Re: Updates prior to the release of cryptlib 3.3.4/3.4.0

>>- CertHash
>
> Where is this defined?  I can't find it in RFC 2560.
>
For the long-term validation it is strongly recommended to use 
expiredCertsOnCRL, ArchiveCutoff and OCSP positive statement as is defined 
in Common PKI Part 4: Operational Protocols and Common PKI Part 9: 
SigG-Profile as Common PKI Private OCSP - Extensions CertHash (Positive 
Statement). Such positive statement not only guarantees the status of 
certificate which can be also expired but also if such OCSP response is 
generated after few years after expiration of the verified certificate, the 
positive statement certHash contains the hash value computed with the 
actually secure hash algorithm, what means the content of the certificate is 
also protected if algorithms used in the certificate become weak.

Common PKI specification: "COMMON PKI SPECIFICATIONS FOR INTEROPERABLE 
APPLICATIONS FROM T7 & TELETRUST - SPECIFICATION PART 4:OPERATIONAL 
PROTOCOLS, http://www.common-pki.org/uploads/media/Common-PKI_v2.0.pdf".


> '216' isn't a cryptlib error code, they're all small negative integers.
That is windows Runtime error 216 at 00403876  :o( if CL32.dll compiled with 
e.g. USE_CERTLEVEL_PKIX_FULL is used.

also
#if 1
  #define USE_CERT_OBSCURE
  #define USE_CMS_OBSCURE
  #define USE_CERT_OBSOLETE
#endif /* 0 */

\cl32\cert\chk_use.c(272) : error C2065: 'KEYUSAGE_SIGN_GENERIC' : 
undeclared identifier

Peter 


_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.