Re: [openssl-users] DTLS with multiple clients

Are you able to share a simple reproducer of your problem? Matt On 05/04/18 02:14, Varun Kulkarni wrote: > Hi, > > I was able to get DTLS work with the latest version of openssl with a > single client and server. However, I was unable to get it to work with > multiple clients. The first client c

Re: [openssl-users] AES-GCM cipher in TLS

On 05/04/18 05:12, PS wrote: > I am trying to decrypt TLS 1.2 records that is using the > TLS_AES_128_GCM_SHA256 cipher-suite using openssl's EVP API. > > Per RFC 5246, decryption needs 4 inputs. > " > >In order to decrypt and verify, the cipher takes as input the key, >nonce, the "addition

Re: [openssl-users] AES-GCM cipher in TLS

Thanks Matt. I did read those RFC as well. And here is the confusion. The RFC5116 says this section 2.1 There is a *single output:* A ciphertext C, which is at least as long as the plaintext, or an indication that the requested encryption operation could not be performed. N

Re: [openssl-users] DTLS with multiple clients

Hi Matt, I was able to fix the issue with the following changes. The change was to create new fd (bound to server address) each time DTLSv1_listen() was called. Previously, I used the same fd for every DTLSv1_listen call. The new dgram BIO was created with an old fd. On passing newly created fd

[openssl-users] RFC5077 KWK

Is it possible to use 5077 with a key wrapping key in a Needham-Schroeder scenario: * A is a Key Server * C is say a web server * A has a relationship with C and hence A has key KEYac * B wants to talk to C but doesn’t have a relationship with C * B has a relationship with A

Re: [openssl-users] RFC5077 KWK

> On Apr 5, 2018, at 2:02 PM, Henderson, Karl via openssl-users > wrote: > > Is it possible to use 5077 with a key wrapping key in a Needham-Schroeder > scenario: > > • A is a Key Server > • C is say a web server > • A has a relationship with C and hence A has key KEYac >

Re: [openssl-users] RFC5077 KWK

Thanks, > TLS 1.3 unifies session tickets with (external) PSKs, perhaps you should > recast your approach in terms of PSKs rather than session tickets. Is there a good implementation example of this? On 4/5/18, 2:19 PM, "openssl-users on behalf of Viktor Dukhovni" wrote: > On

Re: [openssl-users] RFC5077 KWK

> On Apr 5, 2018, at 2:29 PM, Henderson, Karl via openssl-users > wrote: > >> TLS 1.3 unifies session tickets with (external) PSKs, perhaps you should >> recast your approach in terms of PSKs rather than session tickets. > > Is there a good implementation example of this? I think you'd be t

Re: [openssl-users] RFC5077 KWK

Thanks On 4/5/18, 2:35 PM, "openssl-users on behalf of Viktor Dukhovni" wrote: > On Apr 5, 2018, at 2:29 PM, Henderson, Karl via openssl-users wrote: > >> TLS 1.3 unifies session tickets with (external) PSKs, perhaps you should recast your approach in terms of PSKs r

Re: [openssl-users] AES-GCM cipher in TLS

On 05/04/18 18:35, PS wrote: > Thanks Matt. > > I did read those RFC as well. And here is the confusion. The RFC5116 > says this section 2.1 > > There is a *single output:* > > A ciphertext C, which is at least as long as the plaintext, or > > an indication that the requested en

Re: [openssl-users] DTLS with multiple clients

On 05/04/18 18:53, Varun Kulkarni wrote: > Hi Matt, > > > I was able to fix the issue with the following changes. The change was > to create new fd (bound to server address) each time DTLSv1_listen() was > called. There should be no need to do that. Instead, when DTLSv1_listen returns successf

Re: [openssl-users] DTLS with multiple clients

On Thu, Apr 5, 2018 at 3:06 PM, Matt Caswell wrote: > > > On 05/04/18 18:53, Varun Kulkarni wrote: > > Hi Matt, > > > > > > I was able to fix the issue with the following changes. The change was > > to create new fd (bound to server address) each time DTLSv1_listen() was > > called. > > There sho

Re: [openssl-users] DTLS with multiple clients

On 05/04/18 23:37, Varun Kulkarni wrote: > > Thanks for the reply Matt. Previosuly , I did the exact thing you > mentioned. But in that case , the DTLSV1_listen returns succesfully (> > 0) immediately on reception of > app packet and hangs on SSL_accept. > > Here is tshark trace of the same: >

Re: [openssl-users] DTLS with multiple clients

On Thu, Apr 5, 2018 at 4:03 PM, Matt Caswell wrote: > > > On 05/04/18 23:37, Varun Kulkarni wrote: > > > > > Thanks for the reply Matt. Previosuly , I did the exact thing you > > mentioned. But in that case , the DTLSV1_listen returns succesfully (> > > 0) immediately on reception of > > app pack

Re: [openssl-users] DTLS with multiple clients

On Thu, Apr 5, 2018 at 4:03 PM, Matt Caswell wrote: > > > On 05/04/18 23:37, Varun Kulkarni wrote: > > > > > Thanks for the reply Matt. Previosuly , I did the exact thing you > > mentioned. But in that case , the DTLSV1_listen returns succesfully (> > > 0) immediately on reception of > > app pack

Re: [openssl-users] DTLS with multiple clients

On 06/04/18 00:19, Varun Kulkarni wrote: > > > On Thu, Apr 5, 2018 at 4:03 PM, Matt Caswell > wrote: > > > > On 05/04/18 23:37, Varun Kulkarni wrote: > > > > > Thanks for the reply Matt. Previosuly , I did the exact thing you > > mentioned. But in t