Internet Security Components - COM, ActiveX and .NET

Open SSL 1.1.1 - WeOnlyDo Discussion board

Linear

Is there some kind of a deadline when WeOnlyDo ActiveX components start supporting OpenSSL 1.1.1
(interested in SFTP, SSH components)?

locked

3681 views

Hi.

I'm not really sure why you need OpenSSL 1.1.1 for SSH/SFTP, since those protocols have nothing to do with SSL, so TLS1.3 which is major feature of 1.1.1 doesn't apply to SSH protocol. Can you please elaborate why you need OpenSSL 1.1.1?

As for when it will be supported - as soon as FIPS is available as 'drop in' DLL, as it is now with 1.0.2.

Hope this helps!
Jasmine

locked

3650 views

Thank you for your quick response.

Our concern originates from the known list of vulnerabilities in OpenSSL 1.0.x. Numerous customers of our company prefer to consume products based on OpenSSL 1.1.1 even before FIPS support is provided. Though the best solution is still both OpenSSL 1.1.1 and FIPS in one bucket.
As far as we access OpenSSL functionalities mainly through WeOnlyDo libraries that's the reason why I raise the issue.

Thank you

locked

3641 views

Mykola,

hi. Can you point to the list of vulnerability that concern crypto algorithms that are used, not the SSL/TLS layer itself which we don't use? If it's something to be fixed ASAP we'll be happy to know about it.

We'lre also for 1.1.1 (in other products mainly) but FIPS is more important at this time.

Jasmine

locked

3708 views

The first one I have handy:
https://nvd.nist.gov/vuln/detail/CVE-2019-1552

locked

3688 views

Hi.

But, that is for TLS protocol. We don't implement or use SSL/TLS in SSH protocol. We use only OpenSSL's crypto libraries. This doesn't apply in any way to SSH protocol.

Jasmine

locked

3639 views

Thank you for the great customer service ... I am really impressed with the wodSSH ActiveX control.

Andrew Ross

Kiwi Enterprises

...wodFtpDlx was exactly what I needed, it worked, and it was priced right...

David Keenan

Serengeti Systems Incorporated

May I say how nice it is to work with components so complete and self-explanatory that using them in my application is as instinctive as though I wrote them myself?

Michael Barnett

Full Spectrum Telecommunications