Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Jakob Bohm
On 12/05/2015 21:45, Nico Williams wrote: On Tue, May 12, 2015 at 08:23:34PM +0200, Jakob Bohm wrote: How about the following simplifications for the new extension, lets call it GSS-2 (at least in this e-mail). 1. GSS (including SASL/GS2) is always done via the SPNego GSS mechanism, which

Re: [openssl-users] RES: RES: Testing OpenSSL based solution

2015-05-13 Thread Jakob Bohm
On 12/05/2015 22:50, Marcus Vinicius do Nascimento wrote: I did some quick research and found this: http://en.wikipedia.org/wiki/Digital_Signature_Algorithm If my understanding is correct, the public key is (p, q, g, y). The private key would be x, such that y = g^x mod p. Is there some

[openssl-users] 2nd client connects to 1:1-server leads to client crash

2015-05-13 Thread Newcomer83
Hello everyone, I have a server that is supposed to accept only one client. The connection works just fine. When I tried to connect to the server with a second client while another connection is already active, I expected that the 2nd client would return some error code, but instead it crashes

Re: [openssl-users] [openssl-dev] Kerberos

2015-05-13 Thread Matt Caswell
On 08/05/15 09:40, Matt Caswell wrote: On 08/05/15 02:28, Jeffrey Altman wrote: Regardless, the inability to improve the support in this area has left the those organizations that rely upon 2712 with the choice of use insecure protocols or re-implement the applications. I do not

Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Jeffrey Altman
On 5/13/2015 3:17 PM, Nico Williams wrote: Kerberos in particular supports PROT_READY. There is no Kerberos IV GSS mechanism, FYI. I'd never heard of GSS-SRP-6a; do you have a reference? Nico, Look for draft-burdis-cat-srp-sasl. It was never standardized but I believe there is an

Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Nico Williams
We're closer. On Wed, May 13, 2015 at 07:10:10PM +0200, Jakob Bohm wrote: On 13/05/2015 17:46, Nico Williams wrote: On Wed, May 13, 2015 at 12:03:33PM +0200, Jakob Bohm wrote: On 12/05/2015 21:45, Nico Williams wrote: On Tue, May 12, 2015 at 08:23:34PM +0200, Jakob Bohm wrote: How about the

Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Jakob Bohm
For the TL;DR: My original quick writeup included some mistakes in the details of TLS (forgot about Finished messages) and SASL/GS2. It is thus in more than anticipated need of change before it can become a proper spec, finding and fixing such mistakes is the main benefit of having this kind of

Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Nico Williams
On Wed, May 13, 2015 at 12:03:33PM +0200, Jakob Bohm wrote: On 12/05/2015 21:45, Nico Williams wrote: On Tue, May 12, 2015 at 08:23:34PM +0200, Jakob Bohm wrote: How about the following simplifications for the new extension, lets call it GSS-2 (at least in this e-mail). 1. GSS (including

Re: [openssl-users] Testing OpenSSL based solution

2015-05-13 Thread Dave Thompson
From: openssl-users On Behalf Of Marcus Vinicius do Nascimento Sent: Tuesday, May 12, 2015 16:50 I did some quick research and found this: http://en.wikipedia.org/wiki/Digital_Signature_Algorithm If my understanding is correct, the public key is (p, q, g, y). You might want to look at the

Re: [openssl-users] [openssl-dev] Replacing RFC2712 (was Re: Kerberos)

2015-05-13 Thread Nico Williams
I wonder if we could do this in the KITTEN WG list. Maybe not every extension to TLS needs to be treated as a TLS WG work item... We should ask the security ADs. Nico -- ___ openssl-users mailing list To unsubscribe: