Re: CMP and SCEP problem

> Peter Gutmann wrote:
>>> error: crytSetAttribute(CRYPT_SESSINFO_ACTIVE) = -15 (what is
>>> CRYPT_ERROR_FAILED)
>>>
>>> session/scep_cli.c:168 "Couldn't create SCEP request signing attributes"
>>>    
>>
>> Hmm, it looks like you used SHA-256 here as well, SCEP had an even worse
>> problem in that it hardcoded MD5 as the only allowed algorithm.  There
>> is a
>> way to kludge in other algorithms (by sending an HTTP request
>> containing an
>> argument other than a standard SCEP request, which is supposed to
>> return a
>> text page containing information about what new algorithms are
>> supported) but
>> the last time I tried it it wasn't supported very well (there are lots
>> of old,
>> mininal SCEP implementations built into routers and the like) and lead to
>> strange failures if you use it.  In general it seems safe to assume SHA-1
>> (which is what cryptlib does), but trying to push it beyond that is
>> kind of
>> risky.
>>
>> Peter.
>>
>>  
> After the knowledge that CMP has problem with SHA256 I have tried to use
> SHA-1 also with scep but there is no difference. It's still the -15
> error with "Couldn't create SCEP request signing attributes". My scep CA
> certificate and scep source code is available here:
> http://student.fiit.stuba.sk/~michalak04/zdielane/scepca.der
> http://student.fiit.stuba.sk/~michalak04/zdielane/generate_scep.c
>
> It is not possible to try MD5 because EJBCA doesn't allow it.
>
> CMP
> ===
> Is the DER encoded object from EJBCA log or what Tomas provided enough
> for you?:
>
> MIH8MIHBAgECpCQwIjELMAkGA1UEBhMCU0sxEzARBgNVBAMUCmxhbGFAdGlua3mk
> OzA5MRMwEQYDVQQDDAptdWxob2xsYW5kMRUwEwYDVQQKDAxFSkJDQSBTYW1wbGUx
> CzAJBgNVBAYTAlNLoQ8wDQYJKoZIhvZ9B0INBQCiDAQKbGFsYUB0aW5reaQSBBCc
> 3xJ8jgerIBweDQdHl/UkpRIEELr9RaGdtggdMcq3mt4z4QCmEgQQOkmvuW/uI1mw
> AI92BLRo2bgdMBswGQQUrlaasgqkT51Gg8Oj4PYdf14KmWQCAQCgFwMVAGy5nP+4
> rPtLB+tiNndmywHlsXrd
>
> Juraj.
>
>
> _______________________________________________
> Cryptlib mailing list
> Cryptlib@... via Mail:
> cryptlib-request@...
> Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
> http://news.gmane.org/gmane.comp.encryption.cryptlib
> Posts from non-subscribed addresses are blocked to prevent spam, please
> subscribe in order to post messages.