<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I changed my Makefile to use fipsld, but I'm still getting the same error. <div><br></div><div>Before compiling, I run this script:</div><div><span style="font-size: 12pt;">______________________________________________________________</span></div><div><span style="font-size: 12pt;">#! /bin/bash</span></div><div><div><br></div><div>################################</div><div># OpenSSL directory</div><div><br></div><div>if [ -z $OPENSSLDIR ] && [ -d /usr/local/ssl ]; then</div><div> OPENSSLDIR=/usr/local/ssl</div><div>fi</div><div><br></div><div>if [ -z "$OPENSSLDIR" ]; then</div><div> echo "Could not locate OpenSSL installation directory"</div><div>fi</div><div><br></div><div>################################</div><div># OpenSSL and fipsld</div><div><br></div><div>export FIPS_SIG=`find $OPENSSLDIR/fips-2.0 -iname incore 2>/dev/null`</div><div>export FIPSLIBDIR=`find $OPENSSLDIR/fips-2.0 -iname lib 2>/dev/null`</div><div><br></div><div>if [ -z "$FIPS_SIG" ]; then</div><div> echo "Could not locate 'incore' in $OPENSSLDIR/fips-2.0"</div><div>fi</div><div><br></div><div>if [ -z "$FIPSLIBDIR" ]; then</div><div> echo "Could not locate 'FIPS library directory' in $OPENSSLDIR/fips-2.0"</div><div>fi</div><div><br></div><div>set -x</div><div>______________________________________________________________</div><div><br></div><div>Here is my Makefile:</div><div><br></div><div>______________________________________________________________</div><div><div>CC=gcc</div><div>OPENSSLDIR=/usr/local/ssl</div><div>LIBS=$(OPENSSLDIR)/lib/libcrypto.a $(OPENSSLDIR)/lib/libssl.a -ldl</div><div>FIPSLIBDIR=$(OPENSSLDIR)/lib</div><div>INCLUDES=-I$(OPENSSLDIR)/include</div><div>CMD=fipsctl</div><div><br></div><div>OBJS=$(CMD).o</div><div><br></div><div>$(CMD): $(OBJS)</div><div> FIPSLD_CC=$(CC) $(OPENSSLDIR)/bin/fipsld -o $(CMD) $(OBJS) \</div><div> $(LIBS)</div><div><br></div><div>$(OBJS): $(CMD).c</div><div> $(CC) -c $(CMD).c $(INCLUDES)</div><div><br></div><div>clean:</div><div> rm -Rf *.o $(CMD)</div><div>______________________________________________________________</div><div><br></div></div><div>What is wrong? I only want to build the simplest application using FIPS.</div><div><br></div><br><div><hr id="stopSpelling">From: marcosbontempo@hotmail.com<br>To: openssl-users@openssl.org<br>Subject: RE: [openssl-users] FIPS_check_incore_fingerprint: fingerprint does not match<br>Date: Wed, 23 Dec 2015 08:25:41 -0200<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Thanks for the answer! I searched about the FIPS linker script but I couldn't find any content. Can you tell how can I run it?<br><br><div><hr id="ecxstopSpelling">To: openssl-users@openssl.org<br>From: jb-openssl@wisemo.com<br>Date: Wed, 23 Dec 2015 02:58:22 +0100<br>Subject: Re: [openssl-users] FIPS_check_incore_fingerprint: fingerprint does not match<br><br>
<div class="ecxmoz-cite-prefix">On 23/12/2015 01:26, Marcos Bontempo
wrote:<br>
</div>
<blockquote class="ecx cite" id="ecxmid_BLU168_W54BE1B2967B42DDACCE081CEE60_phx_gbl" cite="mid:BLU168-W54BE1B2967B42DDACCE081CEE60@phx.gbl">
<style><!--
.ExternalClass #ecxmid_BLU168_W54BE1B2967B42DDACCE081CEE60_phx_gbl .ecxhmmessage P {
padding:0px;
}
.ExternalClass #ecxmid_BLU168_W54BE1B2967B42DDACCE081CEE60_phx_gbl .ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hello,
<div><br>
</div>
<div>I'm getting this error when call the function
FIPS_mode_set(1):</div>
<div><br>
</div>
<div>error:2D06B06F:FIPS
routines:FIPS_check_incore_fingerprint:fingerprint does not
match</div>
<div><br>
</div>
<div>Does anybody know how to correct it?</div>
<div><br>
</div>
</div>
</blockquote>
<br>
<tt>You forgot to run the special "FIPS" linker script on your <br>
application, which sets the value of that fingerprint based <br>
on the load address and relocations of your application.<br>
<br>
Note, that this means that the design of the FIPS module <br>
security policy is incompatible with ASLR on almost every <br>
operating system having that feature.<br>
<br>
</tt>
<pre class="ecxmoz-signature">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="ecxmoz-txt-link-freetext" href="https://www.wisemo.com" target="_blank">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
<br>_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users</div> </div></div></div> </div></body>
</html>