Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread Kurt Roeckx
On Fri, Nov 29, 2013 at 03:53:09PM -0800, Elio Maldonado Batiz wrote: > Firefox 27 will support TLS 1.2, see > https://bugzilla.mozilla.org/show_bug.cgi?id=861266 I know, and the only TLS 1.2 cipher will be GCM. Kurt -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lis

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread Elio Maldonado Batiz
Firefox 27 will support TLS 1.2, see https://bugzilla.mozilla.org/show_bug.cgi?id=861266 On Fri, Nov 29, 2013 at 10:32 AM, Kurt Roeckx wrote: > On Fri, Nov 29, 2013 at 01:43:11PM +0100, Kurt Roeckx wrote: > > As far as I know, NSS does not have any ciphers with SHA-2 other > > than GCM, and so

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread Kurt Roeckx
On Fri, Nov 29, 2013 at 01:43:11PM +0100, Kurt Roeckx wrote: > As far as I know, NSS does not have any ciphers with SHA-2 other > than GCM, and so I think what you want is not currently possible > with NSS. It seems that some are implemented, but at least firefox with the latest version doesn't ha

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread Kurt Roeckx
On Fri, Nov 29, 2013 at 04:07:35AM -0800, sameer...@gmail.com wrote: > Hi, > > I found some new behavior with openldap server built against Mozilla > NSS(3.15.3) and our requirement is to use only TLSv1.2 ciphers only. I have no idea what you really mean with this. Please note that ciphers can

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread sameerste
@Kurt: Thanks for the information Is there a reason why you disable GCM? I can see no good reason to disable it. It really is what you want in the first place. --It was a user requirement and hence had to be disabled. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-29 Thread sameerste
Hi, I found some new behavior with openldap server built against Mozilla NSS(3.15.3) and our requirement is to use only TLSv1.2 ciphers only. If I have following LDAP (Server+Client)configuration: Scenario 1: Openldap Server built against NSS(slap.conf) Openldap client built a

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-26 Thread sameerste
Hi, Thanks for the information. I checked the ciphers supported by openldap server and got following list(slapd.conf : TLSCipherSuite TLSv1.2): ==> openssl ciphers -v 'TLSv1.2' ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-26 Thread Julien Vehent
On 2013-11-26 13:37, Kurt Roeckx wrote: On Tue, Nov 26, 2013 at 01:14:50PM +, Sameer Stephen wrote: Hi, We have an application which uses pam_ldap.so module to connect to LDAP server. Our application( i.e. client ) uses openldap(2.4.36) which is built against mozilla NSS library(3.15.3)

Re: TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-26 Thread Kurt Roeckx
On Tue, Nov 26, 2013 at 01:14:50PM +, Sameer Stephen wrote: > Hi, > > We have an application which uses pam_ldap.so module to connect to LDAP > server. Our application( i.e. client ) uses openldap(2.4.36) which is built > against mozilla NSS library(3.15.3) and as per NSS mozilla official w

TLS 1.2 Issue with openldap 2.4.36 built on NSS 3.15.3

2013-11-26 Thread Sameer Stephen
Hi, We have an application which uses pam_ldap.so module to connect to LDAP server. Our application( i.e. client ) uses openldap(2.4.36) which is built against mozilla NSS library(3.15.3) and as per NSS mozilla official website, it supports TLSv1.2 protocol/ciphers. Our application run on RHEL