls for ne

  1   2   3   >