Re: Migration from 1.1.1 to 3.x

Hi Darshan,

Yes, you should use OSSL_PROVIDER_load() to explicitly load the FIPS
provider.

EVP_default_properties_enable_fips() alone is not sufficient to enable FIPS
mode unless the FIPS provider is already loaded.

Implications of skipping OSSL_PROVIDER_load():

If the FIPS provider is not already loaded via configuration (e.g., through
openssl.cnf), then EVP_default_properties_enable_fips() will silently fail
to enable FIPS mode.

This may lead to non-FIPS algorithms being used unintentionally.

Thanks & Regards
Prathap G

On Mon, 2 Jun, 2025, 9:58 am Mody, Darshan Arvindkumar (Darshan), <
darshanmody-gc/[email protected]> wrote:

> Hi
>
>
>
> We are migrating from 1.1.1 to 3.x openssl. We also need to support FIPs
> cipher and FIPs mode.
>
>
>
> My question is do we need to use the API the OSSL_PROVIDER_load. If we
> directly EVP_default_properties_enable_fips what are the implications.
>
>
>
> Thanks and Regards
>
> Darshan
>
>
>
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/PH0PR15MB4526934B9B0CE1696B7785EEA762A%40PH0PR15MB4526.namprd15.prod.outlook.com
> <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/PH0PR15MB4526934B9B0CE1696B7785EEA762A%40PH0PR15MB4526.namprd15.prod.outlook.com?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAMHS4B64jSu_2MkphoiTm3GanLdbfi8nmStBX6ESnYxJWQwcWA%40mail.gmail.com.