openssl-users Digest, Vol 95, Issue 27

Fri Oct 21 08:39:14 UTC 2022

Hi,

- Why are you trying to build OpenSSL?
My objective is to sign an 'image.bin' with RSA2048 and verify the
signature.
I managed to build OpenSSL on linux and test the signature and verification
with RSA2048 (private & public keys).
Now, I would like to port it to vxWorks 7.

- Why did you clone the GitHub repository rather than downloading one of
the released source tarballs? Did you read the instructions on
www.openssl.org on how to download OpenSSL source releases?
git clone https://github.com/openssl/openssl.git
A: If there an l'ibOpenssl.a'  static library for vxWorks, then there would
be no reason to build the OpenSSL. Is there?
A: If there was on option to use Only the verify signature module, then I
would just compile this module and not the entire OpenSSL. Is there an
option?

- What platform do you want to build OpenSSL for?
A: vxWorks-7, the toolchain is windows exe files (gcc,ar,ld), thus the only
option I had in mind to build the OpenSSL is cygwin.

- What toolchain do you want to use, and if that's not the default
toolchain for that platform, why aren't you using the default?
A: I have vxWorks toolchain, on windows platform. (It definitely be easier
if I had the vxWorks toochain on Linux, but I don't)

- Have you read the text files in the top-level directory of the OpenSSL
source distribution?
Please direct me to the relevant README on "how to build OpenSSL on
vxWorks" (or similar platform, in which all is needed is to inject the
relevant toochain
i.e. perl Configure VxWorks)

There may well be an easier way to accomplish whatever your goal is.
OpenSSL may not even be a particularly good solution for you. You haven't
given us enough information to go on.
A: For the long run, I consider to use OpenSSL features on Linux and VxWorks

‫בתאריך יום ה׳, 20 באוק׳ 2022 ב-8:27 מאת <‪openssl-users-request at openssl.org
‬‏>:‬

> Send openssl-users mailing list submissions to
>         openssl-users at openssl.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://mta.openssl.org/mailman/listinfo/openssl-users
> or, via email, send a message with subject or body 'help' to
>         openssl-users-request at openssl.org
>
> You can reach the person managing the list at
>         openssl-users-owner at openssl.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of openssl-users digest..."
>
>
> Today's Topics:
>
>    1. RE: openssl-users Digest, Vol 95, Issue 24 (Michael Wojcik)
>    2. OpenSSL 1.1.1 Windows dependencies (David Harris)
>    3. libproviders.so file not found (Gahlot, Ashish Kumar)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 19 Oct 2022 20:30:07 +0000
> From: Michael Wojcik <Michael.Wojcik at microfocus.com>
> To: "openssl-users at openssl.org" <openssl-users at openssl.org>
> Subject: RE: openssl-users Digest, Vol 95, Issue 24
> Message-ID:
>         <
> DM6PR18MB2700C12C0C4C8A7778312669F92B9 at DM6PR18MB2700.namprd18.prod.outlook.com
> >
>
> Content-Type: text/plain; charset="utf-8"
>
> > From: openssl-users <openssl-users-bounces at openssl.org> On Behalf Of
> ???? ???
> > Sent: Tuesday, 18 October, 2022 11:58
>
> > I have downloaded perl strawberry, but I have no clue how to get rid of
> the
> > built-in perl that comes in cygwin, and point cygwin to use the
> strawberry perl.
>
> You don't have to remove the Cygwin version of perl, just change your
> PATH. This is basic both to the various shells available under Cygwin and
> to the Windows command line, so I'm getting the impression that you're not
> very familiar with your operating environment. That's not an ideal place to
> start from when trying to build, much less use, OpenSSL.
>
> I can't be more detailed because at this point I frankly don't understand
> what you're trying to do. I suggest you try asking the right question, in a
> useful manner. (See https://catb.org/esr/faqs/smart-questions for advice
> in how to ask the right question.)
>
> In particular:
>
> - Why are you trying to build OpenSSL?
> - Why did you clone the GitHub repository rather than downloading one of
> the released source tarballs? Did you read the instructions on
> www.openssl.org on how to download OpenSSL source releases?
> - What platform do you want to build OpenSSL for?
> - What toolchain do you want to use, and if that's not the default
> toolchain for that platform, why aren't you using the default?
> - Have you read the text files in the top-level directory of the OpenSSL
> source distribution?
>
> There may well be an easier way to accomplish whatever your goal is.
> OpenSSL may not even be a particularly good solution for you. You haven't
> given us enough information to go on.
>
> --
> Michael Wojcik
>
> ------------------------------
>
> Message: 2
> Date: Thu, 20 Oct 2022 13:54:19 +1300
> From: "David Harris" <openssl at pmail.gen.nz>
> To: Openssl-users at openssl.org
> Subject: OpenSSL 1.1.1 Windows dependencies
> Message-ID: <63509C3B.16160.7FF0516A at openssl.pmail.gen.nz>
> Content-Type: text/plain; charset=US-ASCII
>
> Up front, I'd like to apologize if this is an FAQ or has been answered
> elsewhere
> on this list: my workload means that I simply can't keep as up-to-date as
> I would
> like.
>
> I have a situation where my application fails to accept an incoming SSL
> handshake on Windows Server 2012, but the identical software running on
> Server 2019 accepts the same connection from the same remote client
> without
> a problem. Other types of client software (such as Thunderbird) connect to
> either system without any problems. The connecting client is a Windows
> Cash
> Register using Window's built-in crypto facilities. If I downgrade my app
> to
> OpenSSL 1.1.1g or earlier, the problem doesn't happen. With 1.1.1k or
> 1.1.1q, I
> get the error (I haven't built any versions of OpenSSL between k and q).
> In case
> it helps, the connection is an incoming SMTP connection on port 587, and
> STARTTLS is used to begin SSL negotiation.
>
> SSL_accept returns -1, with an extended error of "SSL_ERROR_SYSCALL" (5),
> which I understand to be largely what it returns when it doesn't have a
> clear idea
> of what's gone wrong. The error queue is completely empty in this
> situation. The
> cert is a LetsEncrypt cert that loads without errors and works fine with
> other
> clients.
>
> Do recent versions of OpenSSL 1.1.1 have dependencies on some Windows
> facility (winsock and wincrypt seem likely candidates) that might work on
> Server
> 2019 but fail on Server 2012?
>
> The version of my application that is in public release uses 1.1.1g, so
> isn't
> affected by this issue, but I'm slightly worried that I'm going to see an
> uptick in
> this type of problem if I release builds based on later versions of 1.1.1.
>
> Does this ring any bells with anyone? Again, apologies if this is answered
> elsewhere - I *did* spend some time in Google but couldn't find anything
> that
> seemed relevant.
>
> Thanks in advance for any advice.
>
> Cheers!
>
> -- David --
>
>
>
> ------------------------------
>
> Message: 3
> Date: Thu, 20 Oct 2022 05:26:44 +0000
> From: "Gahlot, Ashish Kumar" <Ashish-Kumar.Gahlot at rbbn.com>
> To: "openssl-users at openssl.org" <openssl-users at openssl.org>
> Subject: libproviders.so file not found
> Message-ID:
>         <
> PH0PR03MB635059BBC134956637C23831DB2A9 at PH0PR03MB6350.namprd03.prod.outlook.com
> >
>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi everyone,
>
> I'm trying to enable fips provider in openssl3 by writing the following
> lines into openssl.cnf file:
>
> openssl_conf = openssl_init
>
> .include fipsmodule.cnf
>
> [openssl_init]
> providers = provider_sect
>
> [provider_sect]
> fips = fips_sect
> base = base_sect
>
> [base_sect]
> activate = 1
>
> Now when it is enabled, there is an error in syslog that libproviders.so
> file not found:
>
> DSO support routines:dlfcn_load:could not load the shared
> library:crypto/dso/dso_dlfcn.c:118:filename(libproviders.so):
> libproviders.so: cannot open shared object file: No such file or directory
> 140666570000192:error:25070067:DSO support routines:DSO_load:could not
> load the shared library:crypto/dso/dso_lib.c:162:
> 140666570000192:error:0E07506E:configuration file
> routines:module_load_dso:error loading
> dso:crypto/conf/conf_mod.c:224:module=providers, path=providers
> 140666570000192:error:0E076071:configuration file
> routines:module_run:unknown module
> name:crypto/conf/conf_mod.c:165:module=providers
>
> And this seems to be a common issue in openssl3. I have seen solutions
> like commenting out provider_sect but I think I would need it to enable
> fips provider. Is there any working solution for this?
>
> Thank you,
> Ashish
>
> Notice: This e-mail together with any attachments may contain information
> of Ribbon Communications Inc. and its Affiliates that is confidential
> and/or proprietary for the sole use of the intended recipient. Any review,
> disclosure, reliance or distribution by others or forwarding without
> express permission is strictly prohibited. If you are not the intended
> recipient, please notify the sender immediately and then delete all copies,
> including any attachments.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://mta.openssl.org/pipermail/openssl-users/attachments/20221020/7e2aa763/attachment.htm
> >
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> openssl-users mailing list
> openssl-users at openssl.org
> https://mta.openssl.org/mailman/listinfo/openssl-users
>
>
> ------------------------------
>
> End of openssl-users Digest, Vol 95, Issue 27
> *********************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20221021/440ea5ba/attachment-0001.htm>