opencl-devel Mailing List for Botan (Page 3)
Brought to you by:
randombit
Menu
▾
▴
opencl-devel — General discussion list for OpenCL
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
(10) |
May
(4) |
Jun
(15) |
Jul
(7) |
Aug
(14) |
Sep
(3) |
Oct
(1) |
Nov
(2) |
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
|
Feb
(5) |
Mar
(2) |
Apr
(4) |
May
(13) |
Jun
(12) |
Jul
(8) |
Aug
(1) |
Sep
|
Oct
(2) |
Nov
|
Dec
|
| 2004 |
Jan
|
Feb
(3) |
Mar
|
Apr
(20) |
May
(9) |
Jun
(8) |
Jul
(2) |
Aug
|
Sep
(4) |
Oct
(1) |
Nov
(1) |
Dec
|
|
From: Paul A. <pa...@hu...> - 2003-08-06 21:34:03
|
Hi, I am new to this and I am having some difficulties. First I made my keys: RSA_PrivateKey key(512); pub << X509::PEM_encode(key); priv << PKCS8::PEM_encode(key,passphrase2); later I read the keys back in from some files.I then attempt to encode and decrypt a message just to test it out.It really doesnt work at all and I was wonder if anyone sees a flaw in this design. X509_PublicKey * publicKey =3D X509::load_key(file); PK_Encrypting_Key * key_ok =3D dynamic_cast<PK_Encrypting_Key*>(publicKey); if(!key_ok) error(); PK_Encryptor* enc =3D get_pk_encryptor(*key_ok,"EME1(SHA-1)"); byte msg[]=3D"This is a test of the Encrytion System. This is only a test"; int len =3D strlen((char*)msg); SecureVector<byte> ciphertext =3D enc->encrypt(msg,len); X509_PublicKey * privateKey =3D X509::load_key(file2); PK_Decrypting_Key* prkey =3D dynamic_cast<PK_Decrypting_Key*>(privateKey); if(!prkey) error(); PK_Decryptor *dec =3D get_pk_decryptor(*prkey,"EME(SHA-1)"); SecureVector<byte> plainText; plainText =3D dec->decrypt(ciphertext,12); cout<<plainText<<endl; |
|
From: Jack L. <ll...@ac...> - 2003-07-24 17:00:32
|
Sorry I haven't been available the last few days, I've been busy with some
things. I'll check this out this afternoon and see what's going on. -Jack
On Mon, 21 Jul 2003 Mar...@gm... wrote:
> Hallo,
> the last certificate was the wrong, from the folling certificate can not
> read the public key with
>
> int main()
> {
> LibraryInitializer init;
>
> try {
> X509_Certificate cert("somecert.pem");
> X509_PublicKey* key = cert.subject_public_key();
> std::cout << X509::PEM_encode(*key);
> }
> catch(std::exception& e)
> {
> std::cout << e.what() << std::endl;
> }
> return 0;
> }
>
> -> Decoding error: X.509 public key decoding failed
>
> ( openssl can extract the public key )
>
>
>
> -----BEGIN CERTIFICATE-----
> MIICADCCAWkCAQEwDQYJKoZIhvcNAQECBQAwSjELMAkGA1UEBhMCREUxOzA5BgNV
> BAoTMkRhdGVudWViZXJtaXR0bHVuZyBpbSBHZXN1bmRoZWl0cy0gdW5kIFNvemlh
> bHdlc2VuMB4XDTAwMTEwNjE2MTE1MFoXDTA3MTIzMTE2MTE1MFowSjELMAkGA1UE
> BhMCREUxOzA5BgNVBAoTMkRhdGVudWViZXJtaXR0bHVuZyBpbSBHZXN1bmRoZWl0
> cy0gdW5kIFNvemlhbHdlc2VuMIGcMAoGBFUIAQECAgQAA4GNADCBiQKBgQD6eM41
> GVe7r3GkkwFFB41uDV5lQYgjjYHgDiK3Oj8nbyfCNShKoK3i4UVyPGSkWvdkn8Fw
> X2aUFY0oIVSQHxQo6HY2svYbSghKh3k57mCoQgLSKiTVTc23vjbexCPyVosIbjRe
> MRCT2n8N5fiKXwObIIT04V/Ys+4XNTLqhnbSEwIDAQABMA0GCSqGSIb3DQEBAgUA
> A4GBAKMfiEgC7CyCYoYEmS2WcKnQD2gBzkfyF6JQkN0cCEOnwomShKd91AN1cvfE
> OcVz5OSz6p7mwNtfP6lUnpR4sJR0E9/owmq5UXN9TZoVw8AVnXypLM7DLIz1ECeJ
> p4Wss4fqOpjd1aRN79thf0iD7zzV30RjRbeV1qVsVxF1oNQw
> -----END CERTIFICATE-----
>
>
|
|
From: <Mar...@gm...> - 2003-07-21 08:40:16
|
Hallo,
the last certificate was the wrong, from the folling certificate can not
read the public key with
int main()
{
LibraryInitializer init;
try {
X509_Certificate cert("somecert.pem");
X509_PublicKey* key = cert.subject_public_key();
std::cout << X509::PEM_encode(*key);
}
catch(std::exception& e)
{
std::cout << e.what() << std::endl;
}
return 0;
}
-> Decoding error: X.509 public key decoding failed
( openssl can extract the public key )
-----BEGIN CERTIFICATE-----
MIICADCCAWkCAQEwDQYJKoZIhvcNAQECBQAwSjELMAkGA1UEBhMCREUxOzA5BgNV
BAoTMkRhdGVudWViZXJtaXR0bHVuZyBpbSBHZXN1bmRoZWl0cy0gdW5kIFNvemlh
bHdlc2VuMB4XDTAwMTEwNjE2MTE1MFoXDTA3MTIzMTE2MTE1MFowSjELMAkGA1UE
BhMCREUxOzA5BgNVBAoTMkRhdGVudWViZXJtaXR0bHVuZyBpbSBHZXN1bmRoZWl0
cy0gdW5kIFNvemlhbHdlc2VuMIGcMAoGBFUIAQECAgQAA4GNADCBiQKBgQD6eM41
GVe7r3GkkwFFB41uDV5lQYgjjYHgDiK3Oj8nbyfCNShKoK3i4UVyPGSkWvdkn8Fw
X2aUFY0oIVSQHxQo6HY2svYbSghKh3k57mCoQgLSKiTVTc23vjbexCPyVosIbjRe
MRCT2n8N5fiKXwObIIT04V/Ys+4XNTLqhnbSEwIDAQABMA0GCSqGSIb3DQEBAgUA
A4GBAKMfiEgC7CyCYoYEmS2WcKnQD2gBzkfyF6JQkN0cCEOnwomShKd91AN1cvfE
OcVz5OSz6p7mwNtfP6lUnpR4sJR0E9/owmq5UXN9TZoVw8AVnXypLM7DLIz1ECeJ
p4Wss4fqOpjd1aRN79thf0iD7zzV30RjRbeV1qVsVxF1oNQw
-----END CERTIFICATE-----
--
+++ GMX - Mail, Messaging & more http://www.gmx.net +++
Jetzt ein- oder umsteigen und USB-Speicheruhr als Prämie sichern!
|
|
From: Jack L. <ll...@ac...> - 2003-07-20 20:14:17
|
On Sun, 20 Jul 2003, Marcus Meyer wrote:
> Hallo,
> I have a list of many X509Cert. The X509Cert Object can successful read
> the certificate und show me the infos (subject_dn issure_dn ...). The
> Problem is, it can not extract the public key object from the
> certificate.
That is bad.
> Botan::X509_PublicKey* key( Botan::X509::load_key("test.cert") );
> rise the exeption "X.509 public key decoding failed"
This will always fail, because the certificate has a bunch of other things
besides the public key, but load_key doesn't know that.
> the same exeption is come when I use the
> X509Certificate.subject_public_key().
This should not happen.
> I can extract the publickey with "openssl x509 -in cert -pubkey
> then i can create my X509Pubkey object.
>
> Have anybody a idea how i can do this without using openssl?
The following program reads the public key from your sample certificate
just fine (at least with 1.2.4, which is the only version I have built on
this machine). What it prints matches what I get from running
'openssl x509 -in somecert.pem -pubkey -noout'
---- CUT ----
#include <botan/x509cert.h>
using namespace Botan;
#include <iostream>
int main()
{
LibraryInitializer init;
try {
X509_Certificate cert("somecert.pem");
X509_PublicKey* key = cert.subject_public_key();
std::cout << X509::PEM_encode(*key);
}
catch(std::exception& e)
{
std::cout << e.what() << std::endl;
}
return 0;
}
---- CUT ----
-Jack
|
|
From: Marcus M. <Mar...@gm...> - 2003-07-20 19:49:34
|
Hallo,
I have a list of many X509Cert. The X509Cert Object can successful read the
certificate und show me the infos (subject_dn issure_dn ...).
The Problem is, it can not extract the public key object from the
certificate.
Botan::X509_PublicKey* key( Botan::X509::load_key("test.cert") );
rise the exeption "X.509 public key decoding failed"
the same exeption is come when I use the
X509Certificate.subject_public_key().
sample cert
-----BEGIN CERTIFICATE-----
MIID0jCCArqgAwIBAgIBADANBgkqhkiG9w0BAQQFADBUMQswCQYDVQQGEwJERTET
MBEGA1UECBMKU29tZS1TdGF0ZTELMAkGA1UEChMCTUsxIzAhBgkqhkiG9w0BCQEW
FE1hcmN1c19LdW56ZUBnbXgubmV0MB4XDTAyMDIyNDEwMDgzNloXDTA2MDIyMzEw
MDgzNlowVDELMAkGA1UEBhMCREUxEzARBgNVBAgTClNvbWUtU3RhdGUxCzAJBgNV
BAoTAk1LMSMwIQYJKoZIhvcNAQkBFhRNYXJjdXNfS3VuemVAZ214Lm5ldDCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEaN8xGk5DvQ9h67WBQ299aHOTy
4myaHzDpkKeEju0DUhdjPYw/XL46hfGWHi/YwrCnxwrjSWp4NXRqIB5PuoP0dmYb
tYMBtqSpuHYNeEvSkKrdH2VWGH0++hTHbRQ7UmpzQg5bnVbPSuCCHgV1TSBiAQsJ
n6aJr1ktgTnPT8z/4bVkZYs8FnK1uaOoBBE0iAgFL9y4uuu6ZjNdhbc1o0V+QZRq
uJrTFLbEM9Xb11X8rUAAKxkOvY1Zr5qzxIJm4pfZuA9rnATEkj2RnUqqgWTWpp//
mJfEno7xHB4zEvCpK7ryfnevagplXXN8OTabdGfboxfudUw4reZUOLq8rk8CAwEA
AaOBrjCBqzAdBgNVHQ4EFgQUrzCp9HvYf6ioC23/m72jj/+2JbswfAYDVR0jBHUw
c4AUrzCp9HvYf6ioC23/m72jj/+2JbuhWKRWMFQxCzAJBgNVBAYTAkRFMRMwEQYD
VQQIEwpTb21lLVN0YXRlMQswCQYDVQQKEwJNSzEjMCEGCSqGSIb3DQEJARYUTWFy
Y3VzX0t1bnplQGdteC5uZXSCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQF
AAOCAQEAUQFo+bm2XYiOjzFl8B9ppmddWiorZEVt4pGfgl5lPgbJ/czW5jrigQhA
WLWePmDxl2FYVW9fuMAcKJxoUZ9o59todAEx9iQsMDPSx9aEbjGmV7rPwfmUmF7B
LHArIYeJ4h6rq/qXJ4xbZ37fLdr2doKqC83Cn9Bth4Yx2IdLhGqjnfHYq/bgMCyz
4wdlmy8YZFcL0EljvPytI0PbAkS/DQiL75xNx6KUX1dYrgQ6wUR4e5c1/qkoccCS
AhZc1f0ScNgT351YEK2R1lZq+35fuGqb0kegQ71AijTGqgaFfVqAjyAOtur1SQwE
VgYlfo2rgnO0Cj4O5/oHoMYbVN/caw==
-----END CERTIFICATE-----
I can extract the publickey with "openssl x509 -in cert -pubkey
then i can create my X509Pubkey object.
Have anybody a idea how i can do this without using openssl?
|
|
From: Jack L. <ll...@ac...> - 2003-07-20 17:25:06
|
The problems is that by default OpenSSL will create keys in it's own undocumented format. That is why the decoding fails - the private key isn't PKCS #8 at all. The following sequence of commands will create a PKCS #8 private key with OpenSSL, encrypted with a passphrase of 'foo': openssl genrsa | openssl pkcs8 -topk8 -passout pass:foo > pkcs8.pem On Sat, 19 Jul 2003, Marcus Meyer wrote: > Hello, > I use Botan-1.2.6, I'll open a Private-Key-PEM file (create with openssl). > When read the file without change the folling Excepton is rise "PKCS #8: > Unkown PEM label RSA PRIVATE KEY" > then I change the start und end line to ----BEGIN|END PRIVATE KEY--- and > then i have the folling Exception > "PKCS #8 private key decoding failed" > > her ist es sample key ( is not my key ) > -----BEGIN PRIVATE KEY----- > MIICXgIBAAKBgQDRT/S9lJXfkDlpHZbyeaYsI48xB0PDYx+F4oo9NxVR+Wny0leW > QI+EV6p0Mv6Ypfqhq7U+uU4gMPTBhA62LniyfVPWoe3WWZbS7/+JYUB4zC9meHxh > jUSoNtuYm44wIqO5PMRqiz51OTzKXuWKcwfsLTVdyvL+SkqhPoTkTr1h8QIDAQAB > AoGBAJH520vkNmoGYaOnmUBeCsA5xIGC+YVoufFbvuFWay4SbguFGsSVHgJESYJk > lh7LkvHxmKO4BH565heYC9KOsmk09KNQI06cAX7PSge39z44BAFqRp4Sjs+ikYH1 > hoUFl0M+PrTWP4MSWOqOYsrJICBelZVjaONU02a1mSNm6dwBAkEA+4NMMB780fdc > u5c89zyHybeXwsen2jT1FsAAaSuqqFIuqqWDPJpTgkjQDsdms/wat0iaMDWvbuTz > ldNzEwWPkQJBANUL69eE2ytLkK6ScjLXCuyRF/gwmHH72T/ZEuukL0QwT7fTuH0S > VHMOvt4hKFnMDx+z/go1l16OwkD/LcY8PGECQQDUiXZXb8grUkINz9bYAlGo9zkK > gxdnwLqf1+5A8YKMLK58y9Lj4nHRNeCDrKMwU0jsOzD4rlUqe9UPdhjXKSrRAkAx > 0KPItQv6R6UA7MU/FgE754FPSy2aGWVnBH7kEnPq4dECDsNom0ybyqrejao9tPUk > WJXiFT3bok3RnNk7LQKBAkEAvOIyHQpz/PwNr5eK6SXxpzGll+9lpNxkdMm+S5lN > NRsMHWpCyMHjBkTphldx4jDngWrE08lDRqOVWqc72zOj9A== > -----END PRIVATE KEY----- > > can anybody help? > > > > ------------------------------------------------------- > This SF.net email is sponsored by: VM Ware > With VMware you can run multiple operating systems on a single machine. > WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the > same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 > |
|
From: Marcus M. <Mar...@gm...> - 2003-07-19 19:39:22
|
Hello, I use Botan-1.2.6, I'll open a Private-Key-PEM file (create with openssl). When read the file without change the folling Excepton is rise "PKCS #8: Unkown PEM label RSA PRIVATE KEY" then I change the start und end line to ----BEGIN|END PRIVATE KEY--- and then i have the folling Exception "PKCS #8 private key decoding failed" her ist es sample key ( is not my key ) -----BEGIN PRIVATE KEY----- MIICXgIBAAKBgQDRT/S9lJXfkDlpHZbyeaYsI48xB0PDYx+F4oo9NxVR+Wny0leW QI+EV6p0Mv6Ypfqhq7U+uU4gMPTBhA62LniyfVPWoe3WWZbS7/+JYUB4zC9meHxh jUSoNtuYm44wIqO5PMRqiz51OTzKXuWKcwfsLTVdyvL+SkqhPoTkTr1h8QIDAQAB AoGBAJH520vkNmoGYaOnmUBeCsA5xIGC+YVoufFbvuFWay4SbguFGsSVHgJESYJk lh7LkvHxmKO4BH565heYC9KOsmk09KNQI06cAX7PSge39z44BAFqRp4Sjs+ikYH1 hoUFl0M+PrTWP4MSWOqOYsrJICBelZVjaONU02a1mSNm6dwBAkEA+4NMMB780fdc u5c89zyHybeXwsen2jT1FsAAaSuqqFIuqqWDPJpTgkjQDsdms/wat0iaMDWvbuTz ldNzEwWPkQJBANUL69eE2ytLkK6ScjLXCuyRF/gwmHH72T/ZEuukL0QwT7fTuH0S VHMOvt4hKFnMDx+z/go1l16OwkD/LcY8PGECQQDUiXZXb8grUkINz9bYAlGo9zkK gxdnwLqf1+5A8YKMLK58y9Lj4nHRNeCDrKMwU0jsOzD4rlUqe9UPdhjXKSrRAkAx 0KPItQv6R6UA7MU/FgE754FPSy2aGWVnBH7kEnPq4dECDsNom0ybyqrejao9tPUk WJXiFT3bok3RnNk7LQKBAkEAvOIyHQpz/PwNr5eK6SXxpzGll+9lpNxkdMm+S5lN NRsMHWpCyMHjBkTphldx4jDngWrE08lDRqOVWqc72zOj9A== -----END PRIVATE KEY----- can anybody help? |
|
From: Jack L. <ll...@ac...> - 2003-07-03 17:04:23
|
Wow, this is strange. Your program looks fine, leaving me with three major
suspicions as to the problem:
1) I've had problems with gcc 2.96 in the past, and these days only test
Botan with the one that was included in RH 7.3 (which IIRC has some
various bug fixes included that RH 7.1's gcc will be missing). Try
installing the latest 2.96 RPM from RedHat and see if that helps.
2) There is an uncaught exception. For example, the constructor you are
calling by default expects the input file to be in PEM format, but if
it is not, then it will throw an exception. To tell it to expect raw
DER/BER encoding, pass RAW_BER as a second parameter to the
constructor. To see if the problem you're seeing is from an exception
throw, try using this:
try {
// the code from your main()
}
catch(std::exception& e)
{
std::cout << e.what() << std::endl;
}
in which case you will hopefully get a semi-useful diagnostic about
whatever is wrong.
3) There is some bug in Botan - not completely impossible. :) Could you
send me the certificate file you're using, I'll see if I can reproduce
the problem on my end.
-Jack
On Tue, 1 Jul 2003, Mauricio Castillo Silva wrote:
> Hi.
> I just download Botan 1.2.4 and start using it.
> I'm working in Linux RedHat 7.1, gcc 2.96.
> I compile the library and everything goes fine.
> I then create a simple program, that just gets a certificate from a file.
> The program returns this:
>
> Aborted (core dumped).
>
> I'm compiling the source with:
> g++ -o test test1.cpp -I../include/botan -lbotan
>
> I don't know what I'm missing... thanks for the help.
> ____________Test1.cpp___________________________
>
> #include <botan.h>
> #include <iostream>
> #include <x509cert.h>
>
> using namespace Botan;
>
> int main()
> {
> LibraryInitializer init;
> DataSource_Stream in("user1.cer");
>
> cout << "Datasource ready." << endl;
> X509_Certificate cert(in); //This is not working
> return 0;
> }
>
|
|
From: Mauricio C. S. <mca...@in...> - 2003-07-01 21:53:43
|
Hi.
I just download Botan 1.2.4 and start using it.
I'm working in Linux RedHat 7.1, gcc 2.96.
I compile the library and everything goes fine.
I then create a simple program, that just gets a certificate from a file.
The program returns this:
Aborted (core dumped).
I'm compiling the source with:
g++ -o test test1.cpp -I../include/botan -lbotan
I don't know what I'm missing... thanks for the help.
____________Test1.cpp___________________________
#include <botan.h>
#include <iostream>
#include <x509cert.h>
using namespace Botan;
int main()
{
LibraryInitializer init;
DataSource_Stream in("user1.cer");
cout << "Datasource ready." << endl;
X509_Certificate cert(in); //This is not working
return 0;
}
______________________________________
Ing. Mauricio Castillo Silva
Software Engineer
Insys, S.A. de C.V.
|
|
From: Sean R. <sra...@bl...> - 2003-06-26 18:37:02
|
On Wed, 2003-06-25 at 18:44, Jack Lloyd wrote: > On 24 Jun 2003, Sean Radford wrote: > > > Hi, > > > > Just wondering, have people on this list come across Simple Public Key > > Infrastructure, and if so what are their thoughts? > > I've looked at some docs (mostly the RFCs) a few months ago. It seems nice. > Almost certainly easier/saner to implement than X.509 (but what isn't?). > The sexps I'm not a huge fan of, it seems like they'd be a bit tricky to > process (at least in C/C++/Java - in Perl/Lisp/ML they'd probably be a > piece of cake). I totally agree about the SEXP format - there is an XML definition floating about too, though I haven't got round to finding/using it yet. > > SPKI seems to have a rather different idea about certificates than X.509 > (or even PGP). I get the impression reading RFC 2692 that the main uses > SPKI was being considered for are offline uses (that is, direct interaction > between, say, a smartcard and a reader), rather than over the network. > Offline use is apt, but its main design ethos was to mimic human interaction to negate the global naming problem, use a local trust model, and have integral authorisation. The more I've looked into it, it seems amazing it is so little known and used. > The main problem is lack of deployment, in particular since such > non-networked uses are more suited for SPKI (ie, you have to get hardware > vendor support). I have heard some rumblings that SSH and SSL are being > modified to support SPKI, though I haven't seen anything about it lately on > the IETF SSH or TLS lists. Haven't heard anything about this (SSH, TLS etc). Would be fantastic if they would. Something I may have to push sometime in the future... > > So, in summary, my opinion is that SPKI is much better suited to short-term > uses and offline uses (which are often related) than X.509. I have a > feeling this is largely X.509's own fault, though (you can do anything with > X.509 that you can do with SPKI, the problem being that if you do it in > X.509 it's not going to be portable and it will be awful to implement). > > How's your implementation work coming (if at all)? In progress. I've had to put my C++ implementation to the back of the pile at the moment :-( Having to concentrate of the J2EE Certificate Server and Web-based management console at present. Hopefully it'll all become an open source project one day in the near future - got to get that 'plausible promise'. Regards, Sean -- Dr. Sean Radford, MBBS, MSc <sra...@bl...> http://bladesys.demon.co.uk/ Blade Systems |
|
From: Jack L. <ll...@ac...> - 2003-06-26 16:18:42
|
Hi, What can I say but oops. As you may or may not know, as of Botan 1.2.5, I declared several functions in the X509:: and PKCS8:: namespaces obsolete, and by extension obsoleted the PK key constructors taking a DataSource&. However, I have since discovered that it's quite easy to implement the same functionality in the constructors without using the deprecated X509:: and PKCS8:: functions. Thus, the following functions WILL be removed in 1.2.6: X509::decode PKCS8::decode PKCS8::decrypt_key rather than in 1.3.x as was originally suggested in the docs. The only reason they were staying until 1.3.x is because (I thought) they were needed to implement the constructors. The PK key constructors taking a DataSource& will NOT be removed, and are no longer deprecated. That said, I would strongly suggest you use the X509::load_key and PKCS8::load_key functions rather than the constructors. However, at this point I would think the DataSource& PK constructors will be around until at least the post 1.4.x series. Sorry, Jack |
|
From: Jack L. <ll...@ac...> - 2003-06-25 17:44:42
|
On 24 Jun 2003, Sean Radford wrote: > Hi, > > Just wondering, have people on this list come across Simple Public Key > Infrastructure, and if so what are their thoughts? I've looked at some docs (mostly the RFCs) a few months ago. It seems nice. Almost certainly easier/saner to implement than X.509 (but what isn't?). The sexps I'm not a huge fan of, it seems like they'd be a bit tricky to process (at least in C/C++/Java - in Perl/Lisp/ML they'd probably be a piece of cake). SPKI seems to have a rather different idea about certificates than X.509 (or even PGP). I get the impression reading RFC 2692 that the main uses SPKI was being considered for are offline uses (that is, direct interaction between, say, a smartcard and a reader), rather than over the network. The main problem is lack of deployment, in particular since such non-networked uses are more suited for SPKI (ie, you have to get hardware vendor support). I have heard some rumblings that SSH and SSL are being modified to support SPKI, though I haven't seen anything about it lately on the IETF SSH or TLS lists. So, in summary, my opinion is that SPKI is much better suited to short-term uses and offline uses (which are often related) than X.509. I have a feeling this is largely X.509's own fault, though (you can do anything with X.509 that you can do with SPKI, the problem being that if you do it in X.509 it's not going to be portable and it will be awful to implement). How's your implementation work coming (if at all)? -J |
|
From: Sean R. <sra...@ae...> - 2003-06-24 21:34:14
|
Hi, Just wondering, have people on this list come across Simple Public Key Infrastructure, and if so what are their thoughts? Regards, Sean -- Dr. Sean Radford, MBBS, MSc <sra...@ae...> Aegeus Technology Ltd. blog: http://bladesys.demon.co.uk/ |
|
From: Jack L. <ll...@ac...> - 2003-06-24 20:52:16
|
On Tue, 24 Jun 2003, Roddi wrote: > Hi, > > I have some difficulties for choosing the right algorithm for the > following problem: [...] > The solution would be to let the user to key in the signature by hand > (if he/she chooses to). > > Now the question: > Is there a public-key algorithm that can sign with a signature length > of 128bit (or preferably even shorter) and that would still be secure? Not that I know of. Even DSA (which has quite small signatures) would produce sigs quite a bit larger than that (lets say, large enough that it's extremely unlikely that the average person would be able to correctly transcribe the whole thing without making an error). You could get (secure) authentication that small by using, e.g, a message authentication code. The problem then being that someone could find the key hidden in the binary, and produce a keygen. I imagine you would like to prevent this by using PK signatures. Hmmmm... actually, I can think of a way of doing this. DSA produces a signature of size 2*n, when the parameter q is n bits. Typically q is 160 bits (which is consistent with current security needs), because DSA can be broken with (roughly) 2^(n/2) effort, and 2^80 is considered the minimum amount of work required to be safe. Now, if you used a q that was only 64 bits long, this would produce a 128 bit signature, **BUT** it would not be very secure. It would not be trivial for someone to break, but it would certainly be possible, especially if they were well versed in crypto. That said, I think you may be better off forcing the user to have internet access, at least enough that they can download a license file. Another alternative would be, for people who absolutely couldn't get on the net (which I suspect is quite rare these days), would be to give them a phone number to call, where they can read off whatever serial number and machine ID info is needed (probably generated and shown on the screen for them). Then (after doing verification, etc) you mail them a floppy disk or CD-R with the license file included on it. I know music software tends to be expensive, so it may be cheaper to use stronger crypto (which is free), and hire someone to man a phone line (which is cheap), than to risk widespread pirating and losing sales (which could be very expensive). -Jack |
|
From: Roddi <sk...@ab...> - 2003-06-24 15:00:54
|
Hi, I have some difficulties for choosing the right algorithm for the following problem: We write music software and a lot of people try to pirate music software. To protect us from these people we use an authorization mechanism that works like that: 1. the user gets a serial number for registering the product (buying online or inside the box) 2. the program generates a fingerprint to identify the machine (mac address, pentium serial, etc.) 3. upon authorization the program sends the fingerprint and the serial number to the server 4. the server checks if the the serial number is valid and signs both with the private key and sends back the signature 5. the software checks the signature with the public key and refuses to run if the signature if not valid This works pretty well with people who have an internet connection. It works pretty bad for people without. At the moment we require people to key in fingerprint and serial number in a web front-end and download a signature file. This can be a major problem for people who have to use an internet-cafe and do not have a floppy disk drive (e.g. mac users). The solution would be to let the user to key in the signature by hand (if he/she chooses to). Now the question: Is there a public-key algorithm that can sign with a signature length of 128bit (or preferably even shorter) and that would still be secure? Any help appreciated with regards Ruotger Skupin --- Ruotger Skupin Developer sk...@ab... www.ableton.com |
|
From: Jack L. <ll...@ac...> - 2003-06-06 22:41:27
|
On Fri, 6 Jun 2003, Jeff B wrote:
> Hello, if you missed my posts yesterday, here's the scoop: I'm an
> experienced programmer but I'm new to encryption and the Botan library, and
> I'm currently evaluating Botan to use in a project I'm working on. I've got
> the 1.2.4 sources and I'm trying to build using Visual Studio .NET 2003 on
> Windows and CodeWarrior Pro 8.3 on MacOS X, but I'm having troubles building
> on Windows and running on Mac...
>
>
> Issue #1: Windows compile problem solved/workaround. The following in
> get_ciph.cpp, line 87
> Invalid_Combination(const std::string& mode, const std::string& pad) :
> Exception("Invalid mode/padding pair: " + mode + "/" + pad) {}
> Doesn't compile. If you comment out mode and pad and change it to
> Invalid_Combination(const std::string& mode, const std::string& pad) :
> Exception("Invalid mode/padding pair: " /*+ mode + "/" + pad*/) {}
That's a good enough workaround until I can figure out what VS's problem is
here.
> When I added #define BOTAN_EXT_ENTROPY_SRC_WIN32 to the Windows project, the
> same code got executed (and urandom and random weren't found), but the
> addition of
> bits += poll_es<Win32_EntropySource>(slow_poll);
> called the Windows-specific code (Win32_EntropySource::do_fast_poll() and
> Win32_EntropySource::do_slow_poll()) and added bits to the seed and
> everything worked (YEA!)
> OK, now, a question: Is this a known issue? From what I can tell, you need
> to either have a "urandom" or "random" file present, or a platform-specific
> #define (like BOTAN_EXT_ENTROPY_SRC_WIN32 ) in order for it to work. If
> this is in the docs, I apologies... I missed it.
I am such an idiot for not catching this right from the start. Yes, on
Windows especially, extra modules are needed for getting entropy. Typically
this is done (on Windows) by calling configure with an extra flag of
"--module-set=win32", which will enable using various Win32-specific APIs
to gather entropy (specifically, the es_capi and es_win32 modules).
It is mentioned in the docs that adding the --module-set=win32 arg is
necessary on Windows. Given the fact that *I* didn't think about it until
now, no reason to feel bad about it. ;)
I am still baffled that this is also happening on OS X, which really really
should have /dev/*random. But you can try configuring it with
"--module-set=unix", which will enable some extra entropy sources that will
(presumably!) work.
-Jack
|
|
From: Jeff B <je...@ho...> - 2003-06-06 21:51:05
|
Hello, if you missed my posts yesterday, here's the scoop: I'm an
experienced programmer but I'm new to encryption and the Botan library, and
I'm currently evaluating Botan to use in a project I'm working on. I've got
the 1.2.4 sources and I'm trying to build using Visual Studio .NET 2003 on
Windows and CodeWarrior Pro 8.3 on MacOS X, but I'm having troubles building
on Windows and running on Mac...
Issue #1: Windows compile problem solved/workaround. The following in
get_ciph.cpp, line 87
Invalid_Combination(const std::string& mode, const std::string& pad) :
Exception("Invalid mode/padding pair: " + mode + "/" + pad) {}
Doesn't compile. If you comment out mode and pad and change it to
Invalid_Combination(const std::string& mode, const std::string& pad) :
Exception("Invalid mode/padding pair: " /*+ mode + "/" + pad*/) {}
It's able to compile and run (I've built a console app using the
rsa_kgen.cpp file.
Issue #2: In my test project (build on rsa_kgen.cpp),
Botan::Init::Initialize() was throwing because total_bits (generated from
Global_RNG::seed()) was zero. When I reported the problem yesterday, I had
indicated that it was a Mac problem... Turns out it's a Windows problem as
well.
I used "perl configure.pl msvc-windows-i486" to configure Botan on Windows.
When I ran the Windows version, Botan::Init::Initialize() was throwing, just
like it was on the mac.
Botan::Global_RNG::seed(), without any of the BOTAN_EXT_ENTROPY_SRC_EGD,
BOTAN_EXT_ENTROPY_SRC_CAPI, etc... defined, is the whittled down to the
following:
u32bit seed(bool slow_poll, u32bit bits_to_get)
{
u32bit bits = 0;
bits += poll_es<File_EntropySource>(slow_poll);
if(bits >= bits_to_get) return bits;
if(bits >= bits_to_get) return bits;
return bits;
}
}
Well, poll_es<File_EntropySource>(slow_poll) tries to read "/dev/urandom"
and "/dev/random" for random source bits, but neither of these files exist
on either of my machines (Mac or Windows), so
File_EntropySource::slow_poll() isn't placing anything into the buffer,
which causes poll_es() to return zero bits, which in turn causes
initialize() to throw.
When I added #define BOTAN_EXT_ENTROPY_SRC_WIN32 to the Windows project, the
same code got executed (and urandom and random weren't found), but the
addition of
bits += poll_es<Win32_EntropySource>(slow_poll);
called the Windows-specific code (Win32_EntropySource::do_fast_poll() and
Win32_EntropySource::do_slow_poll()) and added bits to the seed and
everything worked (YEA!)
OK, now, a question: Is this a known issue? From what I can tell, you need
to either have a "urandom" or "random" file present, or a platform-specific
#define (like BOTAN_EXT_ENTROPY_SRC_WIN32 ) in order for it to work. If
this is in the docs, I apologies... I missed it.
Jeff
_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*
http://join.msn.com/?page=features/junkmail
|
|
From: Jack L. <ll...@ac...> - 2003-06-06 21:40:13
|
On Thu, 5 Jun 2003, Jeff B wrote: > If you read my previous message, you'll know that I'm trying to build Botan > 1.2.4 on Windows using VS .NET 2003. Now, I'm trying to build Botan 1.2.4 > on the Macintosh (for MacOS X) using Codewarrior 8. Here's the scoop: > > 1. I used perl configure.pl gcc-aix-ppc to set up my configuration. Does > this seem right? I know that the mac & ppc aren't supported but > http://botan.randombit.net/ states that Botan cam be built for MacOS X > (albeit using gcc). The proper string would be <something>-macosx-ppc. There is no explicit support for using Codewarrior because I don't have access to it. But OS X is supported, as are PPC machines (OS X, Linux, and *BSD). > 3. The project compiles and links. When I run the project, I pass main() > "512 ThisIsASamplePassphrase", but > LibraryInitializer init; > Fails. How so? Does an exception get thrown from somewhere? > when j=0 and we try > std::ifstream random_source(sources[j].c_str()); > Sources[0] is "/dev/urandom" and std::ifstream() is failing > > Likewise, when j=1 > Sources[0] is "/dev/random" and std::ifstream() is failing That is bizarre - OS X should have both of those files (at least every version I have ever seen does). > Any suggestions on what to do? First, make sure the files /dev/random and /dev/urandom actually exist. Open up a Terminal window, and type: ls -l /dev/*random Which should produce something along the lines of: crw-r--r-- 1 root wheel 7, 0 Jun 6 14:35 /dev/random crw-r--r-- 1 root wheel 7, 1 May 4 12:01 /dev/urandom In particular, make sure that first bit of "crw-r--r--" is the same. Then, make sure they work, by typing: hexdump -n 8 -C /dev/urandom which should produce something like: 00000000 c1 eb 1f 5d 78 19 c0 85 |...]x...| 00000008 though the specific byte values will presumably be different. If the above all checks out, then I'll need to get more information about exactly what kind of failure occurs. -Jack |
|
From: Jeff B <je...@ho...> - 2003-06-05 23:49:00
|
If you read my previous message, you'll know that I'm trying to build Botan 1.2.4 on Windows using VS .NET 2003. Now, I'm trying to build Botan 1.2.4 on the Macintosh (for MacOS X) using Codewarrior 8. Here's the scoop: 1. I used perl configure.pl gcc-aix-ppc to set up my configuration. Does this seem right? I know that the mac & ppc aren't supported but http://botan.randombit.net/ states that Botan cam be built for MacOS X (albeit using gcc). 2. I created a console project using /Botan/Doc/Examples/rsa_kgen.cpp and added the Botan source. 3. The project compiles and links. When I run the project, I pass main() "512 ThisIsASamplePassphrase", but LibraryInitializer init; Fails. Looking into it, LibraryInitializer::LibraryInitializer() calls Init::initialize(arg_string); (arg_stringis is "") Inside Init::initialize() total_bits += Global_RNG::seed(true, min_entropy - total_bits); Inside Global_RNG::seed() bits += poll_es<File_EntropySource>(slow_poll); whuch calls poll_es() in rng_seed.cpp poll_es() is template<class ES> u32bit poll_es(bool slow_poll, u32bit buf_size = 256) { ES source; SecureVector<byte> buffer(buf_size); u32bit got = 0; if(slow_poll) got = source.slow_poll(buffer, buffer.size()); else got = source.fast_poll(buffer, buffer.size()); Global_RNG::add_entropy(buffer, got); return entropy_estimate(buffer, got); } } when ES object is constructed, File_EntropySource::File_EntropySource(const std::string& sources) { std::vector<std::string> source_list = split_on(sources, ':'); std::vector<std::string> defaults = Config::get_list("rng/es_files"); for(u32bit j = 0; j != source_list.size(); j++) add_source(source_list[j]); for(u32bit j = 0; j != defaults.size(); j++) add_source(defaults[j]); } the sources var that's passed in is "", so std::vector<std::string> source_list = split_on(sources, ':'); source_list is "" and std::vector<std::string> defaults = Config::get_list("rng/es_files"); is returning "/dev/urandom:/dev/random" stepping out and getting back to poll_es(), the call if(slow_poll) got = source.slow_poll(buffer, buffer.size()); is going to u32bit File_EntropySource::slow_poll(byte output[], u32bit length) { u32bit read = 0; for(u32bit j = 0; j != sources.size(); j++) { std::ifstream random_source(sources[j].c_str()); if(!random_source) continue; random_source.read((char*)output + read, length); read += random_source.gcount(); length -= random_source.gcount(); if(length == 0) break; } return read; } when j=0 and we try std::ifstream random_source(sources[j].c_str()); Sources[0] is "/dev/urandom" and std::ifstream() is failing Likewise, when j=1 Sources[0] is "/dev/random" and std::ifstream() is failing OK, I'm curious... Under Linix, if you std::ifstream("/directory/MyFile.txt"); Does this work? Any suggestions on what to do? Thanks, Jeff _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail |
|
From: Jack L. <ll...@ac...> - 2003-06-05 22:29:40
|
On Thu, 5 Jun 2003, Jeff B wrote: > I'm trying to get the 1.2.4 build to compile with Visual Studio .NET 2003 > (ver 7) and I'm having a bit of trouble. Here's what I've done so far: > > > 1. D/l 1.2.4 source > (http://prdownloads.sourceforge.net/opencl/Botan-1.2.4.tgz) and unzipped > 2. Ran configure.pl (I believe I used "perl configure.pl msvc-windows-i486") > 3. ran VS, created a Visual C++ Win32 console application > 4. added the contents of Botan's SRC directory to the new project > 5. Went into the project's settings and > a) Turned off using precompiled headers > b) Added the Botan\include path to the "include additional directories" > setting. > 6. Rebuilt my test project Hmm, I've never tried this method before, but I imagine it might run into trouble. Here's the prefered method: Steps 1/2 OK. 3. run 'nmake' to build libbotan.lib 4. Add Botan's base directory to the library search path in VC 4a. Tell the compiler to link with libbotan.lib Step 5/6 OK. > OK, first issue: There are a _LOT_ of compile warnings. One of the > warnings, C4290, found in base.h, line 42, > void set_key(const byte[], u32bit) throw(Invalid_Key_Length); > > is about exception specification being ignored. Doing a search on C4290 in > VS, I found "Handling Exceptions, part 6" in Deep C++, which goes on to say > that VS ignores the exception specification at run time. Lovely, I thought > VS .NET 2003 was supposed to bring conformance to ANSI C++. Well, in this case it's not really a warning - it's just the compiler spouting off about how much it sucks (exception specfications are well established, the MSDN page I found about this warning is basically lying). I have always been under the impression that compilers would warn about problems in the code, not problems in the compiler. Anyway... > Is this warning a known issue or is my configure.pl settings wrong, or do I > need to set any additional parameters in the project? I can just silence > the warning, but it seems dangerous. OK, so much for the warnings. Moving > on... I would say either use a pragma to ignore this specific 'warning', or lower your warning level down to 2 so it never shows up. I don't see much of a way out of this in the general case, besides massive code modifications. I'll have config.h include a pragma disabling this warning in 1.2.5 - I honestly see no useful reason for it to exist. > 7. At the end of the build, I get 3 errors pertaining to get_ciph.cpp, line > 87, which is > > Keyed_Filter* get_cipher(const std::string& algo_spec, Cipher_Dir direction) > { > struct Invalid_Combination : public Exception > { > Invalid_Combination(const std::string& mode, const std::string& pad) : > Exception("Invalid mode/padding pair: " + mode + "/" + pad) {} > }; > > The compiler doesn't like > Exception("Invalid mode/padding pair: " + mode + "/" + pad) > > > Are these known issues? Hmmm, I hadn't heard about this second problem at all. Seems to depends on the exact version of VC7 used (THANK YOU MICROSOFT). I'll try to figure out a workaround for the next release. > Are my configure options correct? Yes, but you should build the library as a seperate entity, rather than building all the source as part of your application. -Jack |
|
From: Jeff B <je...@ho...> - 2003-06-05 19:09:48
|
I'm trying to get the 1.2.4 build to compile with Visual Studio .NET 2003 (ver 7) and I'm having a bit of trouble. Here's what I've done so far: 1. D/l 1.2.4 source (http://prdownloads.sourceforge.net/opencl/Botan-1.2.4.tgz) and unzipped 2. Ran configure.pl (I believe I used "perl configure.pl msvc-windows-i486") 3. ran VS, created a Visual C++ Win32 console application 4. added the contents of Botan's SRC directory to the new project 5. Went into the project's settings and a) Turned off using precompiled headers b) Added the Botan\include path to the "include additional directories" setting. 6. Rebuilt my test project OK, first issue: There are a _LOT_ of compile warnings. One of the warnings, C4290, found in base.h, line 42, void set_key(const byte[], u32bit) throw(Invalid_Key_Length); is about exception specification being ignored. Doing a search on C4290 in VS, I found "Handling Exceptions, part 6" in Deep C++, which goes on to say that VS ignores the exception specification at run time. Lovely, I thought VS .NET 2003 was supposed to bring conformance to ANSI C++. Is this warning a known issue or is my configure.pl settings wrong, or do I need to set any additional parameters in the project? I can just silence the warning, but it seems dangerous. OK, so much for the warnings. Moving on... 7. At the end of the build, I get 3 errors pertaining to get_ciph.cpp, line 87, which is Keyed_Filter* get_cipher(const std::string& algo_spec, Cipher_Dir direction) { struct Invalid_Combination : public Exception { Invalid_Combination(const std::string& mode, const std::string& pad) : Exception("Invalid mode/padding pair: " + mode + "/" + pad) {} }; The compiler doesn't like Exception("Invalid mode/padding pair: " + mode + "/" + pad) Are these known issues? Are my configure options correct? TIA, Jeff _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail |
|
From: Jack L. <ll...@ac...> - 2003-05-20 18:21:49
|
I just GCC 3.3, and ran into a few problems. For one, it looks like GCC 3.3 has reverted back to the 2.95.3 behavior of rejecting long long constants outright, and giving a most annoying warning even if -fpermissive -Wno-long-long is used. To work around this, pass --gcc295x to configure.pl (I'm considering renaming this option to --my-gcc-is-stupid or something). More seriously, there seems to be a strange binutils bug that affects GCC 3.3 but not any previous versions, that causes big_base.cpp to be miscompiled when -O3 -fPIC is passed to the compiler. If you're using GCC 3.3 and the check application dies with a segmentation fault, recompile build/lib/big_base.o with LIB_OPT set to -O2. The full analysis from the GCC folks is not in yet, but it seems this affects only older binutils. All in all, I would say stick with earlier versions of GCC 3.x until these problems are sorted out. -Jack |
|
From: Sean R. <sra...@bl...> - 2003-05-18 23:10:35
|
Just wanted to say well done for your continued effort on the project and I hope you get the chance to take your well earned break shortly. All much appreciated by us all, Sean On Sun, 2003-05-18 at 21:28, Jack Lloyd wrote: > Sadly, it looks like my release QA is not too great these days. A change in > 1.2.2 has rendered DSA/NR/ElGamal key generation pretty much impossible. > And, as if that wasn't enough, I've recently found that there were several > bugs in the X.509 implementation, ranging from good certificates being > refused, to using an invalid encoding of the authorityKeyIdentifier > extension (!!!). Ouch. The X.509 bugs have been around a while, I think. > > 1.2.3 will be released probably tommorow, Wednesday at the very latest. > > -Jack > > > > ------------------------------------------------------- > This SF.net email is sponsored by: If flattening out C++ or Java > code to make your application fit in a relational database is painful, > don't do it! Check out ObjectStore. Now part of Progress Software. > http://www.objectstore.net/sourceforge -- Dr. Sean Radford, MBBS, MSc <sra...@bl...> <http://bladesys.demon.co.uk/> Blade Systems |
|
From: Jack L. <ll...@ac...> - 2003-05-18 20:28:07
|
Sadly, it looks like my release QA is not too great these days. A change in 1.2.2 has rendered DSA/NR/ElGamal key generation pretty much impossible. And, as if that wasn't enough, I've recently found that there were several bugs in the X.509 implementation, ranging from good certificates being refused, to using an invalid encoding of the authorityKeyIdentifier extension (!!!). Ouch. The X.509 bugs have been around a while, I think. 1.2.3 will be released probably tommorow, Wednesday at the very latest. -Jack |
|
From: Jack L. <ll...@ac...> - 2003-05-14 16:45:28
|
GCC 2.95.x produces a lot of useless warnings when compiling Botan. You can
safely ignore these, it's just a stupid thing 2.95.x does. Also, the
message
es_egd ("EGD Entropy Source"): You might need to add -lsocket to LINK_TO in the Makefile
is not an error, just a note that on some systems the Unix socket routines
live in a separate library from the standard C library (for example,
Solaris is like this).
Doing a:
./configure.pl --module-set=unix --gcc295x gcc-linux-i586
make
should produce a real working library, just close your eyes and ignore
everything that gets printed to the screen. :)
-Jack
On Wed, 14 May 2003, Ferriol Barbena Matas wrote:
> Hi,
>
> I have a Debian Woody with the gcc 2.95.4 in a Pentium
> I configured botan with
> ./configure.pl --gcc295x gcc-linux-i586
> I can use the "--modules-set=unix" option because configure says:
> ./configure.pl --module-set=unix --gcc295x gcc-linux-i586
> es_egd ("EGD Entropy Source"): You might need to add -lsocket to LINK_TO
> in the Makefile
>
> I searched this problem in Botan web site but I can't find any reported
> similar situation.
>
> I decided to make without the "module-set" option, but the make process
> is advicing me with a lot of warnings !
>
> I made any mistake ? What's wrong ?
>
> Thanks, and sorry for my english !
>
> Bye.
>
>
>
>
> -------------------------------------------------------
> Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
> The only event dedicated to issues related to Linux enterprise solutions
> www.enterpriselinuxforum.com
>
>
|
