<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks Matt. I actually had this working (loading the fips_libctx using the *load_config() API) but I was hitting other issues and thought I was doing something wrong (more on that later). </div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So to review, I have my own config file, /usr/local/ssl/openssl-fips, with the relevant contents(some comments snipped):</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
.include /usr/local/ssl/fipsmodule.cnf
<div><br>
</div>
<div>[openssl_init]</div>
<div>providers = provider_sect</div>
<div><br>
</div>
<div># List of providers to load</div>
<div>[provider_sect]</div>
<div>default = default_sect</div>
<div># The fips section name should match the section name inside the</div>
<div># included fipsmodule.cnf.</div>
<div>fips = fips_sect</div>
<div>base = base_sect </div>
<div><br>
</div>
<div>[default_sect]<br>
</div>
<div># activate = 1</div>
<div><br>
</div>
<div>[base_sect]<br>
</div>
<span>activate = 1</span><br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
And then fipsmodule.cnf contains:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
[fips_sect]
<div>activate = 1</div>
<div>conditional-errors = 1</div>
<div>security-checks = 1</div>
module-mac = E4:0D:C8:C3:1E:DB:2B:30:E6:F2:49:7B:F5:BD:10:5C:9A:2B:CC:C1:33:49:31:B5:C5:AF:50:AB:82:1E:AE:C9<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
By activating the fips and base providers via config, my application then calls:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
OSSL_LIB_CTX_load_config(fips_libctx, "/usr/local/ssl/openssl-fips.cnf");<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Which loads the "fips" and "base" providers in the fips_libctx, which I verify with:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
OSSL_PROVIDER_available(fips_libctx, "fips");<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
and</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
OSSL_PROVIDER_available(fips_libctx, "base")<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
...and both are available.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
However, remember I am trying to create two non-default library contexts (from earlier code):</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
fips_libctx = OSSL_LIB_CTX_new();
<div></div>
non_fips_libctx = OSSL_LIB_CTX_new();<span></span><br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Again, I think I have what I need for the fibs_libctx. For the non_fips_libctx, I'm calling:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
defp = OSSL_PROVIDER_load(non_fips_libctx, "default");<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
nullp = OSSL_PROVIDER_load(NULL, "null");<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
A call to OSSL_PROVIDER_available() says the "default" provider is available; however, I'm wondering if I should be loading the default provider via *load_config() as well? I would have to uncomment the "activate = 1" in the default section of my config though.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I also still have this in my code:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
/* Disallow falling back to the default library context */
<div> </div>
<span> nullp = OSSL_PROVIDER_load(NULL, "null");</span><br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
But not sure it's having any affect?</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I do know that later in my application, both in "FIPS" or "non-FIPS" mode, I can create an SSL_CTX with SSL_CTX_new_ex(). I also successfully call several APIs using both the fips_libctx or the non_fips_libctx, for example:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0in;font-family:Calibri;font-size:12.0pt;color:black">status = SSL_CTX_use_PrivateKey_file(ctx,<file>,SSL_FILETYPE_PEM);</p>
<p style="margin:0in;font-family:Calibri;font-size:12.0pt;color:black">status = SSL_CTX_use_certificate_file(ctx,<file>,SSL_FILETYPE_PEM);</p>
<p style="margin:0in;font-family:Calibri;font-size:12.0pt;color:black">status = SSL_CTX_check_private_key(ctx);</p>
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
All return successfully. So I think what I have between configuration files and API calls accomplishes what I need to. Would anyone reading this agree?</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I'm running into another issue that I need to troubleshoot a bit more before I add too much information and too many questions to a single message.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks to everyone for their help with this, things are starting to make more sense now.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Matt Caswell <matt@openssl.org><br>
<b>Sent:</b> Thursday, October 28, 2021 7:39 AM<br>
<b>To:</b> Jason Schultz <jetson23@hotmail.com>; Dr Paul Dale <pauli@openssl.org>; openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: OpenSSL 3.0 FIPS questions</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText"><br>
<br>
On 27/10/2021 17:28, Jason Schultz wrote:<br>
> With these config files and the code above, the <br>
> OSSL_PROVIDER_load(fips_libctx, "fips") call fails. Here are the <br>
> messages from the ERR_print_errors_fp() call:<br>
> <br>
> 2097C692B57F0000:error:1C8000D5:Provider routines:(unknown <br>
> function):missing config data:providers/fips/self_test.c:289:<br>
> 2097C692B57F0000:error:1C8000E0:Provider routines:(unknown <br>
> function):fips module entering error state:providers/fips/self_test.c:387:<br>
> 2097C692B57F0000:error:1C8000D8:Provider routines:(unknown <br>
> function):self test post failure:providers/fips/fipsprov.c:706:<br>
> 2097C692B57F0000:error:078C0105:common libcrypto routines:(unknown <br>
> function):init fail:crypto/provider_core.c:903:name=fips<br>
<br>
<br>
This tells us that the fips provider has successfully loaded, but then <br>
subsequently failed during its self-test because it cannot find its <br>
config data.<br>
<br>
I can see that you have created a separate libctx for fips. However <br>
automatic loading of the config file only works for the *default* <br>
libctx. If you create your own one then you need to explicitly load the <br>
config file:<br>
<br>
if (!OSSL_LIB_CTX_load_config(fips_libtx, "/usr/local/ssl/openssl.cnf")) {<br>
/* error handling */<br>
}<br>
<br>
Actually if you do this then you should not need to call <br>
OSSL_PROVIDER_load() explicitly to load the fips provider since you <br>
already activated it in the config file. You can either drop the <br>
explicit call to OSSL_PROVIDER_load() for the fips provider, or remove <br>
the "activate = 1" line in "fips_sect" in fipsmodule.cnf. This is just a <br>
minor optimisation though. Doing both is redundant but harmless. You <br>
could also load the base provider via config if you wanted to.<br>
<br>
Matt<br>
<br>
<br>
</div>
</span></font></div>
</div>
</body>
</html>