delorie.com/archives/browse.cgi | search |
X-Recipient: | archive-cygwin AT delorie DOT com |
DomainKey-Signature: | a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id |
:list-unsubscribe:list-subscribe:list-archive:list-post | |
:list-help:sender:mime-version:references:in-reply-to:from:date | |
:message-id:subject:to:content-type:content-transfer-encoding; | |
q=dns; s=default; b=oYrseMw/4R0vp2Hf038Um86nJOWgpruPOGeoHPK33Tf | |
OOlbzA7+xiWhAp3lg5qDim36V075ZsVtzzAEsBEpHF9NkNzWo1bF0wLO0VlMOAra | |
PVwPUl/A8bnMgs3jlYfwMqQhgH/0ENdKGoVCvZu4EYAPXe107LDY2J+hot5/OBk8 | |
= | |
DKIM-Signature: | v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id |
:list-unsubscribe:list-subscribe:list-archive:list-post | |
:list-help:sender:mime-version:references:in-reply-to:from:date | |
:message-id:subject:to:content-type:content-transfer-encoding; | |
s=default; bh=46qgnBVZhM98oyqyb5MzfMuXeng=; b=uYPHRLPmd0FZJNVAV | |
ATEEtOXEqdPGJlalkJ7yiq+M3qaccd7KeNKZvLsem++lNF+qjrnR7VNDlwIRB7Hl | |
INlnJhWPXYy09Y5DE/Qxqy9utswqstNig4DT+D9D+SNNYQwakjhnul5Ea67DPqAv | |
USVI+HHkVfAxB2Vq048yXGOfJg= | |
Mailing-List: | contact cygwin-help AT cygwin DOT com; run by ezmlm |
List-Id: | <cygwin.cygwin.com> |
List-Subscribe: | <mailto:cygwin-subscribe AT cygwin DOT com> |
List-Archive: | <http://sourceware.org/ml/cygwin/> |
List-Post: | <mailto:cygwin AT cygwin DOT com> |
List-Help: | <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs> |
Sender: | cygwin-owner AT cygwin DOT com |
Mail-Followup-To: | cygwin AT cygwin DOT com |
Delivered-To: | mailing list cygwin AT cygwin DOT com |
Authentication-Results: | sourceware.org; auth=none |
X-Spam-SWARE-Status: | No, score=-0.9 required=5.0 tests=AWL,BAYES_20,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.1 spammy=steven, unsubscribe-simple, unsubscribesimple, efforts |
X-HELO: | mail-vs1-f45.google.com |
DKIM-Signature: | v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :content-transfer-encoding; bh=p1wPwNwChVM8/NGVT1MKLYVMi0WHIRWA4wkM1Ii0ZaE=; b=lz5a4yZfsLcVsEL2uxkIo/MxKsOQ4dLVbb5EcY3OmGsBu0lPZHEwvFB1qO77Rqeg3B 1cu+LJXR1zOuPgPB2M4ORfmRkK37OpOT0ydjynCziTngiC9RGrYP9pNutc7RIW0i0V2Z Y/6Y+oS0BGV+Qm3BU4nt+lQYubu4vl6fuYKo6fXtNrlItpqA37+U+ArIu43wqYohvUgD mnLVrrU7lM8Dj0OUdw9j18+aGCJ8dAjtyHbxANUKi6sOsLN0aQ+DEImP/1BtDORWj7KC 1aMe1pUN3AGJ9WYeAGkXbgRPtqivbJRcb8dqrg+OAqYsxTfUmhUv5+adgFbJkV3Lp0Ri s0Cg== |
MIME-Version: | 1.0 |
References: | <d1f44f95-0ec4-bdce-7f84-fd98a4372c84 AT SystematicSw DOT ab DOT ca> <5cf5a0f7 DOT 1c69fb81 DOT cfbf0 DOT b1e6 AT mx DOT google DOT com> |
In-Reply-To: | <5cf5a0f7.1c69fb81.cfbf0.b1e6@mx.google.com> |
From: | Benjamin Baratte <benjamin DOT baratte AT gmail DOT com> |
Date: | Tue, 4 Jun 2019 16:32:21 +0200 |
Message-ID: | <CABTpe5_kr=-zEYZ2uqYeuVO5x747faY-8YXp=NP2VQ5GNPNF_A@mail.gmail.com> |
Subject: | Re: Question regarding OpenSSL 1.1.1b package configuration against OpenSSL 1.0.2r |
To: | cygwin AT cygwin DOT com |
X-IsSubscribed: | yes |
X-MIME-Autoconverted: | from quoted-printable to 8bit by delorie.com id x54EXBwi012106 |
Hi Guys, Thanks for your feedback. I have recompile the openssl package with Cygport and this has allowed me to point out the differences between the OpenSSL mainline and the Cygwin pacakge. Actually the Cygwin package follow the spec from Fedora package where it has been decided to remove some patented algorithms. After some readings on wikipedia, the implementation of the Brainpool curves may requires patented method to be as efficient as NIST curves. (https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation) I don't know if OpenSSL use such optimization algorithm but I find out that we can use the Brainpool curves by providing the ECC parameters to OpenSSL 1.1.1b Fedora version. (https://bitnuts.de/articles/using_brainpool_ecc_in_openssl.html) Therefore the patch will remove builtin support of RFC defined Brainpool curves (and others) and keep only NIST which are optimized remove only the named curves but not the algorithms behind. I'm not legal person therefore I can't tell if this is really make any difference but I think the algorithm is still embedded in the OpenSSL package. I think that the default ECC implementation is not optimized of all curves except for NIST curves. May be this needs to be check with OpenSSL team ? Anyway, Steven you are right compiling a package like OpenSSL is not straightforward even with Cygport but still feasable with reasonnable efforts (I guess because I'm used to have unsual setup where automatic tool does not work out of the box :) ) Regarding the CVE-2016-7055 pointed by Brian, as far as I have read this is impacting only the Brainpool P 512 curve and this is not compromizing the private key and I think we could restrict the restriction to this curves only. (https://nvd.nist.gov/vuln/detail/CVE-2016-7055) Best Regards, Ben Le mar. 4 juin 2019 à 00:36, Steven Penny <svnpenn AT gmail DOT com> a écrit : > > On Mon, 3 Jun 2019 14:35:29, Brian Inglis wrote: > > You can easily rebuild the package yourself with the cygport utility, to check > > that works, then change the build config to include the Brainpool ECs, and > > rebuild the way you want it. > > Please do not presume someones technical prowess. It might be easy *to you*, but > its certainly not easy in an objective sense, and definitely not to a novice > Cygwin user. > > This is coming from someone who has built hundreds of Cygwin and Mingw64 > packages. Have some perspective. > > > -- > Problem reports: http://cygwin.com/problems.html > FAQ: http://cygwin.com/faq/ > Documentation: http://cygwin.com/docs.html > Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple > -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
webmaster | delorie software privacy |
Copyright © 2019 by DJ Delorie | Updated Jul 2019 |