Fwd: TLS/SSH bugs

Hello,

we're not a direct cryptlib user but we have to deal with APC devices
(which use cryptlib).
We've a lot of trouble with the devices and we believe that most of
them can be traced back to cryptlib.

I'll start with a issue in the SSH server implementation  where we
already looked at the cryptlib code and are pretty sure that it''s not
behaving correctly.
SSH clients (e.g. OpenSSH >= v6.7) sending DH GEX requests with a key
size of > 4096 bit won't be able to connect to the server. See
http://forums.apc.com/message/65463#65463 for details.

There seems to be a problem with TLS ClientHello extension handling
(breaking compatibility with Chrome and Firefox without SSLv3
support):
http://forums.apc.com/message/65421#65421

Besides that there's an issue with spaces in the common name (I assume
that's a problem caused by the APC engineers) and certificates using
UTF8String data types (That might be a general problem). See
http://forums.apc.com/message/65428#65428

Besides that I'm wondering if the SSL/TLS server implementation
supports sending multiple certificates during the handshake (to
support intermediate CAs). I briefly looked at the SSL/TLS server
Session part of the manual and it only talks about a single
certificate.

Best Regards,
Freddy

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.