Displaying 20 results from an estimated 500 matches similar to: "TLS feature missing"
2018 Jul 30
2
2.3.2.1 - EC keys suppport?
>>>> I did some local testing and it seems that you are using a curve
>>>> that is not acceptable for openssl as a server key.
>>>> I tested with openssl s_server -cert ec-cert.pem -key ec-key.pem
>>>> -port 5555
>>>> using cert generated with brainpool. Everything works if I use
>>>> prime256v1 or secp521r1. This is a
2018 Jul 31
2
2.3.2.1 - EC keys suppport?
On 31.07.2018 03:32, ????? wrote:
>> Perhaps for whose interested - IETF RFC 7027 specifies for TLS use:
>>
>> [ brainpoolP256r1 | brainpoolP384r1 | brainpoolP512r1 ]
>>
>> And thus t1 would not work anyway. However, having tested r1 the result
>> was just the same.
>>
>> A tcpdump during the openssl test [ s_server | s_client ] then revealed
2019 Oct 14
0
Panic: file smtp-client-connection.c: line 1212 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded)
On 11/10/2019 10:06, Hativ via dovecot wrote:
> Hello Aki,
>
> I have this problem just with 2.3.8, my self-compiled 2.3.3 works
> fine. I have previously tried to update from 2.3.3 to higher versions
> (possibly 2.3.5 or so), but always had this error, which is why I am
> always back to 2.3.3.
>
This bug was already known. It is tracked internally as DOV-3600. Looks
like
2018 Jul 31
0
2.3.2.1 - EC keys suppport?
> Perhaps for whose interested - IETF RFC 7027 specifies for TLS use:
>
> [ brainpoolP256r1 | brainpoolP384r1 | brainpoolP512r1 ]
>
> And thus t1 would not work anyway. However, having tested r1 the result
> was just the same.
>
> A tcpdump during the openssl test [ s_server | s_client ] then revealed
> (TLSv1.2 Record Layer: Handshake Protocol: Client Hello) :
>
>
2018 Jul 31
0
2.3.2.1 - EC keys suppport?
>
>>> Perhaps for whose interested - IETF RFC 7027 specifies for TLS use:
>>>
>>> [ brainpoolP256r1 | brainpoolP384r1 | brainpoolP512r1 ]
>>>
>>> And thus t1 would not work anyway. However, having tested r1 the result
>>> was just the same.
>>>
>>> A tcpdump during the openssl test [ s_server | s_client ] then revealed
2018 Jul 31
2
2.3.2.1 - EC keys suppport?
On 31.07.2018 09:30, ????? wrote:
>>>> Perhaps for whose interested - IETF RFC 7027 specifies for TLS use:
>>>>
>>>> [ brainpoolP256r1 | brainpoolP384r1 | brainpoolP512r1 ]
>>>>
>>>> And thus t1 would not work anyway. However, having tested r1 the result
>>>> was just the same.
>>>>
>>>> A tcpdump
2019 Oct 11
2
Panic: file smtp-client-connection.c: line 1212 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded)
Hello Aki,
I have this problem just with 2.3.8, my self-compiled 2.3.3 works fine.
I have previously tried to update from 2.3.3 to higher versions
(possibly 2.3.5 or so), but always had this error, which is why I am
always back to 2.3.3.
Configuration is exactly the same.
Here my output from "doveconf -n":
# 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf# Pigeonhole version
0.5.8
2018 Dec 19
1
How to configure Dovecot to disable NIST's curves and still rertain EECDH?
My opinion is that security by RFC is not security, it's mommy medicine.
Standards have had a terrible time keeping up with security realities.
NITS's curves leak side channel information all over the place. I don't
have details on what implementations are set to calculate the NIST
curves in constant time, and that's not an easy feat to do anyway so I
don't want to depend
2018 Jul 30
2
2.3.2.1 - EC keys suppport?
<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 30 July 2018 at 21:00 ѽ҉ᶬḳ℠ <
<a href="mailto:vtol@gmx.net">vtol@gmx.net</a>> wrote:
</div>
<div>
<br>
2018 Jul 30
3
2.3.2.1 - EC keys suppport?
> On 30 July 2018 at 20:37 ????? <vtol at gmx.net> wrote:
>
>
>
> >>>>>>> facing [ no shared cipher ] error with EC private keys.
> >>>>>> the client connecting to your instance has to support ecdsa
> >>>>>>
> >>>>>>
> >>>>> It does - Thunderbird 60.0b10 (64-bit)
>
2018 Sep 14
4
X448 Key Exchange
On 09/13/2018 08:18 PM, Damien Miller wrote:
> We have any plans to add more crypto options to OpenSSH without a strong
> justification, and I don't see one for X448-SHA512 ATM.
What I like about it is that it offers ~224 bit security level, whereas
X25519 offers ~128 bits (according to RFC7748). Hence, pairing X448
with AES256 would provide a full chain of security in the ~224 bit
2019 Feb 17
3
[PATCH] use ecdh/X25519 from openssl when possible (openssl-1.1.0+)
See attached:
(1) patch against 7.9p1, tested with openssl 1.1.0j and openssl 1.1.1a on linux/i386; passes regression
test and connects to unpatched sshd without problems;
I hacked a bit regress/unittests/kex, and benchmarked
do_kex_with_key("curve25519-sha256 at libssh.org", KEY_ED25519, 256);
Before:
0.3295s per call
After:
0.2183s per call
That is, 50% speedup; assuming
2018 Jul 30
0
2.3.2.1 - EC keys suppport?
> I did some local testing and it seems that you are using a curve that is not acceptable for openssl as a server key.
>
> I tested with openssl s_server -cert ec-cert.pem -key ec-key.pem -port 5555
>
> using cert generated with brainpool. Everything works if I use prime256v1 or secp521r1. This is a limitation in OpenSSL and not something we can really do anything about.
>
>
2019 Jul 18
1
Dovecot 2.3.0 TLS
Hello,
I don't know who will read this message, but I found this thread: https://www.mail-archive.com/search?l=dovecot at dovecot.org&q=subject:%22Dovecot+2.3.0+TLS%22&o=newest
And I'm expected the same issue, I will try to explain to you (english is not my native language, sorry)
Since Buster update, so Dovecot update too, I'm not able to connect to my mail server from my
2016 Oct 19
2
SSH Weak Ciphers
On 10/19/2016 01:54 PM, m.roth at 5-cent.us wrote:
> Alice Wonder wrote:
>> On 10/19/2016 11:34 AM, Leonard den Ottolander wrote:
>>> Hello Gordon,
>>>
>> *snip*
>>>
>>> Personally I would be more concerned whether or not to enable ECDSA
>>> algorithms (https://blog.cr.yp.to/20140323-ecdsa.html).
>>>
>> For web server ECDSA
2018 Jul 30
2
2.3.2.1 - EC keys suppport?
>>>>>> facing [ no shared cipher ] error with EC private keys.
>>>>> the client connecting to your instance has to support ecdsa
>>>>>
>>>>>
>>>> It does - Thunderbird 60.0b10 (64-bit)
>>>>
>>>> [ security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384;true ]
>>>>
>>>> It seems there is
2006 Mar 31
1
oh323 - unable to install
I'm and Asterisk@home user - been so now for almost a year.
Lately, I've upgraded to the latest & greatest.. (which is built on 1.2.5)
and am unable to install oh323.
I've already asked over at the (A@H) Sourceforge forum but no one seems to
think it worth answering.
The error I get is pretty obvious but I don't know where to go from here.
More importantly, I need to have
2017 Dec 25
0
ssl_curve_list seems to be ignored with Dovecot 2.3
Hi all,
after upgrading to Dovecot 2.3, I've noticed the new "ssl_curve_list"
TLS option in 10-ssl.conf.
Setting it to "ssl_curve_list = X25519:P-256" or leaving it blank (auto)
does not change anything, Dovecot keeps on negotiating P-384: Server
Temp Key: ECDH, P-384, 384 bits
When using "-curves X25519" in s_client, it does a fallback to DH:
Server Temp Key:
2013 Feb 09
3
help on plotting series with different x-axis values on a graph with one x-axis
Hi,
I have run into this problem a couple of times now and hope you can help!
If I want to plot mulitiple series with differing x-axis values (however, all in the same range) in 1 plot with one common axis R obstruses the plots.
E.g. if I plot water content against time and I start with the sampler at 5 cm depth, it plots that one right.
But the next depth, 15 cm, is measured at slightly
2018 Sep 13
2
X448 Key Exchange
Hi all,
I'm interested in having X448 protocol available as an option, as it
gives a larger security margin over X25519. For anyone unfamiliar, it
is an Diffie-Hellman elliptic curve key exchange using Curve448 (defined
in RFC7748: https://tools.ietf.org/html/rfc7748). Furthermore, it is
included in the new TLS 1.3 specification (RFC8846:
https://tools.ietf.org/html/rfc8446).