<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:#000099;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:#000099;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:#000099;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Right, sorry about the wrong posting – and thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The message is correct – we got this in the 1.0.2f tree and are still getting in in the 1.0.2g tree.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I notice that in crypto\x509v3\v3_purp.c there is this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> if (x->ex_flags & EXFLAG_SET)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> return;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">#ifndef OPENSSL_NO_SHA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">#endif<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We haven’t disabled SHA1 because we need it for our ssh implementation. From what I’ve been reading, the code should not be calling with EVP_sha1().<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">glen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> openssl-dev [mailto:openssl-dev-bounces@openssl.org]
<b>On Behalf Of </b>Jeremy Farrell<br>
<b>Sent:</b> Wednesday, March 23, 2016 3:48 PM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Cc:</b> openssl-dev@openssl.org<br>
<b>Subject:</b> Re: [openssl-dev] Low level API call to digest SHA1 forbidden in FIPS mode - within openssl code<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">This is a question about using the OpenSSL libraries; should be in openssl-users, copied and reply-to'd.<span style="font-size:12.0pt"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">On 23/03/2016 17:25, Glen Matthews wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">We’re receiving this assertion at the start of negotiating an SSL connection:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">c:\s\15\src\openssl\build\openssl-1.0.2f\crypto\sha\sha_locl.h(128): OpenSSL internal error, assertion failed: Low level API call to digest SHA1 forbidden in FIPS mode!<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><br>
I notice the assertion message mentions a header from what looks like a 1.0.2f tree, but the references below are all to a 1.0.2g tree. I've no idea if this is relevant to the problem, but I wonder if this is a self-consistent build of the libraries.<br>
<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">The last 2 lines of this stack trace shows that we are performing a BIO_read at this point.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">How can we work around this issue? We’re using the self-validated FIPS module and openssl 1.0.2g.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">glen<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">user32!ZwUserWaitMessage+0xa
<o:p></o:p></p>
<p class="MsoNormal"> user32!DialogBox2+0x212
<o:p></o:p></p>
<p class="MsoNormal"> user32!InternalDialogBox+0x132
<o:p></o:p></p>
<p class="MsoNormal"> user32!SoftModalMessageBox+0xee1
<o:p></o:p></p>
<p class="MsoNormal"> user32!MessageBoxWorker+0x2eb
<o:p></o:p></p>
<p class="MsoNormal"> user32!MessageBoxTimeoutW+0xba
<o:p></o:p></p>
<p class="MsoNormal"> user32!MessageBoxW+0x4e
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!OPENSSL_showfatal+0x25e [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\cryptlib.c @ 979]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!OpenSSLDie+0x22 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\cryptlib.c @ 1008]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!SHA1_Init+0x33 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\sha\sha_locl.h @ 128]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!EVP_DigestInit_ex+0x269 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\evp\digest.c @ 241]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!EVP_Digest+0x7a [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\evp\digest.c @ 359] <o:p></o:p></p>
<p class="MsoNormal"> libeay32f!ASN1_item_digest+0x6a [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\asn1\a_digest.c @ 107]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!X509_digest+0x44 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\x509\x_all.c @ 414]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!x509v3_cache_extensions+0x43 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\x509v3\v3_purp.c @ 407]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!X509_check_purpose+0x47 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\x509v3\v3_purp.c @ 134]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!X509_verify_cert+0x180 [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\x509\x509_vfy.c @ 249]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl_verify_cert_chain+0x14a [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\ssl_cert.c @ 759]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl3_get_server_certificate+0x1bb [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\s3_clnt.c @ 1255]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl3_connect+0x258 [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\s3_clnt.c @ 345]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl23_get_server_hello+0x44a [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\s23_clnt.c @ 799]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl23_connect+0x1f2 [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\s23_clnt.c @ 228]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl23_read+0x44 [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\s23_lib.c @ 134]
<o:p></o:p></p>
<p class="MsoNormal"> ssleay32f!ssl_read+0x5e [c:\s\15\src\openssl\build\openssl-1.0.2g\ssl\bio_ssl.c @ 167]
<o:p></o:p></p>
<p class="MsoNormal"> libeay32f!BIO_read+0xbf [c:\s\15\src\openssl\build\openssl-1.0.2g\crypto\bio\bio_lib.c @ 212]
<o:p></o:p></p>
<p class="MsoNormal"> hclftpx!CAsyncSslSocketLayer::OnReceive+0x1a8 [c:\s\15\src\montreal\inc\asyncsslsocketlayer.cpp @ 357]
<o:p></o:p></p>
</blockquote>
<pre>-- <o:p></o:p></pre>
<pre>J. J. Farrell<o:p></o:p></pre>
<pre>Not speaking for Oracle.<o:p></o:p></pre>
</div>
</body>
</html>