<div dir="auto">Great!<div dir="auto"><br></div><div dir="auto">The CBC implementation was rather limited. If you have any specific requirements, fill free to fill a bug report in the engine repo. </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">пн, 22 июля 2019 г., 21:16 Blumenthal, Uri - 0553 - MITLL <<a href="mailto:uri@ll.mit.edu">uri@ll.mit.edu</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Are there any other parts of the openssl.cnf that could be related to this issue, or help diagnose it’s cause?<br>
Does your configuration file contain a header similar to described in the Gost engine documentation? If no, the gost section is not processed. <br>
<br>
I don't remember any significant changes in 1.1.1 engine processing, and it works with 1.0.2<br>
<br>
Sorry for brevity, I'll be able to look in more details only at the beginning of August. <br>
<br>
Darn… You were right – that header (openssl_conf = openssl_def) was NOT present. Adding it resulted in success (with some error messages):<br>
<br>
$ openssl speed -engine gost -evp gost89-cbc<br>
engine "gost" set.<br>
Doing gost89-cbc for 3s on 16 size blocks: 13107440 gost89-cbc's in 2.99s<br>
Doing gost89-cbc for 3s on 64 size blocks: 3383428 gost89-cbc's in 3.00s<br>
Doing gost89-cbc for 3s on 256 size blocks: 849765 gost89-cbc's in 3.00s<br>
Doing gost89-cbc for 3s on 1024 size blocks: 211166 gost89-cbc's in 3.00s<br>
Doing gost89-cbc for 3s on 8192 size blocks: 26167 gost89-cbc's in 3.01s<br>
Doing gost89-cbc for 3s on 16384 size blocks: 13338 gost89-cbc's in 3.00s<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4571538880:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_crypt.c:671:<br>
4571538880:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
$ openssl speed -engine gost -evp grasshopper-cfb<br>
engine "gost" set.<br>
Doing grasshopper-cfb for 3s on 16 size blocks: 19210088 grasshopper-cfb's in 3.00s<br>
Doing grasshopper-cfb for 3s on 64 size blocks: 5210373 grasshopper-cfb's in 3.00s<br>
Doing grasshopper-cfb for 3s on 256 size blocks: 1320249 grasshopper-cfb's in 3.00s<br>
Doing grasshopper-cfb for 3s on 1024 size blocks: 328343 grasshopper-cfb's in 3.00s<br>
Doing grasshopper-cfb for 3s on 8192 size blocks: 41459 grasshopper-cfb's in 3.00s<br>
Doing grasshopper-cfb for 3s on 16384 size blocks: 20488 grasshopper-cfb's in 3.00s<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
4541392320:error:8106A07A:lib(129):GOST_CIPHER_CTL:rng error:/Users/ur20980/src/engine/gost_grasshopper_cipher.c:558:<br>
4541392320:error:0607C085:digital envelope routines:EVP_CIPHER_CTX_ctrl:ctrl operation not implemented:crypto/evp/evp_enc.c:628:<br>
$<br>
<br>
<br>
<br>
<br>
пт, 19 июля 2019 г., 21:09 Blumenthal, Uri - 0553 - MITLL <mailto:<a href="mailto:uri@ll.mit.edu" target="_blank" rel="noreferrer">uri@ll.mit.edu</a>>:<br>
MacOS Mojave 10.14.5, OpenSSL-1.1.1c (Macports-installed).<br>
<br>
Engines defined in the openssl.cnf file:<br>
<br>
#############<br>
[engine_section]<br>
pkcs11 = pkcs11_section<br>
gost = gost_section<br>
<br>
[pkcs11_section]<br>
engine_id = pkcs11<br>
dynamic_path = /opt/local/lib/engines-1.1/libpkcs11.so<br>
MODULE_PATH = /Library/OpenSC/lib/opensc-pkcs11.so<br>
init = 0<br>
<br>
[gost_section]<br>
engine_id = gost<br>
dynamic_path = /opt/local/lib/engines-1.1/gost.dylib<br>
default_algorithms = ALL<br>
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet<br>
init = 1<br>
#############<br>
<br>
Note, whether the above has "init = 1" or not, does not alter the outcome.<br>
<br>
Engine in question is "gost". <br>
<br>
First, the engine does not load automatically/dynamically. For "openssl dgst" I have to specify it explicitly, otherwise the algorithms it provides, are not available:<br>
<br>
$ openssl dgst -md_gost94 ~/LastTest.log<br>
dgst: Unrecognized flag md_gost94<br>
dgst: Use -help for summary.<br>
$ openssl dgst -engine gost -md_gost94 ~/LastTest.log<br>
engine "gost" set.<br>
md_gost94(/Users/ur20980/LastTest.log)= e82e6e515c86851498eac606722b50b724b1f95952d4edb7202029f127751816<br>
$<br>
<br>
Second - even when I explicitly specify the engine, "openssl speed" refuses to recognize the ciphers provided by it, though "openssl enc" shows that it can access them:<br>
<br>
$ openssl speed -engine gost -evp gost89-cbc<br>
speed: gost89-cbc is an unknown cipher or digest<br>
$ openssl enc -engine gost -ciphers<br>
engine "gost" set.<br>
Supported ciphers:<br>
-aes-128-cbc -aes-128-cfb -aes-128-cfb1 <br>
-aes-128-cfb8 -aes-128-ctr -aes-128-ecb <br>
. . . . .<br>
-des3-wrap -desx -desx-cbc <br>
-gost89 -gost89-cbc -gost89-cnt <br>
-gost89-cnt-12 -grasshopper-cbc -grasshopper-cfb <br>
-grasshopper-ctr -grasshopper-ecb -grasshopper-ofb <br>
-id-aes128-wrap -id-aes128-wrap-pad -id-aes192-wrap<br>
<br>
<br>
Seems like a bug...?<br>
-- <br>
Regards,<br>
Uri<br>
</blockquote></div>