Need help - upgrading openssl version from 3.0.12 to 3.2.x version

[Prasad, PCRaghavendra]

Ok Tomas for the clarification, it is clear now 😊


Internal Use - Confidential
-----Original Message-----
From: Tomas Mraz <tomas at openssl.org>
Sent: Wednesday, March 6, 2024 5:09 PM
To: Prasad, PCRaghavendra; Wall, Stephen; openssl-users at openssl.org
Cc: Ds, Pradeep Kumar; Chandramouli, Basavaraj - Dell Team
Subject: Re: Need help - upgrading openssl version from 3.0.12 to 3.2.x version


[EXTERNAL EMAIL]

Yes, exactly. If you use the FIPS module that is part of the 3.2.x version, it will not be FIPS compliant as that version is not FIPS validated. It is still present there and can be built with enable-fips but not validated.

You can combine the OpenSSL library (libcrypto+libssl shared or statically linked libraries) from the 3.2.x version with the FIPS module (fips.so/fips.dll) built from the validated version of the OpenSSL tarball.

Regards,

Tomas Mraz

On Tue, 2024-03-05 at 12:37 +0000, Prasad, PCRaghavendra wrote:
> Hi Tomas,
>
> If we are using OpenSSL 3.2.x and during the build, if we use the
> command enable-fips and install OpenSSL, then we can't claim for fips
> compliance.
> Is this understanding right?
>
> OpenSSL FIPS provider module 3.0 (#4282) is tested only in 3.0.8 and
> 3.0.9 and that is the reason we should pick from these OpenSSL
> versions.
> What is the OpenSSL FIPS provider module in the OpenSSL 3.2.x version?
>
> Thanks,
> Raghu
>
>
> Internal Use - Confidential
> -----Original Message-----
> From: Prasad, PCRaghavendra
> Sent: Thursday, February 29, 2024 8:23 PM
> To: Tomas Mraz; Wall, Stephen; openssl-users at openssl.org
> Subject: RE: Need help - upgrading openssl version from 3.0.12 to
> 3.2.x version
>
> Hi Tomas,
>
> If we migrate from 3.0.x to 3.2.x directly do we need to take care of
> any use cases, we are carrying OpenSSL (libcrypto and libssl) in our
> python application and use them during the encryption/decryption,
> handshake etc.
>
> So should we take care of any specific things as part of the migration
> as it is a major change from 3.0.x to 3.2.x. ( will there be any
> specific code changes or config changes we as an application need to
> consider)
>
> Thanks
>
>
> -----Original Message-----
> From: Tomas Mraz <tomas at openssl.org>
> Sent: Tuesday, February 27, 2024 1:14 PM
> To: Prasad, PCRaghavendra; Wall, Stephen; openssl-users at openssl.org
> Subject: Re: Need help - upgrading openssl version from 3.0.12 to
> 3.2.x version
>
>
> [EXTERNAL EMAIL]
>
> For FIPS compliance you definitely need to use the validated version
> of a FIPS provider. Please see the instructions here [1] on how to
> combine the latest release with a validated FIPS provider version.
>
> [1]
> https://urldefense.com/v3/__https://github.com/openssl/openssl/blob/ma
> ster/README-FIPS.md__;!!LpKI!jLMp7kblHEfwy_-l1pml2BUrIGyDrS0buy7NkQJ9A
> nH48CNuu5pkshNIHT4nJ8wBN0wuiDin47HZyuaShgEZPQ$
>  [github[.]com]
>
> Tomas Mraz, OpenSSL
>
> On Tue, 2024-02-27 at 05:55 +0000, Prasad, PCRaghavendra wrote:
> > Thanks, Tomas,
> >
> > So we can use OpenSSL 3.2.0 and enable fips during the build step
> > and get the fips.so
> >
> > OR
> >
> > we should take the OpenSSL 3.2.0 code and then take the FIPS
> > provider from the OpenSSL 3.0.8 or 3.0.9 and build, then get the
> > fips.so, fipsmodule.cnf and combine with OpenSSL 3.2.0
> >
> > Thanks,
> > Raghu
> >
> > -----Original Message-----
> > From: openssl-users <openssl-users-bounces at openssl.org> On Behalf Of
> > Tomas Mraz
> > Sent: Tuesday, February 27, 2024 9:05 AM
> > To: Wall, Stephen; openssl-users at openssl.org
> > Subject: Re: Need help - upgrading openssl version from 3.0.12 to
> > 3.2.x version
> >
> >
> > [EXTERNAL EMAIL]
> >
> > On Mon, 2024-02-26 at 22:38 +0000, Wall, Stephen wrote:
> > > > Please note that we actually test running the 3.0.8 and 3.0.9
> > > > validated versions of the FIPS provider with the 3.2 OpenSSL in
> > > > the CI and it works. We are not aware of any problems with
> > > > running the validated versions of the FIPS provider with the
> > > > current OpenSSL versions.
> > >
> > > OK, so
> > > https://urldefense.com/v3/__https://github.com/openssl/openssl/iss
> > > ues/
> > > 23400__;!!LpKI!m4FTaZF0-kz3NQm8Y9WvC4n233dgbq01QmEc_C-
> > > 2XrCWwWFFRtkaMjD
> > > i6t8tcws2hmT529ayVVlzqPunWH8qZw$ [github[.]com] doesn't actually
> > > prevent OpenSSL from working, it's just an issue with `openssl
> > > fipsinstall`.  I hadn't followed it closely enough, just briefly
> > > saw some some messages go past.
> >
> > Yeah, that issue is not really preventing the 3.0.x FIPS provider
> > working with subsequent OpenSSL releases. It's just a matter of a
> > minor FIPS compliance issue. (Depending on different views it might
> > matter for the FIPS compliance or not.)
> >
> > > Good to know.  Will the same apply to the 140-3 module and OpenSSL
> > > 3.2?
> >
> > Yes, that is and always was the intention. The FIPS provider is
> > built in a way that it can be used with any other version and the
> > same applies to third party providers.
> >
> > --
> > Tomáš Mráz, OpenSSL
> >
>
> --
> Tomáš Mráz, OpenSSL
>

--
Tomáš Mráz, OpenSSL