<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Running fails specifically on the line:<br>
</p>
<p><br>
</p>
<pre style="margin-top: 0px; margin-bottom: 1em; padding: 5px; border: 0px; font-size: 13px; width: auto; max-height: 600px; overflow: auto; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; background-color: rgb(239, 240, 241); word-wrap: normal; color: rgb(36, 39, 41);"><code style="margin: 0px; padding: 0px; border: 0px; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; white-space: inherit;">if(1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) handleErrors();</code><br></pre>
<pre style="margin-top: 0px; margin-bottom: 1em; padding: 5px; border: 0px; font-size: 13px; width: auto; max-height: 600px; overflow: auto; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; background-color: rgb(239, 240, 241); word-wrap: normal; color: rgb(36, 39, 41);"><code style="margin: 0px; padding: 0px; border: 0px; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; white-space: inherit;"><br></code></pre>
<p>Although I've added some additional debugging code at this point, including this function:<br>
</p>
<p><br>
</p>
<div></div>
<div>
<pre style="margin-top: 0px; margin-bottom: 1em; padding: 5px; border: 0px; font-size: 13px; width: auto; max-height: 600px; overflow: auto; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; background-color: rgb(239, 240, 241); word-wrap: normal; color: rgb(36, 39, 41);"><div>int Check_Enable_FIPS(void)</div><div>{</div><div> int mode = FIPS_mode();</div><div> int ret = 0;</div><div> unsigned long err = 0;</div><div><br></div><div> if(mode == 0)</div><div> {</div><div> ret = FIPS_mode_set(1 /* on */);</div><div> printf("Attempting to set FIPS mode to 1...\n");</div><div> err = ERR_peek_last_error();</div><div> printf("Last error was: %lx\n", err);</div><div> if(ret != 1)</div><div> {</div><div> err = ERR_get_error();</div><div> }</div><div> } else {</div><div> ret = FIPS_mode_set(0 /* off */);</div><div> if(ret != 1)</div><div> {</div><div> err = ERR_get_error();</div><div> }</div><div> }</div><div><br></div><div> if(ret != 1)</div><div> {</div><div> printf("FIPS_mode_set failed: %lx\n", err);</div><div> }</div><div><br></div><div><br></div><div> printf("FIPS mode is: %d\n", FIPS_mode());</div><div>}<br></div></pre>
<br>
Which returns<br>
</div>
<p><br>
</p>
<div style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);">
Attempting to set FIPS mode to 1...</div>
<div style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);">
Last error was: 2d06b06f</div>
<div style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);">
FIPS_mode_set failed: 2d06b06f</div>
<div style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);">
FIPS mode is: 0<br>
</div>
<div><br>
</div>
<p>So it would appear that my FIPS mode is never even being set, and walking through the code would seem to confirm this. In addition, the error code doesn't seem to be present in the FIPS documentation, but errstr informs me that it is<br>
</p>
<p><br>
</p>
<p><span style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);">error:2D06B06F:FIPS
routines:DSA_BUILTIN_PARAMGEN2:fingerprint does not match nonpic relocated</span><span style="color: rgb(36, 39, 41); font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; font-size: 13px; white-space: pre; background-color: rgb(239, 240, 241);"></span><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div>Any tips on where to go from here?</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
Matt Heimlich </div>
</div>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Ethan Rahn <ethan.rahn@gmail.com><br>
<b>Sent:</b> Friday, October 7, 2016 4:01 PM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> Re: [openssl-users] Building an application with OpenSSL and FIPS support.</font>
<div> </div>
</div>
<div>
<div dir="ltr">Matt,
<div><br>
</div>
<div>What part of the selftest fails? Can you step through it with a debugger?</div>
<div><br>
</div>
<div>Cheers,</div>
<div><br>
</div>
<div>Ethan</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Oct 7, 2016 at 10:56 AM, Matthew Heimlich <span dir="ltr">
<<a href="mailto:MHeimlich@steelcloud.com" target="_blank">MHeimlich@steelcloud.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr" style="font-size:12pt; color:#000000; background-color:#ffffff; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-right:0px; margin-bottom:1em; margin-left:0px; background-color:rgb(255,255,255); padding:0px; border:0px; font-size:15px; clear:both; color:rgb(36,39,41); font-family:Arial,"Helvetica Neue",Helvetica,sans-serif">
I'm on RHEL7. I've got a very simple encryption/decryption program that works fine without FIPS support enabled, but fails when it is:</p>
<pre style="margin-top:0px; margin-bottom:1em; padding:5px; border:0px; font-size:13px; width:auto; max-height:600px; overflow:auto; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; background-color:rgb(239,240,241); word-wrap:normal; color:rgb(36,39,41)"><code style="margin:0px; padding:0px; border:0px; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; white-space:inherit">#include <openssl/conf.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <string.h>
void handleErrors(void)
{
ERR_print_errors_fp(stderr);
abort();
}
int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *key,
unsigned char *iv, unsigned char *ciphertext)
{
EVP_CIPHER_CTX *ctx;
int len;
int ciphertext_len;
/* Create and initialise the context */
if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();
/* Initialise the encryption operation. IMPORTANT - ensure you use a key
* and IV size appropriate for your cipher
* In this example we are using 256 bit AES (i.e. a 256 bit key). The
* IV size for *most* modes is the same as the block size. For AES this
* is 128 bits */
if(1 != EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv))
handleErrors();
/* Provide the message to be encrypted, and obtain the encrypted output.
* EVP_EncryptUpdate can be called multiple times if necessary
*/
if(1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
handleErrors();
ciphertext_len = len;
/* Finalise the encryption. Further ciphertext bytes may be written at
* this stage.
*/
if(1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) handleErrors();
ciphertext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int decrypt(unsigned char *ciphertext, int ciphertext_len, unsigned char *key,
unsigned char *iv, unsigned char *plaintext)
{
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
/* Create and initialise the context */
if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();
/* Initialise the decryption operation. IMPORTANT - ensure you use a key
* and IV size appropriate for your cipher
* In this example we are using 256 bit AES (i.e. a 256 bit key). The
* IV size for *most* modes is the same as the block size. For AES this
* is 128 bits */
if(1 != EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv))
handleErrors();
/* Provide the message to be decrypted, and obtain the plaintext output.
* EVP_DecryptUpdate can be called multiple times if necessary
*/
if(1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
handleErrors();
plaintext_len = len;
/* Finalise the decryption. Further plaintext bytes may be written at
* this stage.
*/
if(1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len)) handleErrors();
plaintext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return plaintext_len;
}
int main (void)
{
/* Force FIPS initialization */
FIPS_mode_set(1);
/* Set up the key and iv. Do I need to say to not hard code these in a
* real application? :-)
*/
/* A 256 bit key */
unsigned char *key = (unsigned char *)"<wbr>012345678901234567890123456789<wbr>01";
/* A 128 bit IV */
unsigned char *iv = (unsigned char *)"01234567890123456";
/* Message to be encrypted */
unsigned char *plaintext =
(unsigned char *)"The quick brown fox jumps over the lazy dog";
/* Buffer for ciphertext. Ensure the buffer is long enough for the
* ciphertext which may be longer than the plaintext, dependant on the
* algorithm and mode
*/
unsigned char ciphertext[128];
/* Buffer for the decrypted text */
unsigned char decryptedtext[128];
int decryptedtext_len, ciphertext_len;
/* Initialise the library */
ERR_load_crypto_strings();
OpenSSL_add_all_algorithms();
OPENSSL_config(NULL);
/* Encrypt the plaintext */
ciphertext_len = encrypt (plaintext, strlen ((char *)plaintext), key, iv,
ciphertext);
/* Do something useful with the ciphertext here */
printf("Ciphertext is:\n");
BIO_dump_fp (stdout, (const char *)ciphertext, ciphertext_len);
/* Decrypt the ciphertext */
decryptedtext_len = decrypt(ciphertext, ciphertext_len, key, iv,
decryptedtext);
/* Add a NULL terminator. We are expecting printable text */
decryptedtext[decryptedtext_<wbr>len] = '\0';
/* Show the decrypted text */
printf("Decrypted text is:\n");
printf("%s\n", decryptedtext);
/* Clean up */
EVP_cleanup();
ERR_free_strings();
return 0;
}
</code></pre>
<p style="margin-right:0px; margin-bottom:1em; margin-left:0px; background-color:rgb(255,255,255); padding:0px; border:0px; font-size:15px; clear:both; color:rgb(36,39,41); font-family:Arial,"Helvetica Neue",Helvetica,sans-serif">
As you can see, just the demo code with FIPS enabled. Without FIPS, my output is:</p>
<pre style="margin-top:0px; margin-bottom:1em; padding:5px; border:0px; font-size:13px; width:auto; max-height:600px; overflow:auto; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; background-color:rgb(239,240,241); word-wrap:normal; color:rgb(36,39,41)"><code style="margin:0px; padding:0px; border:0px; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; white-space:inherit">Ciphertext is:
0000 - e0 6f 63 a7 11 e8 b7 aa-9f 94 40 10 7d 46 80 a1 .oc.......@.}F..
0010 - 17 99 43 80 ea 31 d2 a2-99 b9 53 02 d4 39 b9 70 ..C..1....S..9.p
0020 - 2c 8e 65 a9 92 36 ec 92-07 04 91 5c f1 a9 8a 44 ,.e..6.....\...D
Decrypted text is:
The quick brown fox jumps over the lazy dog
</code></pre>
<p style="margin-right:0px; margin-bottom:1em; margin-left:0px; background-color:rgb(255,255,255); padding:0px; border:0px; font-size:15px; clear:both; color:rgb(36,39,41); font-family:Arial,"Helvetica Neue",Helvetica,sans-serif">
With FIPS, compilation goes fine, but generates the following when run:</p>
<pre style="margin-top:0px; margin-bottom:1em; padding:5px; border:0px; font-size:13px; width:auto; max-height:600px; overflow:auto; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; background-color:rgb(239,240,241); word-wrap:normal; color:rgb(36,39,41)"><code style="margin:0px; padding:0px; border:0px; font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif; white-space:inherit">139686960322208:error:<wbr>2D0A0086:FIPS routines:FIPS_cipher:selftest failed:fips_enc.c:336:
139686960322208:error:<wbr>2D0A0086:FIPS routines:FIPS_cipher:selftest failed:fips_enc.c:336:
</code></pre>
<p style="margin-right:0px; margin-bottom:1em; margin-left:0px; background-color:rgb(255,255,255); padding:0px; border:0px; font-size:15px; clear:both; color:rgb(36,39,41); font-family:Arial,"Helvetica Neue",Helvetica,sans-serif">
I've tried both as a C project, and as a C++ project, pointing the CC env variable at both the fipsld script, and the modified fipsld++ from the wiki script as appropriate. My FIPSLD_CC variable points to gcc as noted in the FIPS documentation.</p>
<p style="margin-right:0px; margin-bottom:1em; margin-left:0px; background-color:rgb(255,255,255); padding:0px; border:0px; font-size:15px; clear:both; color:rgb(36,39,41); font-family:Arial,"Helvetica Neue",Helvetica,sans-serif">
What am I missing here?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<div id="m_-4777077090356752310Signature">
<div name="divtagdefaultwrapper">
<div>Thanks,</div>
<div><br>
</div>
Matt Heimlich </div>
</div>
</div>
<br>
--<br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">
https://mta.openssl.org/<wbr>mailman/listinfo/openssl-users</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>