<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 01/02/2016 22:45, Viktor Dukhovni
wrote:<br>
</div>
<blockquote class=" cite"
id="mid_20160201214534_GB4987_mournblade_imrryr_org"
cite="mid:20160201214534.GB4987@mournblade.imrryr.org" type="cite">
<pre wrap="">On Mon, Feb 01, 2016 at 10:21:49PM +0100, Martin Vegter wrote:
</pre>
<blockquote class=" cite" id="Cite_6466873" type="cite">
<pre wrap="">I have a C program, which is using AES routines from the OpenSSL
library. I have the necessary library installed (libssl-dev
1.0.1e-2+deb7u19):
$ ls /usr/lib/x86_64-linux-gnu/libcrypto.*
/usr/lib/x86_64-linux-gnu/libcrypto.a
/usr/lib/x86_64-linux-gnu/libcrypto.so
/usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
I can compile my program statically:
gcc -s -o aes aes.c /usr/lib/x86_64-linux-gnu/libcrypto.a
but when i try to compile it dynamically, I get following error:
$ gcc -s -o aes aes.c -lcrypto
/tmp/ccofFr4N.o: In function `encrypt':
aes.c:(.text+0x9f): undefined reference to `aesni_set_encrypt_key'
aes.c:(.text+0xd9): undefined reference to `aesni_cbc_encrypt'
aes.c:(.text+0x1a0): undefined reference to `aesni_cbc_encrypt'
/tmp/ccofFr4N.o: In function `decrypt':
aes.c:(.text+0x2d4): undefined reference to `aesni_set_decrypt_key'
aes.c:(.text+0x31e): undefined reference to `aesni_cbc_encrypt'
collect2: error: ld returned 1 exit status
</pre>
</blockquote>
<pre wrap="">You're using internal function names that are not exported by the
libcrypto shared library on Debian systems. Use the EVP interface.
In future versions of OpenSSL constrained visibility of shared
library symbols will be extended to more platforms (than just Debian
where the export list was created by the Debian package maintainer).
The EVP interface is faster on many systems (supports AES-NI on
suitably capable Intel CPUs) and also safer (avoids timing
side-channels).
</pre>
</blockquote>
<tt>The OP is already invoking the AES-NI functions (those are in
fact <br>
the ones failing).</tt><tt><br>
</tt><tt><br>
</tt><tt>As for the side channel protection: Is this really
restricted to <br>
the EVP interface (which would be a security bug in 1.0.x), or is
<br>
it simply that the EVP interface does not expose certain lower <br>
level APIs that can be accidentally invoked without side channel <br>
protection options?</tt><tt><br>
</tt><br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="https://www.wisemo.com">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>