Announcing a NSS release for Blocking Fraudulent Certificates

2011-03-23 Thread Kai Engert
This announcement is related to the same underlying issue as reported in http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-certificates/ While the above mentioned hotfix was made at the Mozilla client application level, we would like to provide a hotfix at the NSS level, to

Re: Hashing function in NSS

2011-03-23 Thread Robert Relyea
On 03/23/2011 02:02 PM, Honza Bambas wrote: > On 3/23/2011 9:32 PM, Crypto User wrote: >> On Mar 23, 12:05 pm, Honza Bambas wrote: >>> On 3/22/2011 10:29 PM, Crypto User wrote:> Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to pr

Re: Hashing function in NSS

2011-03-23 Thread Honza Bambas
On 3/23/2011 9:32 PM, Crypto User wrote: On Mar 23, 12:05 pm, Honza Bambas wrote: On 3/22/2011 10:29 PM, Crypto User wrote:> Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to provide this on Linux. I was trying to find the correct APIs

Re: Hashing function in NSS

2011-03-23 Thread Robert Relyea
On 03/23/2011 01:32 PM, Crypto User wrote: > On Mar 23, 12:05 pm, Honza Bambas wrote: >> On 3/22/2011 10:29 PM, Crypto User wrote:> Hi , >>> I am trying to create APIS which will provide Hashing functionality >>> to end user. I am using NSS to provide this on Linux. >>> I was trying to find the

Re: PK11_DigestBegin vs MD5_Begin()

2011-03-23 Thread Robert Relyea
On 03/22/2011 10:20 PM, Crypto User wrote: > For creating hash I found 2 sets of APIs . > There seem to be different APIs. > E.g CreateDigestContext(SECOidTag hashAlg) and PK11_DigestBegin > related APIs in > https://developer.mozilla.org/en/NSS/Cryptography_functions > or > MD5_Begin() and relate

Re: Hashing function in NSS

2011-03-23 Thread Crypto User
On Mar 23, 12:05 pm, Honza Bambas wrote: > On 3/22/2011 10:29 PM, Crypto User wrote:> Hi , > >   I am trying to create APIS which will provide Hashing functionality > > to end user. I am using NSS to provide this on Linux. > > I was trying to find the correct APIs in NSS to provide this > > functi

Re: Hashing function in NSS

2011-03-23 Thread Honza Bambas
On 3/22/2011 10:29 PM, Crypto User wrote: Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to provide this on Linux. I was trying to find the correct APIs in NSS to provide this functionality and I was confused. There seem to be different APIs

Re: CRL import error: Issuer's V2 Certificate Revocation List has an unknown critical extension.

2011-03-23 Thread Bayard Bell
To establish context on the question: are you aware of the following in RFC3280?: The X.509 v2 CRL format also allows communities to define private extensions to carry information unique to those communities. Each extension in a CRL may be designated as critical or non-critical. A CRL validat

Re[9]: S/MIME Encryption Certificate without email address

2011-03-23 Thread Konstantin Andreev
On 22.03.11 12:23, Sergei Evdokimov wrote: I think, being able to support encryption or having an option that enables or disables verification of email addresses in certificates would make sense. Here is a hint for you. At the lowest level, NSS doesn't track [email]->[certificate] relations,

Re[8]: S/MIME Encryption Certificate without email address

2011-03-23 Thread Konstantin Andreev
On 22.03.11 21:00, Robert Relyea wrote: On 03/22/2011 02:23 AM, silent...@gmail.com wrote: <...> the requirement is to allow having more than one <...> email provider AFTER the card was issued. <...> Unless there is an authoritative way to bind the cert to a given email address, there is no w

Darwin universal builds and related Makefile miscellania

2011-03-23 Thread Bayard Bell
NSS community/maintainer types, I've been doing some hacking to sort out remaining issues with getting 32-bit build support on OS X 10.6, allowing for universal builds, and I wanted to make sure I was headed in the right direction, such that what I'm doing might be acceptable as patches. I've b

PK11_DigestBegin vs MD5_Begin()

2011-03-23 Thread Crypto User
For creating hash I found 2 sets of APIs . There seem to be different APIs. E.g CreateDigestContext(SECOidTag hashAlg) and PK11_DigestBegin related APIs in https://developer.mozilla.org/en/NSS/Cryptography_functions or MD5_Begin() and related hash API from ("hash"_Begin etc) http://mxr.mozilla.org

Hashing function in NSS

2011-03-23 Thread Crypto User
Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to provide this on Linux. I was trying to find the correct APIs in NSS to provide this functionality and I was confused. There seem to be different APIs. E.g CreateDigestContext(SECOidTag hashAlg)

Re: Importing GPG public and private keys in NSS

2011-03-23 Thread Robert Relyea
On 03/23/2011 06:24 AM, Superpacko wrote: > Well, so i 've been told that i shuld be able to extract the MPI as > bytes and pass it to NSS since GPG original key format is PEM, i > should be able to use MPIs data as raw bytes. If it's really PEM (which should be a printable string), then you should

CRL import error: Issuer's V2 Certificate Revocation List has an unknown critical extension.

2011-03-23 Thread Mangesh Divekar (Sunbridge)
Hello, We are using JSS in our application. We are working with CRL to do verification of certificates. the below mention code : CryptoManager.initialize("e:\\jss"); CryptoManager cm = CryptoManager.getInstance();

Re: Importing GPG public and private keys in NSS

2011-03-23 Thread Superpacko
On 21 mar, 17:42, Superpacko wrote: > On 18 mar, 17:20, Robert Relyea wrote: > > > > > > > > > > > On 03/18/2011 08:06 AM, Superpacko wrote: > > > > On 17 mar, 18:35, Robert Relyea wrote: > > >> On 03/17/2011 11:33 AM, Superpacko wrote: > > > >>> On 17 mar, 15:20, Robert Relyea wrote: > >

Re: S/MIME Encryption Certificate without email address

2011-03-23 Thread silent...@gmail.com
On Mar 22, 11:34 pm, Robert Relyea wrote: > On 03/22/2011 03:09 PM, silent...@gmail.com wrote: > > > > > > > > > Thank you for the reply! > > > On Mar 22, 7:00 pm, Robert Relyea wrote: > >> Unless there is an authoritative way to bind the cert to a given email > >> address, there is no way to use