<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small">Hi Viktor,<br clear="all"></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Thanks for the response.</div><div class="gmail_default" style="font-size:small">After removing "tls1_new" and "tls1_clear", I didn't see the crash.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Need some clarification..</div><div class="gmail_default" style="font-size:small">The same code works fine with <span style="font-family:Helvetica;font-size:12px">OpenSSL 1.0.2g</span><span style="font-family:Helvetica;font-size:12px"> version. We have been using this api's in older versions also, it works fine.</span></div><div class="gmail_default" style="font-size:small"><span style="font-family:Helvetica;font-size:12px"><i>"tls1_new"</i> makes an <i>"ssl3_new"</i> api call. SSLV3 is deprecated in openssl1.1.1 version. </span></div><div class="gmail_default"><font face="Helvetica"><span style="font-size:12px">Are we not supposed to use this api(tls1_new) in openssl1.1.1? </span></font></div><div class="gmail_default"><font face="Helvetica"><span style="font-size:12px"><br></span></font></div><div class="gmail_default"><font face="Helvetica"><span style="font-size:12px">Thanks in advance.</span></font></div><div class="gmail_default" style="font-size:small"><span style="font-family:Helvetica;font-size:12px"><br></span></div><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Regards,<br></div><div dir="ltr"><div>Samiya khanum</div></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 20, 2023 at 7:10 AM <<a href="mailto:openssl-users-request@openssl.org" target="_blank">openssl-users-request@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send openssl-users mailing list submissions to<br>
<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openssl-users-request@openssl.org" target="_blank">openssl-users-request@openssl.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openssl-users-owner@openssl.org" target="_blank">openssl-users-owner@openssl.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: <span class="gmail_default" style="font-size:small"></span>Crash seen in tls13_enc API (Viktor Dukhovni)<br>
2. Re: OpenSSL seeks feedback on draft mission & values<br>
statement (Christian Heinrich)<br>
3. Re: RAND_Bytes() failed with RAND_R_ERROR_INSTANTIATING_DRBG<br>
(Dr Paul Dale)<br>
4. Re: OpenSSL 3.0.x + Python 3.9.x + Enable FIPS- Need<br>
help/inputs (Dr Paul Dale)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 19 Apr 2023 19:02:16 -0400<br>
From: Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" target="_blank">openssl-users@dukhovni.org</a>><br>
To: <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
Subject: Re: Crash seen in tls13_enc API<br>
Message-ID: <<a href="mailto:ZEBy-GeML2X8oLi5@straasha.imrryr.org" target="_blank">ZEBy-GeML2X8oLi5@straasha.imrryr.org</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
On Thu, Apr 20, 2023 at 12:20:16AM +0530, Samiya Khanum via openssl-users wrote:<br>
<br>
> * if(tls1_new(con) != 1)*<br>
> * {*<br>
> * SSL_shutdown(con);*<br>
> * SSL_free(con);*<br>
> * SocketClose(sd);*<br>
> * return FAILURE;*<br>
> * }*<br>
<br>
What is "tls1_new"? This does not look like a public OpenSSL API call.<br>
<br>
> * err = SSL_connect(con);*<br>
> * if(err == -1)*<br>
> * {*<br>
> * tls1_clear(con);*<br>
<br>
And what is tls1_clear()? Perhaps if you simply delete both calls,<br>
things will start to work.<br>
<br>
-- <br>
Viktor.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 20 Apr 2023 10:52:11 +0930<br>
From: Christian Heinrich <<a href="mailto:christian.heinrich@cmlh.id.au" target="_blank">christian.heinrich@cmlh.id.au</a>><br>
To: Hugo Landau <<a href="mailto:hlandau@openssl.org" target="_blank">hlandau@openssl.org</a>><br>
Cc: <a href="mailto:openssl-project@openssl.org" target="_blank">openssl-project@openssl.org</a>, <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
Subject: Re: OpenSSL seeks feedback on draft mission & values<br>
statement<br>
Message-ID:<br>
<<a href="mailto:CAGKxTUROfvVh5RVKp1Si_KMfNCYbZjhBAUJwqF-oCDRz64-19Q@mail.gmail.com" target="_blank">CAGKxTUROfvVh5RVKp1Si_KMfNCYbZjhBAUJwqF-oCDRz64-19Q@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
Hugo,<br>
<br>
On Fri, 31 Mar 2023 at 20:09, Hugo Landau <<a href="mailto:hlandau@openssl.org" target="_blank">hlandau@openssl.org</a>> wrote:<br>
> For further information on the draft mission & values statement and<br>
> details on how to submit feedback, please see:<br>
<br>
Just an additional point that wasn't appropriate for the feedback form.<br>
<br>
Can you include a statement that clarifies the position on export<br>
restrictions in light of the fact OpenSSL is widely available and<br>
therefore does not strictly apply in most cases?<br>
<br>
<br>
--<br>
Regards,<br>
Christian Heinrich<br>
<br>
<a href="http://cmlh.id.au/contact" rel="noreferrer" target="_blank">http://cmlh.id.au/contact</a><br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 20 Apr 2023 11:33:18 +1000<br>
From: Dr Paul Dale <<a href="mailto:pauli@openssl.org" target="_blank">pauli@openssl.org</a>><br>
To: <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
Subject: Re: RAND_Bytes() failed with RAND_R_ERROR_INSTANTIATING_DRBG<br>
Message-ID: <<a href="mailto:4bfa0629-e010-9335-4241-a92b07b5f9af@openssl.org" target="_blank">4bfa0629-e010-9335-4241-a92b07b5f9af@openssl.org</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
My guess would be /dev/random is waiting to be seeded.? 3.0 waits for <br>
the operating system to have decent entropy.? 1.1.1 will run without <br>
(which is rather bad).<br>
<br>
You might be able to run one of the entropy gathering daemons.? CPU <br>
Jitter is my usual recommendation but there are others.<br>
<br>
<br>
Paul Dale<br>
<br>
<br>
On 18/4/23 05:11, Manish Patel via openssl-users wrote:<br>
> Hi,<br>
><br>
> ? I am trying to upgrade openssl-1.1.1c with openssl-3.0.8.<br>
> We have an existing code that calls RAND_Bytes() which<br>
> now fails with above error code: [error:1200006C:lib(36)::reason(108)]<br>
><br>
> Tracing<br>
> RAND_bytes_ex()<br>
> seed_src_generate()<br>
> ossl_pool_acquire_entropy() <- this returns no entropy.<br>
><br>
> The pool->len is always zero.<br>
> I do not see ossl_rand_pool_add() or ossl_rand_pool_add_begin()<br>
> ever called.<br>
><br>
> What am I missing? Looks like the random code in openssl has changed<br>
> significantly but can not figure out what do I need to do for the<br>
> entropy pool<br>
> to kick start.<br>
><br>
> Any help is appreciated.<br>
><br>
> Thank you<br>
> Manish.<br>
><br>
><br>
><br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Thu, 20 Apr 2023 11:39:37 +1000<br>
From: Dr Paul Dale <<a href="mailto:pauli@openssl.org" target="_blank">pauli@openssl.org</a>><br>
To: "Prasad, PCRaghavendra" <<a href="mailto:Pcraghavendra.Prasad@dell.com" target="_blank">Pcraghavendra.Prasad@dell.com</a>>,<br>
"<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a>><br>
Cc: "Ds, Pradeep Kumar" <PradeepKumar.Ds@Dell.com><br>
Subject: Re: OpenSSL 3.0.x + Python 3.9.x + Enable FIPS- Need<br>
help/inputs<br>
Message-ID: <<a href="mailto:5b7134db-07ad-c1b0-89cc-2639c4e1c6d5@openssl.org" target="_blank">5b7134db-07ad-c1b0-89cc-2639c4e1c6d5@openssl.org</a>><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
It looks like you're trying to access non-approved crypto.? My <br>
suggestion would be to create a new library context specifically for <br>
this using OSSL_LIB_CTX_new().? Load only the default provider into that <br>
context using OSSL_PROVIDER_load().? Do not call <br>
EVP_default_properties_enable_fips() on it.<br>
<br>
You should only use this new library context for non-FIPS operations.? <br>
If there is any doubt about what is permitted and what isn't, contact <br>
your FIPS lab for clarification.<br>
<br>
Paul Dale<br>
<br>
On 20/4/23 01:35, Prasad, PCRaghavendra wrote:<br>
><br>
> Hi Dr.Paul/Team,<br>
><br>
> Good Morning,<br>
><br>
> We have integrated OpenSSL 3.0.8 in our code along with fips <br>
> enablement. We are using python 3.11 version.<br>
><br>
> We have used the default search path as our application directory <br>
> (OSSL_PROVIDER_set_default_search_path) and loaded the ?base? and <br>
> ?fips? providers and not the default provider.<br>
><br>
> OSSL_PROVIDER_load(None, b"base")<br>
><br>
> OSSL_PROVIDER_load(None, b"fips")<br>
><br>
> After that, we enabled the FIPS using <br>
> libcrypto.EVP_default_properties_enable_fips() call.<br>
><br>
> Should we load the default provider as well or base and fips are good <br>
> enough?<br>
><br>
> Sometimes we are getting the below error message from Python <br>
> cryptography package<br>
><br>
> cryptography.exceptions.InternalError: Unknown OpenSSL error. This <br>
> error is commonly encountered when another library is not cleaning up <br>
> the OpenSSL error stack. If you are using cryptography with another <br>
> library that uses OpenSSL try disabling it before reporting a bug. <br>
> Otherwise please file an issue at <br>
> <a href="https://github.com/pyca/cryptography/issues" rel="noreferrer" target="_blank">https://github.com/pyca/cryptography/issues</a> with information on how to <br>
> reproduce this. ([_OpenSSLErrorWithText(code=50856204, lib=6, <br>
> reason=524556, reason_text=b'error:0308010C:digital envelope <br>
> routines::unsupported')])<br>
><br>
> This error is intermittent is what we are observing as we have already <br>
> tested the complete application couple of times<br>
><br>
> Any thoughts or inputs on this please will help us in debugging more <br>
> on this issue.<br>
><br>
> Thanks,<br>
><br>
> Raghavendra<br>
><br>
> Internal Use - Confidential<br>
><br>
> *From:* Dr Paul Dale <<a href="mailto:pauli@openssl.org" target="_blank">pauli@openssl.org</a>><br>
> *Sent:* Wednesday, March 8, 2023 11:02 AM<br>
> *To:* Prasad, PCRaghavendra; <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
> *Cc:* Ds, Pradeep Kumar; Kuppam, Pradeep; Kappgal, Srinath<br>
> *Subject:* Re: OpenSSL 3.0.x + Python 3.9.x + Enable FIPS- Need <br>
> help/inputs<br>
><br>
> [EXTERNAL EMAIL]<br>
><br>
> Are there any specific .h files where we can refer to this method<br>
> that needs to be used ( ex: evp.h )?<br>
><br>
><br>
> #include "openssl/evp.h" should be enough to get the EVP APIs.? You <br>
> will need other includes for other parts of OpenSSL but that covers <br>
> EVP well enough.<br>
><br>
><br>
> still, are there any files that we can go through once before<br>
> calling in the fips mode?<br>
><br>
><br>
> Turn on -Wdeprecated or equivalent in your compile and the low level <br>
> calls will be flagged.? They should all be deprecated.<br>
><br>
><br>
> One more doubt is How can we set fips enabled for the complete<br>
> application (process/service) while running so that if we are<br>
> using non-compliant algorithms/methods it should throw errors? Is<br>
> it possible in OpenSSL 3.0.x?<br>
><br>
><br>
> The call you are looking for is:<br>
><br>
> EVP_set_default_properties(libctx, "fips=yes");<br>
><br>
> I strongly suggest reading the documentation about the FIPS provider <br>
> [<a href="http://openssl.org" rel="noreferrer" target="_blank">openssl.org</a>] <br>
> <<a href="https://urldefense.com/v3/__https:/www.openssl.org/docs/man3.0/man7/fips_module.html__;!!LpKI!gwsGt_60jqaHzhWTEXZCwSn0frcRAuJbbxYQLrkbfBfkw9-Eg_mdOnYzU6EDHNOBOR25XSXKcqHcPO1X7_TtGA$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https:/www.openssl.org/docs/man3.0/man7/fips_module.html__;!!LpKI!gwsGt_60jqaHzhWTEXZCwSn0frcRAuJbbxYQLrkbfBfkw9-Eg_mdOnYzU6EDHNOBOR25XSXKcqHcPO1X7_TtGA$</a>> <br>
> and the migration guide [<a href="http://openssl.org" rel="noreferrer" target="_blank">openssl.org</a>] <br>
> <<a href="https://urldefense.com/v3/__https:/www.openssl.org/docs/man3.0/man7/migration_guide.html__;!!LpKI!gwsGt_60jqaHzhWTEXZCwSn0frcRAuJbbxYQLrkbfBfkw9-Eg_mdOnYzU6EDHNOBOR25XSXKcqHcPO2zYsa_AA$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https:/www.openssl.org/docs/man3.0/man7/migration_guide.html__;!!LpKI!gwsGt_60jqaHzhWTEXZCwSn0frcRAuJbbxYQLrkbfBfkw9-Eg_mdOnYzU6EDHNOBOR25XSXKcqHcPO2zYsa_AA$</a>>.? <br>
> Both the avoidance of low level calls and setting the default <br>
> properties are covered therein.? There are a number of other nuances <br>
> to trip over when using the FIPS provider.<br>
><br>
><br>
> Paul Dale<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20230420/d4a3c48a/attachment.htm" rel="noreferrer" target="_blank">https://mta.openssl.org/pipermail/openssl-users/attachments/20230420/d4a3c48a/attachment.htm</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 101, Issue 30<br>
**********************************************<br>
</blockquote></div>
</div>
<br>
<span style="background-color:rgb(255,255,255)"><font size="2">This electronic communication and the information and any files transmitted with it, or attached to it, are confidential and are intended solely for the use of the individual or entity to whom it is addressed and may contain information that is confidential, legally privileged, protected by privacy laws, or otherwise restricted from disclosure to anyone else. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, you are hereby notified that any use, copying, distributing, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender, delete it from your computer, and destroy any printed copy of it.</font></span>