The provider fips can't be loaded on openssl3.0.8

Matt Caswell matt at openssl.org
Fri May 5 08:26:23 UTC 2023



On 05/05/2023 08:27, Johnson Wang (王舜樸) via openssl-users wrote:

>      fips = OSSL_PROVIDER_load(NULL, "fips_sect");

This looks odd. You should just be loading "fips" not "fips_sect".

Matt


> 
>      if (fips == NULL) {
> 
>          printf("Failed to load FIPS provider\n");
> 
>          exit(EXIT_FAILURE);
> 
>      }
> 
>      base = OSSL_PROVIDER_load(NULL, "base");
> 
>      if (base == NULL) {
> 
>          OSSL_PROVIDER_unload(fips);
> 
>          printf("Failed to load base provider\n");
> 
>          exit(EXIT_FAILURE);
> 
>      }
> 
>      /* Rest of application */
> 
>      OSSL_PROVIDER_unload(base);
> 
>      OSSL_PROVIDER_unload(fips);
> 
>      exit(EXIT_SUCCESS);
> 
> }
> 
> Thanks,
> 
> Johnson
> 
> *From:*openssl-users <openssl-users-bounces at openssl.org> *On Behalf Of 
> *pauli at openssl.org
> *Sent:* Friday, May 5, 2023 11:23 AM
> *To:* openssl-users at openssl.org
> *Subject:* [EXTERNAL] Re: The provider fips can't be loaded on openssl3.0.8
> 
> ***CAUTION:*The e-mail below is from an external source. Please exercise 
> caution before opening attachments, clicking links, or following 
> guidance.**
> 
> My initial guess would be that the configuration file isn't being found 
> by your application.
> Have you set OPENSSL_CONF?
> What about OPENSSL_CONF_INCLUDE?
> 
> Useful places to look are the FIPS module 
> <https://www.openssl.org/docs/man3.0/man7/fips_module.html> and the 
> config <https://www.openssl.org/docs/man3.0/man5/config.html> documentation.
> 
> 
> Pauli
> 
> On 5/5/2023 12:28 pm, Johnson Wang (王舜樸) via openssl-users wrote:
> 
>     Hi,
> 
>     Environment: Debian buster
> 
>     After installing openssl and running fipsinstall, I tried to execute
>     "openssl list -providers". The log didn't print provider fips.
> 
>     And, I went to try the test code as below. It printed "Failed to
>     load FIPS provider".
> 
>     Test code:
> 
>     #include <openssl/provider.h>
> 
>     int main(void)
> 
>     {
> 
>          OSSL_PROVIDER *fips;
> 
>          OSSL_PROVIDER *base;
> 
>          fips = OSSL_PROVIDER_load(NULL, "fips");
> 
>          if (fips == NULL) {
> 
>              printf("Failed to load FIPS provider\n");
> 
>              exit(EXIT_FAILURE);
> 
>          }
> 
>          base = OSSL_PROVIDER_load(NULL, "base");
> 
>          if (base == NULL) {
> 
>              OSSL_PROVIDER_unload(fips);
> 
>              printf("Failed to load base provider\n");
> 
>              exit(EXIT_FAILURE);
> 
>          }
> 
>          /* Rest of application */
> 
>          OSSL_PROVIDER_unload(base);
> 
>          OSSL_PROVIDER_unload(fips);
> 
>          exit(EXIT_SUCCESS);
> 
>     }
> 
>     Test command:
> 
>     openssl list -providers
> 
>     Providers:
> 
>        base
> 
>          name: OpenSSL Base Provider
> 
>          version: 3.0.8
> 
>          status: active
> 
>     Complete steps:
> 
>     1. ./Configure --prefix=/usr --openssldir=/usr/lib/ssl
>     --libdir=lib/arm-linux-gnueabi shared no-idea no-mdc2 no-rc5 no-zlib
>     no-ssl3 no-rc4 no-dtls1 linux-armv4 enable-fips
> 
>     2. make depend
> 
>     3. make
> 
>     4. make install
> 
>     5. openssl fipsinstall -out /usr/lib/ssl/fipsmodule.cnf -module
>     /usr/lib/arm-linux-gnueabi/ossl-modules/fips.so
> 
>     6. Modify openssl.cnf
> 
>     7. Run openssl list -providers
> 
>     openssl.cnf:
> 
>     I have added the setting:
> 
>     openssl_conf = openssl_init
> 
>     config_diagnostics = 1
> 
>     .include /usr/lib/ssl/fipsmodule.cnf
> 
>     [openssl_init]
> 
>     providers = provider_sect
> 
>     [provider_sect]
> 
>     fips = fips_sect
> 
>     base = base_sect
> 
>     [base_sect]
> 
>     activate = 1
> 
>     fipsmodule.cnf:
> 
>     [fips_sect]
> 
>     activate = 1
> 
>     install-version = 1
> 
>     conditional-errors = 1
> 
>     security-checks = 1
> 
>     module-mac =
>     C1:D0:1D:D2:1F:74:98:86:8C:55:DB:B0:5D:74:F0:74:FF:A1:63:E9:ED:6C:E6:97:6D:DB:D9:96:CF:1B:CA:8B
> 
>     install-mac =
>     41:9C:38:C2:8F:59:09:43:2C:AA:2F:58:36:2D:D9:04:F9:6C:56:8B:09:E0:18:3A:2E:D6:CC:69:05:04:E1:11
> 
>     install-status = INSTALL_SELF_TEST_KATS_RUN
> 
>     Some test result:
> 
>     openssl version -a
> 
>     OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
> 
>     built on: Tue May  2 07:20:31 2023 UTC
> 
>     platform: linux-armv4
> 
>     options:  bn(64,32)
> 
>     compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3
>     -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
> 
>     OPENSSLDIR: "/usr/lib/ssl"
> 
>     ENGINESDIR: "/usr/lib/arm-linux-gnueabi/engines-3"
> 
>     MODULESDIR: "/usr/lib/arm-linux-gnueabi/ossl-modules"
> 
>     Seeding source: os-specific
> 
>     CPUINFO: OPENSSL_armcap=0x0
> 
>     openssl fipsinstall -out /usr/lib/ssl/fipsmodule.cnf -module
>     /usr/lib/arm-linux-gnueabi/ossl-modules/fips.so
> 
>     HMAC : (Module_Integrity) : Pass
> 
>     SHA1 : (KAT_Digest) : Pass
> 
>     SHA2 : (KAT_Digest) : Pass
> 
>     SHA3 : (KAT_Digest) : Pass
> 
>     TDES : (KAT_Cipher) : Pass
> 
>     AES_GCM : (KAT_Cipher) : Pass
> 
>     AES_ECB_Decrypt : (KAT_Cipher) : Pass
> 
>     RSA : (KAT_Signature) : RNG : (Continuous_RNG_Test) : Pass
> 
>     Pass
> 
>     ECDSA : (PCT_Signature) : Pass
> 
>     ECDSA : (PCT_Signature) : Pass
> 
>     DSA : (PCT_Signature) : Pass
> 
>     TLS13_KDF_EXTRACT : (KAT_KDF) : Pass
> 
>     TLS13_KDF_EXPAND : (KAT_KDF) : Pass
> 
>     TLS12_PRF : (KAT_KDF) : Pass
> 
>     PBKDF2 : (KAT_KDF) : Pass
> 
>     SSHKDF : (KAT_KDF) : Pass
> 
>     KBKDF : (KAT_KDF) : Pass
> 
>     HKDF : (KAT_KDF) : Pass
> 
>     SSKDF : (KAT_KDF) : Pass
> 
>     X963KDF : (KAT_KDF) : Pass
> 
>     X942KDF : (KAT_KDF) : Pass
> 
>     HASH : (DRBG) : Pass
> 
>     CTR : (DRBG) : Pass
> 
>     HMAC : (DRBG) : Pass
> 
>     DH : (KAT_KA) : Pass
> 
>     ECDH : (KAT_KA) : Pass
> 
>     RSA_Encrypt : (KAT_AsymmetricCipher) : Pass
> 
>     RSA_Decrypt : (KAT_AsymmetricCipher) : Pass
> 
>     RSA_Decrypt : (KAT_AsymmetricCipher) : Pass
> 
>     INSTALL PASSED
> 
>     Could you please help to check whether I have wrong steps?
> 
>     Thanks,
> 
>     Johnson
> 
>     -The information contained in this message may be confidential and
>     proprietary to American Megatrends (AMI). This communication is
>     intended to be read only by the individual or entity to whom it is
>     addressed or by their designee. If the reader of this message is not
>     the intended recipient, you are on notice that any distribution of
>     this message, in any form, is strictly prohibited. Please promptly
>     notify the sender by reply e-mail or by telephone at 770-246-8600,
>     and then delete or destroy all copies of the transmission.
> 
> -The information contained in this message may be confidential and 
> proprietary to American Megatrends (AMI). This communication is intended 
> to be read only by the individual or entity to whom it is addressed or 
> by their designee. If the reader of this message is not the intended 
> recipient, you are on notice that any distribution of this message, in 
> any form, is strictly prohibited. Please promptly notify the sender by 
> reply e-mail or by telephone at 770-246-8600, and then delete or destroy 
> all copies of the transmission.


More information about the openssl-users mailing list