<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><font size="2"><span style="font-size:10pt;">> By raising the limit, you don't suddenly put every application at risk of a DoS,<br>
> because these applications won't suddenly use a 16k RSA key.</span></font></p>
<p><font size="2"><span style="font-size:10pt;"><br>
</span></font></p>
<p><font size="2"><span style="font-size:10pt;">Instead of raising the limit of <font size="2">
<span style="font-size:10pt;">client key exchange message length</span></font> more than 2048, why can't we add the
</span></font><br>
</p>
<p><font size="2"><span style="font-size:10pt;">"ssl3_check_client_hello" functionality in the
<span style="font-size: 10pt;">ss</span></span></font><span style="font-size: 10pt;">l/s3_srvr.c because that will "permit appropriate message length".</span></p>
<p><br>
<span style="font-size: 10pt;"></span></p>
<p><span style="font-size: 10pt;">I came across this functionality when I compared the code of openssl-1.0.1p and openssl-1.0.2e.<br>
</span></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<span style="font-size:12pt">Regards,<br style="">
Saurabh<br>
</span></div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of openssl-users-request@openssl.org <openssl-users-request@openssl.org><br>
<b>Sent:</b> Thursday, July 21, 2016 6:38 PM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> openssl-users Digest, Vol 20, Issue 18</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Send openssl-users mailing list submissions to<br>
openssl-users@openssl.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a id="LPlnk260145" href="https://mta.openssl.org/mailman/listinfo/openssl-users">
https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
openssl-users-request@openssl.org<br>
<br>
You can reach the person managing the list at<br>
openssl-users-owner@openssl.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Openssl software failure for RSA 16K modulus (Salz, Rich)<br>
2. Re: Openssl software failure for RSA 16K modulus (Salz, Rich)<br>
3. Re: Help finding replacement for ASN1_seq_unpack_X509<br>
(Jim Carroll)<br>
4. Re: [openssl-users] Help finding replacement for<br>
ASN1_seq_unpack_X509 (Salz, Rich)<br>
5. Re: Openssl software failure for RSA 16K modulus (Erwann Abalea)<br>
6. Re: Openssl software failure for RSA 16K modulus (Salz, Rich)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 21 Jul 2016 12:15:15 +0000<br>
From: "Salz, Rich" <rsalz@akamai.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Openssl software failure for RSA 16K<br>
modulus<br>
Message-ID:<br>
<f3934079655b4d8fa3328b21ea62ef6f@usma1ex-dag1mb1.msg.corp.akamai.com><br>
Content-Type: text/plain; charset="Windows-1252"<br>
<br>
<br>
> Largest accepted client key exchange message length seems to be set to 2048 bytes.
<br>
> Key exchange for an RSA16k is slightly larger than that (exactly 2048 bytes of pure crypto payload, plus a few bytes of overhead).<br>
<br>
> OpenSSL is too conservative here.<br>
<br>
Why not use an ECC key?<br>
<br>
We have to make trade-offs. Who uses a 16K RSA key?<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 21 Jul 2016 12:17:44 +0000<br>
From: "Salz, Rich" <rsalz@akamai.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Openssl software failure for RSA 16K<br>
modulus<br>
Message-ID:<br>
<e8e3f6f5b5a849ab8000dab434aace1d@usma1ex-dag1mb1.msg.corp.akamai.com><br>
Content-Type: text/plain; charset="Windows-1252"<br>
<br>
> We have to make trade-offs. Who uses a 16K RSA key?<br>
<br>
Let me add some clarification. Is it worth putting every application that uses OpenSSL at risk for a DoS attack with a 16K RSA key?<br>
<br>
-- <br>
Senior Architect, Akamai Technologies<br>
IM: richsalz@jabber.at Twitter: RichSalz<br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 21 Jul 2016 08:52:24 -0400<br>
From: "Jim Carroll" <jim@carroll.com><br>
To: <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Help finding replacement for<br>
ASN1_seq_unpack_X509<br>
Message-ID: <00e201d1e34e$ba83f760$2f8be620$@carroll.com><br>
<br>
We are porting M2Crypto which is a python swig wrapper around OpenSSL. It<br>
currently supports OpenSSL 0.9.8 and we are porting it to 1.1.0. The 1.1.0<br>
branch is really cool (clean, elegant code), but there were a few<br>
refactoring's that affected M2Crypto. Most were trivial getter/setter type<br>
changes, but a few were in the are of getting rid of some ASN1 processing<br>
(which happens to be our weakest point of understanding).<br>
<br>
We're left with porting the final bit -- which is related to X509 cert<br>
handling. Here's a sample use. The caller builds up the call with a the<br>
following 'psuedo-sequence'. get_der() is the function we are working on<br>
finishing.<br>
<br>
X508* load_cert_bio(char* filename) {<br>
BIO* bio = BIO_new_file(filename, "r");<br>
return PEM_read_bio_X509(bio, NULL, NULL, NULL);<br>
}<br>
<br>
unsigned char* get_der(int* len_out) {<br>
X509* cert = load_cert_bio("x509.pem");<br>
X509* ca = load_cert_bio("ca.pem");<br>
<br>
STACK_OF(X509)* stack = sk_x509_new_null();<br>
sk_x509_push(stack, cert);<br>
sk_x509_push(stack, ca);<br>
<br>
return ASN1_seq_pack_X509(stack, i2d_X509, NULL, len_out);<br>
}<br>
<br>
The ASN1_seq_pack_X509 was a macro -- and has been removed.<br>
<br>
<br>
> -----Original Message-----<br>
> From: openssl-users [<a href="mailto:openssl-users-bounces@openssl.org">mailto:openssl-users-bounces@openssl.org</a>] On<br>
> Behalf Of Salz, Rich<br>
> Sent: Thursday, July 21, 2016 4:35 AM<br>
> To: openssl-users@openssl.org<br>
> Subject: Re: [openssl-users] Help finding replacement for<br>
> ASN1_seq_unpack_X509<br>
> <br>
> > Would it be acceptable to just iterate the stack elements, passing<br>
> each X509<br>
> > through i2d_X509 and appending the results -- would that generate<br>
> valid<br>
> > DER?<br>
> <br>
> Maybe. It depends on what the receiver is expecting. If it's willing<br>
> to read a set of certs until it hits EOF (or equivalent) that's fine.<br>
> But if you're sending a SEQUENCE OF certificates then you need to wrap<br>
> it in an ASN1/DER container. For example, Netscape Cert Sequence<br>
> <br>
> Can you post a code snippet?<br>
> <br>
> <br>
> --<br>
> openssl-users mailing list<br>
> To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users">
https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
begin 666 smime.p7s<br>
M,( &"2J&2(;W#0$'`J" ,( "`0$Q"S )!@4K#@,"&@4`,( &"2J&2(;W#0$'<br>
M`0``H((.$3""!#8P@@,>H ,"`0("`0$P#08)*H9(AO<-`0$%!0`P;S$+, D&<br>
M`U4$!A,"4T4Q%# 2!@-5! H3"T%D9%1R=7-T($%",28P) 8#500+$QU!9&14<br>
M<G5S="!%>'1E<FYA;"!45% @3F5T=V]R:S$B," &`U4$`Q,9061D5')U<W0@<br>
M17AT97)N86P@0T$@4F]O=# >%PTP,# U,S Q,#0X,SA:%PTR,# U,S Q,#0X<br>
M,SA:,&\Q"S )!@-5! 83`E-%,10P$@8#500*$PM!9&14<G5S="!!0C$F,"0&<br>
M`U4$"Q,=061D5')U<W0@17AT97)N86P@5%10($YE='=O<FLQ(C @!@-5! ,3<br>
M&4%D9%1R=7-T($5X=&5R;F%L($-!(%)O;W0P@@$B, T&"2J&2(;W#0$!`04`<br>
M`X(!#P`P@@$*`H(!`0"W]QHSYO(`!"TYX$Y;[1^\; _-M?HCML[>FQ$SEZ0I<br>
M3'V3G[U*O)/M`QKCC\_E;5!:UI<IE%J L$EZVRZ5_;C*OS<X+1X^D4&M<%;'<br>
M\$\_Z#*>=,K(D%3IQE\/>)V:0#P.K&&J7A2/GH>A:E#<UYI.KP6SIG&4G'&S<br>
M4& *QQ.=. >&`JCIJ&DF&)"K3+!/(ZLZ3X38W\Z?X6EON]="UVM$Y,>M[FU!<br>
M7W):<0@WLWEEI%F@E#?W`"\-PI)RVM X<ML4J$7$72I]M[36Q.ZLS1-$M\DK<br>
MW4,`)?IAN6EJ6",1MZ<SCU9U6?7-*==&MPHK9;;30F\5LKA[^^_I75/5-%HG<br>
M`@,!``&C@=PP@=DP'08#51T.!!8$%*V]F'HTM";W^L0F5.\#O> DRU0:, L&<br>
M`U4=#P0$`P(!!C /!@-5'1,!`?\$!3 #`0'_,(&9!@-5'2,$@9$P@8Z %*V]<br>
MF'HTM";W^L0F5.\#O> DRU0:H7.D<3!O,0LP"08#500&$P)313$4,!(&`U4$<br>
M"A,+061D5')U<W0@04(Q)C D!@-5! L3'4%D9%1R=7-T($5X=&5R;F%L(%14<br>
M4"!.971W;W)K,2(P( 8#500#$QE!9&14<G5S="!%>'1E<FYA;"!#02!2;V]T<br>
M@@$!, T&"2J&2(;W#0$!!04``X(!`0"PF^"%)<+6(^(/E@:2G4&8G-F$>8'9<br>
M'EL4!R,V98^PV'>[K$%L1V"#4;#Y,CWG_/8F$\> %J6_6OR'SWAYB2&:XDP'<br>
M"H8UO/+>4<32EK?<?D[N</T<.>L,`E$4+8Z]%N#!WT9UYR2M[/1"M(63<!!G<br>
MNIT&-4H8TRMZS%%"H7ICT>:[H<4KPC:^$PWFO6-^>7NG"0U JVK=CXK#]O:,<br>
M&D(%4=1%]9^G8B%H%2!#/)GG?+TDV*F1%W.(/U8;,3@8M'$/FLW(#IZ.+AOA<br>
MC)B#RQ\Q\41,Q@1S279@#\?XO1> :R[IS$P.6IIY#R *+M6>8R8>59*4V((7<br>
M6GO0O,>/3H8$,(($KS""`Y>@`P(!`@(1`. CRQ42@U.)K6%N>E1G:R$P#08)<br>
M*H9(AO<-`0$+!0`P;S$+, D&`U4$!A,"4T4Q%# 2!@-5! H3"T%D9%1R=7-T<br>
M($%",28P) 8#500+$QU!9&14<G5S="!%>'1E<FYA;"!45% @3F5T=V]R:S$B<br>
M," &`U4$`Q,9061D5')U<W0@17AT97)N86P@0T$@4F]O=# >%PTQ-#$R,C(P<br>
M,# P,#!:%PTR,# U,S Q,#0X,SA:,(&;,0LP"08#500&$P)'0C$;,!D&`U4$<br>
M"!,21W)E871E<B!-86YC:&5S=&5R,1 P#@8#500'$P=386QF;W)D,1HP& 8#<br>
M500*$Q%#3TU/1$\@0T$@3&EM:71E9#%!,#\&`U4$`Q,X0T]-3T1/(%-(02TR<br>
M-38@0VQI96YT($%U=&AE;G1I8V%T:6]N(&%N9"!396-U<F4@16UA:6P@0T$P<br>
M@@$B, T&"2J&2(;W#0$!`04``X(!#P`P@@$*`H(!`0")L0W:>E,93G!2';Q6<br>
MI@8FM[A)X);G4:OQ\%H3216CM(P;8+QZ44*G>8RD(M\784Z1U78C"A332@)_<br>
MMAT)@&ZE!#W9NKL6_J&'J2Y#4D,6?*\R4,BF3UKI"-C/DR6<>XCH,&3FI/A6<br>
M@/TJ)!0S%YFL1.5IBZ-&!DO",]3I0)\&L+&LDT"YM0B3.IPJ4Z,0VST@83Q5<br>
M`X[93G8E`B$I^J-\<79/[N%?@>G[5(#;PWLU4K>$WB(]+# M,7]9O5(WL#-I<br>
M+4/K^M:E\9=W9U&,V>XGZ[RE!SAVC*2I./_?C/4#K$F^RO=SF3H/,JN<E3H3<br>
M/0Y&.E=T85"^QD _R^3BGZ(A`@,!``&C@@$7,((!$S ?!@-5'2,$&# 6@!2M<br>
MO9AZ-+0F]_K$)E3O`[W@),M4&C =!@-5'0X$%@04DF%K@N&BH*I/[&?QPJ/W<br>
MM( `P>PP#@8#51T/`0'_! 0#`@&&,!(&`U4=$P$!_P0(, 8!`?\"`0`P'08#<br>
M51TE!!8P% 8(*P8!!04'`P(&""L&`04%!P,$,!$&`U4=( 0*, @P!@8$51T@<br>
M`#!$!@-5'1\$/3 [,#F@-Z UAC-H='1P.B\O8W)L+G5S97)T<G5S="YC;VTO<br>
M061D5')U<W1%>'1E<FYA;$-!4F]O="YC<FPP-08(*P8!!04'`0$$*3 G,"4&<br>
M""L&`04%!S !AAEH='1P.B\O;V-S<"YU<V5R=')U<W0N8V]M, T&"2J&2(;W<br>
M#0$!"P4``X(!`0`;*FZL5<$ZJXC%V.W-5?.J:V$KP D0(YD/Q69J;['UM+5W<br>
M7@\"80#??07^$K.D@( `_/L=6VIR`@I!O 6ZP5C5)L+JU4V$^_Z"F,]8&^,B<br>
M8YQ2^+L%-JM]6*7>JSMCY=K5<^_LX/M[XJ/_\$(CG,JVC4T^Y$L8`[*H+=38<br>
MNT)+D&F%$-NF-S3H>^ !$*6<RCK'GT^(-&Z*9= :BKNIW,K*-M'T_,)D*36O<br>
MUK&G<1'2`T.QCSZ:[)XR4_1VDLJ&- >Y+,KF'$K8F0W!AN*0DOM:0FHC(1#I<br>
M9<?UU;M^ZHR%( )BZM$Z!RQ9Q9DS\CB)Y;;I%GH?>13V2A :)OI\BON;,((%<br>
M(#""! B@`P(!`@(1`-4+#]T2278FC)\!=Y87SN8P#08)*H9(AO<-`0$+!0`P<br>
M@9LQ"S )!@-5! 83`D=",1LP&08#500($Q)'<F5A=&5R($UA;F-H97-T97(Q<br>
M$# .!@-5! <3!U-A;&9O<F0Q&C 8!@-5! H3$4-/34]$3R!#02!,:6UI=&5D<br>
M,4$P/P8#500#$SA#3TU/1$\@4TA!+3(U-B!#;&EE;G0@075T:&5N=&EC871I<br>
M;VX@86YD(%-E8W5R92!%;6%I;"!#03 >%PTQ-C Q,3,P,# P,#!:%PTQ-S Q<br>
M,3(R,S4Y-3E:," Q'C <!@DJADB&]PT!"0$6#VII;4!C87)R;VQL+F-O;3""<br>
M`2(P#08)*H9(AO<-`0$!!0`#@@$/`#""`0H"@@$!`-K\XS'GF('[$TPZLMT=<br>
MY]ID(UGI@9^?K.$F3&?)JS.0Q"6)OD@;8S<+1#[2QFG.S045<BKJ-D6O9FQ\<br>
M<*2_A$&HWT6R`S' 7$<4M7HIO_"G@U#-`1,6W2HZ`,L53(EL?:P_[H%Y/6VB<br>
MJU\01/0U<U7T/"K$+CFK\>HV/H^"EPS!W)_L#3<"[3T(BZ3LDTHN"#(\B5A1<br>
M^VO2XN77=+Z\+IU=@1UR!40:,<7&)5,P,O1STRE:UFFYLS65=GVT*:ZY[YK9<br>
M':(_+75)?UCOJQ: M-%=9XH<_VNPXG^;7/:6"2-DDFNH3JMIBVKH$1G/E$ 9<br>
MD8XE<3>#8^@.89*P$#)O+'$"`P$``:."`=<P@@'3,!\&`U4=(P08,!: %))A<br>
M:X+AHJ"J3^QG\<*C][2 `,'L,!T&`U4=#@06!!0P:UC0J,N<!7>SB(9<*/G'<br>
MV*_ SS .!@-5'0\!`?\$! ,"!: P# 8#51T3`0'_! (P`# =!@-5'24$%C 4<br>
M!@@K!@$%!0<#! 8(*P8!!04'`P(P1@8#51T@!#\P/3 [!@PK!@$$`;(Q`0(!<br>
M`P4P*S I!@@K!@$%!0<"`18=:'1T<',Z+R]S96-U<F4N8V]M;V1O+FYE="]#<br>
M4%,P708#51T?!%8P5#!2H%"@3H9,:'1T<#HO+V-R;"YC;VUO9&]C82YC;VTO<br>
M0T]-3T1/4TA!,C4V0VQI96YT075T:&5N=&EC871I;VYA;F1396-U<F5%;6%I<br>
M;$-!+F-R;#"!D 8(*P8!!04'`0$$@8,P@8 P6 8(*P8!!04', *&3&AT=' Z<br>
M+R]C<G0N8V]M;V1O8V$N8V]M+T-/34]$3U-(03(U-D-L:65N=$%U=&AE;G1I<br>
M8V%T:6]N86YD4V5C=7)E16UA:6Q#02YC<G0P) 8(*P8!!04', &&&&AT=' Z<br>
M+R]O8W-P+F-O;6]D;V-A+F-O;3 :!@-5'1$$$S 1@0]J:6U 8V%R<F]L;"YC<br>
M;VTP#08)*H9(AO<-`0$+!0`#@@$!`&7_YE!"6I-N>DE*'QH34=CM%+[K`1M]<br>
M]CL[U/FRY5[^LX>0V\F[3S&JAG>8?S4(\8%YC7"@FZN?&[XNG;*71FB1VC5\<br>
M[C@1T1/1VFB^.U_DY "31W;:;K"NZ]K)Q3#HO(@&45E,YCJ!NY$AC!C\IGQ:<br>
M2/NGP"_K'85*^(.K.&Q*INS)?2E26GN'Y^%BLAID@HA<[DL&']YY*Z 9#&;V<br>
MFJ3HYV^Y[HF)FFH-]D/]<5G):'.LJD*"]IJWI4,'-BQ;060E4[7[NKAN!^P\<br>
MBTU&T;&8EQ; '\I'[_^.1-;+K'J.:_]/&2]A0@L9SC^8NO*8S_4,>"4TRIOH<br>
MI'J>$[1$P4TQ@@0C,(($'P(!`3"!L3"!FS$+, D&`U4$!A,"1T(Q&S 9!@-5<br>
M! @3$D=R96%T97(@36%N8VAE<W1E<C$0, X&`U4$!Q,'4V%L9F]R9#$:,!@&<br>
M`U4$"A,10T]-3T1/($-!($QI;6ET960Q03 _!@-5! ,3.$-/34]$3R!32$$M<br>
M,C4V($-L:65N="!!=71H96YT:6-A=&EO;B!A;F0@4V5C=7)E($5M86EL($-!<br>
M`A$`U0L/W1))=B:,GP%WEA?.YC )!@4K#@,"&@4`H(("1C 8!@DJADB&]PT!<br>
M"0,Q"P8)*H9(AO<-`0<!,!P&"2J&2(;W#0$)!3$/%PTQ-C W,C$Q,C4R,C1:<br>
M,",&"2J&2(;W#0$)!#$6!!1G&[GL6/=H8LZE9M4)L7L&;?<.K#!;!@DJADB&<br>
M]PT!"0\Q3C!,, H&""J&2(;W#0,', X&""J&2(;W#0,"`@(`@# -!@@JADB&<br>
M]PT#`@(!0# '!@4K#@,"!S -!@@JADB&]PT#`@(!*# '!@4K#@,"&C"!P@8)<br>
M*P8!! &"-Q $,8&T,(&Q,(&;,0LP"08#500&$P)'0C$;,!D&`U4$"!,21W)E<br>
M871E<B!-86YC:&5S=&5R,1 P#@8#500'$P=386QF;W)D,1HP& 8#500*$Q%#<br>
M3TU/1$\@0T$@3&EM:71E9#%!,#\&`U4$`Q,X0T]-3T1/(%-(02TR-38@0VQI<br>
M96YT($%U=&AE;G1I8V%T:6]N(&%N9"!396-U<F4@16UA:6P@0T$"$0#5"P_=<br>
M$DEV)HR?`7>6%\[F,('$!@LJADB&]PT!"1 ""S&!M*"!L3"!FS$+, D&`U4$<br>
M!A,"1T(Q&S 9!@-5! @3$D=R96%T97(@36%N8VAE<W1E<C$0, X&`U4$!Q,'<br>
M4V%L9F]R9#$:,!@&`U4$"A,10T]-3T1/($-!($QI;6ET960Q03 _!@-5! ,3<br>
M.$-/34]$3R!32$$M,C4V($-L:65N="!!=71H96YT:6-A=&EO;B!A;F0@4V5C<br>
M=7)E($5M86EL($-!`A$`U0L/W1))=B:,GP%WEA?.YC -!@DJADB&]PT!`0$%<br>
M``2"`0"BA-SZ*7/VI,VOREMEIW/;NJ!T.(Q,&_+LZM3[,K57Q>;>/_E:B,?4<br>
MK5#@,W&"P\/'6&9N(0O:&\E9$LLW&L4A&HFUP*--6&QWBNO"Q&@@SIXKRKY!<br>
M_1ADXBJEW(_'N=2L<O%!9/VQ^P]?>'::Q/1SE_GHOFK1&0]"5Q.5WG@#>A65<br>
MB(_+) A!06%L^,:81&8%&!ZR+=BE5G.6@!ENZ? 9F%CZ(<"+? HBSP6%VV8?<br>
MTAS31B5,U\:SOL4_RM%C>8G1EAU^KEX8F\F8/,E_>XVZIV_@N7TL:@M3&I0Q<br>
J=3SK\27,?_:X'&P\D7@_/_32#280-K>N"UZHE-(Y;\OR3/=C````````<br>
`<br>
end<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Thu, 21 Jul 2016 12:57:09 +0000<br>
From: "Salz, Rich" <rsalz@akamai.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Help finding replacement for<br>
ASN1_seq_unpack_X509<br>
Message-ID:<br>
<b54c7abdcf9d4d589ff40e7603228ba4@usma1ex-dag1mb1.msg.corp.akamai.com><br>
Content-Type: text/plain; charset="Windows-1252"<br>
<br>
<br>
> STACK_OF(X509)* stack = sk_x509_new_null();<br>
> sk_x509_push(stack, cert);<br>
> sk_x509_push(stack, ca);<br>
> <br>
> return ASN1_seq_pack_X509(stack, i2d_X509, NULL, len_out);<br>
<br>
Okay, so your just pushing two DER-format blobs one after the other.<br>
Yes, what you thought to do is fine. :)<br>
<br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Thu, 21 Jul 2016 12:31:56 +0000<br>
From: Erwann Abalea <Erwann.Abalea@docusign.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Openssl software failure for RSA 16K<br>
modulus<br>
Message-ID: <C1C086D5-5270-4595-8ED6-D6D69DF0C7E1@docusign.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
<br>
> Le 21 juil. 2016 ? 14:17, Salz, Rich <rsalz@akamai.com> a ?crit :<br>
> <br>
>> We have to make trade-offs. Who uses a 16K RSA key?<br>
> <br>
> Let me add some clarification. Is it worth putting every application that uses OpenSSL at risk for a DoS attack with a 16K RSA key?<br>
<br>
By raising the limit, you don?t suddenly put every application at risk of a DoS, because these applications won?t suddenly use a 16k RSA key.<br>
Anyway, OpenSSL 1.0.2+ now sets some limits on message sizes (defensive), some tradeoffs have to be done on those limits. According to some sources (NIST and ECRYPT II), 16k RSA provides an equivalent security level of a 512bits ECC key.<br>
<br>
------------------------------<br>
<br>
Message: 6<br>
Date: Thu, 21 Jul 2016 13:08:52 +0000<br>
From: "Salz, Rich" <rsalz@akamai.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-users] Openssl software failure for RSA 16K<br>
modulus<br>
Message-ID:<br>
<e54921bc7b864c64bda6fd688172240c@usma1ex-dag1mb1.msg.corp.akamai.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
<br>
>By raising the limit, you don?t suddenly put every application at risk of a DoS,<br>
> because these applications won?t suddenly use a 16k RSA key.<br>
<br>
Yes we do, because the other side could send a key, not local config.<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
openssl-users@openssl.org<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 20, Issue 18<br>
*********************************************<br>
</div>
</span></font></div>
</div>
</body>
</html>