Re: Automatic announcements for Mozilla's NSS/NSPR upgrades

2012-02-27 Thread Honza Bambas
Kai, is there some way to just see the current state for each branch? If not, do you plan to build one? -hb- On 2/26/2012 5:01 PM, Kai Engert wrote: I would like to make you aware of a new public mailing list, it can be helpful it you want to track which NSPR/NSS versions are used by Mozilla

Re: Regarding ssl handshake

2012-02-22 Thread Honza Bambas
On 2/20/2012 2:52 PM, maddy wrote: Hi, first: ssl thread has been removed recently (bug 674147). That change is currently in Firefox Beta (11), so you should update and test your extension/code with Firefox Beta code base. second: we do not support blocking sockets being accessed on the soc

Re: SSL_ConfigSecureServer and on the fly cert generation

2011-12-07 Thread Honza Bambas
On 12/7/2011 4:01 PM, passfree wrote: Is it possible to start NSS_Init without creating dbs? I guess what I am asking if I can have all of this in memory rather than on disc. I need to create a self-contained executable. If you are sure what you are doing, then NSS_NoDB_Init can be what you ne

Re: NSS or PSM access from addon

2011-11-30 Thread Honza Bambas
Hi Filipe, sorry for delay. You may want to use nsICMS* interfaces and around (implemented as e.g. "@mozilla.org/nsCMSMessage;1", "@mozilla.org/nsCMSEncoder;1", etc) to create Cryptographic Message Syntax blobs. It is not a simple way to encrypt binary data, since you also have to manage cert

Re: Recent builds of NSS on Windows?

2011-10-14 Thread Honza Bambas
On 10/13/2011 10:23 PM, Walter Goulet wrote: Hi, I'm wondering if anyone has recently built a version of NSS on Windows per the instructions on the NSS build pages (http://www.mozilla.org/ projects/security/pki/nss/nss-3.7.7/nss-3.7.7-build.html)? I've run into problems building NSS using both M

Re: does anyone try to use AES_CBC ???

2011-07-22 Thread Honza Bambas
On 7/22/2011 8:06 PM, Matej Kurpel wrote: On 22. 7. 2011 18:36, Brian Smith wrote: - Original Message - From: "Matej Kurpel" On 22 juil, 14:41, helpcrypto helpcrypto wrote: at this time, i had just to make some test about the AES_CBC or AES_ECB like time to encrypt, time to decrypt,how

Re: Mixed HTTPS/non-HTTPS content in IE9 and Chrome 13 dev

2011-05-29 Thread Honza Bambas
On 5/18/2011 1:07 AM, Brian Smith wrote: See https://twitter.com/#!/scarybeasts/status/69138114794360832: "Chrome 13 dev channel now blocks certain types of mixed content by default (script, CSS, plug-ins). Let me know of any significant breakages." See https://ie.microsoft.com/testdrive/brows

Re: keygen & CRMF on Firefox for mobile

2011-05-12 Thread Honza Bambas
On 5/9/2011 10:52 PM, Michael Helm wrote: This flavor of firefox 4 Useragent string: Mozilla/5.0 (Android; Linux armv7l; rv:2.1.1) Gecko/ Firefox/4.0.2pre Fennec/4.0.1 (which can be installed on Android phones& tablets) seems to lack a functioning keygen magic tag, or the crypto object. The brow

Re: Certificate Problem in FF 4

2011-04-08 Thread Honza Bambas
I'm getting the no issuer chain error even when I first visit the https://crm.ausnetservers.net.au link with an empty (clean) profile - so there is certainly no cert exception nor any additional certificates. I don't think this is a Firefox bug. If you feel opposite please provide more info h

Re: Hashing function in NSS

2011-03-23 Thread Honza Bambas
On 3/23/2011 9:32 PM, Crypto User wrote: On Mar 23, 12:05 pm, Honza Bambas wrote: On 3/22/2011 10:29 PM, Crypto User wrote:> Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to provide this on Linux. I was trying to find the correct A

Re: Hashing function in NSS

2011-03-23 Thread Honza Bambas
On 3/22/2011 10:29 PM, Crypto User wrote: Hi , I am trying to create APIS which will provide Hashing functionality to end user. I am using NSS to provide this on Linux. I was trying to find the correct APIs in NSS to provide this functionality and I was confused. There seem to be different APIs

Re: Root certificate authorities

2011-03-13 Thread Honza Bambas
On 3/5/2011 9:22 PM, Nelson B Bolyard wrote: There's an unfinished set of code in Mozilla's CVS repository that implements a PKCS#11 module on top of MS CAPI, enabling access to certs and keys in Windows' cert and key stores. Read about it in http://mxr.mozilla.org/security/source/security/nss/l

Re: Setting the hostname to verify the cert against

2011-01-25 Thread Honza Bambas
Ben, proxy info (the last argument) could make a trick for you. Fill proxy info with host:port of the server (as it actually stands as a proxy between the two clients). Let host name passed to createTransport() be the name of the client. This will make the underlying TCP socket connect to th

Re: NSS 3.12.5: Error '-8023' ... how to track it down?

2011-01-11 Thread Honza Bambas
On 1/11/2011 5:36 PM, Bernhard Thalmayr wrote: Hi experts, I have apache httpd running with a shared lib using NSS/NSPR. The lib talks to an SSL enabled server using PR_WRITE. Occasionally PR_WRITE returns error '-8023'. OS is CentOS 5.5 64bit. NSS: @(#)NSS 3.12.5.0 Aug 3 2010 17:15:02 NSP

Re: Determining EV status of a cert - how is it done?

2010-12-13 Thread Honza Bambas
On 12/13/2010 2:35 PM, ra...@ri wrote: Good day, I was wondering how the EV status of a certificate is determined in FF/ nss. I know that the certificate itself must have a certain OID. I assume the OIDs inidicating EV status are stored somewhere in the source code. Could someone provide me with

Re: NSS and nonblocking sockets

2010-11-29 Thread Honza Bambas
On 11/25/2010 5:54 PM, passfree wrote: Hi list, I am developing a XPCOM component to wrap input/output stream pairs into ssl for server or client communication. I am not familiar with NSS and I don't know how to write proper xpcom components in C but I have a working implementation. I have one

Re: NSS and CKA_ALWAYS_AUTHENTICATE

2010-08-16 Thread Honza Bambas
On 8/16/2010 8:51 PM, Matej Kurpel wrote: Hello, I need to force authentication on the device everytime a sign operation is requested from my PKCS#11 library. From the specification, I understood that there is a flag CKA_ALWAYS_AUTHENTICATE of the private key which should be set to TRUE. How

Re: Classification of client certificates by NSS / Mozilla Firefox

2010-05-04 Thread Honza Bambas
On 5/4/2010 3:41 PM, M.Hunstock wrote: 1. What is the criteria of NSS for distinguishing between "own" and "others" certificates? This function [1] used from [2] should return true for your certificate. If there is a private key, then you should see it in the user tab. However, the code f

Re: Support for CKA_ALWAYS_AUTHENTICATE

2010-02-05 Thread Honza Bambas
Robert Relyea wrote: On 02/01/2010 02:09 AM, Helge Bragstad wrote: Hi, My understanding from previous postings on this list is that the CKA_ALWAYS_AUTHENTICATE + CKU_CONTEXT_SPECIFIC features of PKCS #11 are not supported in NSS. Is this likely to be implemented in the near future? Actually

Re: How to "log out" of SDR?

2009-10-14 Thread Honza Bambas
Nelson B Bolyard wrote: On 2009-10-14 01:33 PDT, Neil wrote: Nelson Bolyard wrote: I'll add these thoughts. I don't know of any way to "log in" to a token that has no password. IINM, such a token just "comes up" in a state that is similar to being already logged in. It's not surpris

Re: How to "log out" of SDR?

2009-10-14 Thread Honza Bambas
Neil wrote: Nelson Bolyard wrote: I'll add these thoughts. I don't know of any way to "log in" to a token that has no password. IINM, such a token just "comes up" in a state that is similar to being already logged in. It's not surprising to me that forcefully logging it out leaves it in a