Re: NSS and OpenSSL BIO replacement

2008-08-20 Thread Nelson B Bolyard
Ruchi Lohani wrote, On 2008-08-20 21:31: > Thanks Nelson. > And sorry about the subject of the mail. I wanted to ask about that also. > What are the equivalent APIs in NSS which probably can replace the BIO > I/O abstraction of OpenSSL ? Years have elapsed since I last looked at the BIO functions,

Re: Extracting and/or documenting Firefox's trusted root certs

2008-08-20 Thread Daniel Stenberg
On Wed, 20 Aug 2008, Wan-Teh Chang wrote: >> certutil: function failed: security library: bad database. > > 'DB' is the directory that contains your NSS databases. Thanks for that and sorry for not doing my home work properly. This turns out to generate a rather interesting list. Using my curren

Re: NSS and OpenSSL BIO replacement

2008-08-20 Thread Ruchi Lohani
Thanks Nelson. And sorry about the subject of the mail. I wanted to ask about that also. What are the equivalent APIs in NSS which probably can replace the BIO I/O abstraction of OpenSSL ? Cheers Ruchi On Wed, Aug 20, 2008 at 8:09 PM, Nelson B Bolyard <[EMAIL PROTECTED]>wrote: > Ruchi Lohani wr

Re: NSS and OpenSSL BIO replacement

2008-08-20 Thread Nelson B Bolyard
Ruchi Lohani wrote: > Can anyone point me to the documentation present for pkcs7. I'm not sure if you're asking about the standards or the NSS implementations of the standards (there are multiple of each). PKCS#7 v 1.5, also known as Cryptographic Message Syntax (CMS), is RFC 2315. It was the f

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Nelson B Bolyard
Kyle Hamilton wrote: > 2008/8/20 Robert Relyea <[EMAIL PROTECTED]>: >> Luckily, Michael also stated that most CA's rejected his requests. But it >> only takes one CA to spoil the party. > Of course, if he doesn't provide the certificate and proof that he has > the private key to it, I'm going to b

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Kyle Hamilton
2008/8/20 Robert Relyea <[EMAIL PROTECTED]>: > > Luckily, Michael also stated that most CA's rejected his requests. But it > only takes one CA to spoil the party. > It only takes one CA to spoil the party, because there's no presentation to the user of who's responsible for the muckup. Of course,

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Eddy Nigg
Nelson B Bolyard: > > I'll be convinced when I see the cert and/or see the web site's enrollment > page with that feature. There's one CA that can kiss it's place in the root > list good-bye. > Quoting from the article: "The one obtained by the researcher at Black Hat was for MSFT’s https://log

NSS and OpenSSL BIO replacement

2008-08-20 Thread Ruchi Lohani
Hi, Can anyone point me to the documentation present for pkcs7. Are there any specific examples present on its usage? Thanks ___ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Robert Relyea
Nelson B Bolyard wrote: Thorsten Becker wrote: Nelson Bolyard wrote: On the other hand, it is possible that the domain validation was performed but that it was deceived through the use of DNS attacks. In his slides on the subject of DNS attacks, Dan Kaminsky did say that it was possibl

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Nelson B Bolyard
Thorsten Becker wrote: > Nelson Bolyard wrote: >> On the other hand, it is possible that the domain validation was performed >> but that it was deceived through the use of DNS attacks. In his slides >> on the subject of DNS attacks, Dan Kaminsky did say that it was possible >> to deceive domain va

Re: Extracting and/or documenting Firefox's trusted root certs

2008-08-20 Thread Wan-Teh Chang
On Wed, Aug 20, 2008 at 1:56 PM, Daniel Stenberg <[EMAIL PROTECTED]> wrote: > >> certutil -L -h 'Builtin Object Token' -d DB > > What exactly is 'DB' in this context? My firefox 3 directory has three .db > files, and trying them all one by one makes certutil with the command line > above say: > > c

Re: Extracting and/or documenting Firefox's trusted root certs

2008-08-20 Thread Daniel Stenberg
On Tue, 19 Aug 2008, Nelson Bolyard wrote: > Here's a simple (?) shell script to do it. Great! > certutil -L -h 'Builtin Object Token' -d DB What exactly is 'DB' in this context? My firefox 3 directory has three .db files, and trying them all one by one makes certutil with the command line ab

Re: Trusted CA issuing SSL server certs with unvetted FQDNs!

2008-08-20 Thread Thorsten Becker
Nelson Bolyard wrote: > On the other hand, it is possible that the domain validation was performed > but that it was deceived through the use of DNS attacks. In his slides > on the subject of DNS attacks, Dan Kaminsky did say that it was possible > to deceive domain validation through DNS attacks.