Re: PKCS11 quagmire... (JSS question)

2007-06-15 Thread Glen Beasley
David Stutzman wrote: > Robert Relyea wrote: > >>> The JSS method to create this is: >>> SignerInfo(SignerIdentifier signerIdentifier, SET signedAttributes, >>> SET unsignedAttributes, OBJECT_IDENTIFIER contentType, byte[] >>> messageDigest, SignatureAlgorithm signingAlg, PrivateKey signingKey

Re: Creating certs with multiple signatures

2007-06-15 Thread Romain Kang
On Fri, 15 Jun 2007 12:04:09 -0700, Nelson Bolyard <[EMAIL PROTECTED]> wrote: > I wrote a long response to your posting, and then noticed something > that may be a much shorter solution, so I'll ask about it first, > and if that doesn't solve the problem, I'll send the longer tome. > > You wrote:

Re: PKCS11 quagmire... (JSS question)

2007-06-15 Thread Robert Relyea
David Stutzman wrote: Robert Relyea wrote: The JSS method to create this is: SignerInfo(SignerIdentifier signerIdentifier, SET signedAttributes, SET unsignedAttributes, OBJECT_IDENTIFIER contentType, byte[] messageDigest, SignatureAlgorithm signingAlg, PrivateKey signingKey) So j

Re: nss and mozilla database

2007-06-15 Thread Nelson Bolyard
[EMAIL PROTECTED] wrote: > I've been hitting a strange error when trying to use NSS tools with > the certificates databases in Mozilla (mainly XULRunner, but I got the > same result in Firefox). Be very sure that no mozilla apps are running when you copy the cert and/or key DBs, or you will get co

Re: Creating certs with multiple signatures

2007-06-15 Thread Nelson Bolyard
Romain, I wrote a long response to your posting, and then noticed something that may be a much shorter solution, so I'll ask about it first, and if that doesn't solve the problem, I'll send the longer tome. You wrote: > Now try to create a sign jar: > - signtool -dA -kZ -p... -Zcommon.jar test.d

Re: PKCS11 quagmire... (JSS question)

2007-06-15 Thread David Stutzman
Robert Relyea wrote: >> The JSS method to create this is: >> SignerInfo(SignerIdentifier signerIdentifier, SET signedAttributes, >> SET unsignedAttributes, OBJECT_IDENTIFIER contentType, byte[] >> messageDigest, SignatureAlgorithm signingAlg, PrivateKey signingKey) >> > So just passing agentPr

Re: PKCS11 quagmire... (JSS question)

2007-06-15 Thread Robert Relyea
David Stutzman wrote: PK11PrivKey tempAgentKey = null; try { tempAgentKey = PK11PrivKey.fromPrivateKeyInfo(agentPrivateKey.getEncoded(), cm.getInternalCryptoToken()); } catch (TokenException ex) { //handle exception } This works fine. This morning I used a hardware toke

Re: Proposal for improving the security of add-on updates

2007-06-15 Thread Dave Townsend
Nelson Bolyard wrote: > > $18/year is too expensive, eh? > Heh, this is true. My attempts to find cheap SSL certificates had only yielded $100/per year jobs. Given that they are not that expensive I have started doing a straw poll of authors to see whether that would be too much or not. Dave

Re: Proposal for improving the security of add-on updates

2007-06-15 Thread Nelson Bolyard
Dave Townsend wrote: > Hi all, I am looking for some feedback on a proposal I'm working on to > improve the security of add-on updates in Mozilla products. Let me give > an overview of the problem I wish to solve and then what I have come up > with so far as a potential solution. > > In the Mozill

Re: nss and mozilla database

2007-06-15 Thread Kaspar Brand
[EMAIL PROTECTED] wrote: > When I go into into my profile directory, I am able to view it > using signtool. It gives the following output : > > Object signing certificates > --- > Common Name - Organization > Issued by: Common Name - Organization (Common Nam

Re: Signtool : signing firefox xpi

2007-06-15 Thread Kaspar Brand
Ahryman40k wrote: > But i have another problem when trying to use my component from a web page > :s > I think it is a security issue because javascript can use it when executed > from local with a security alert, but nothing works when executed from web. > At the beginning, i was thinked that sig