Re: Need to check on compatibility issue
Matt Caswell <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <CAODx15eqJL_uajbjC4CEHZnz2opZXrhMYO5izRmT98B4=RZQ+w@mail.gmail.com> |
On Wed, 2 Jul 2025 at 20:22, Michael Richardson <mcr+ietf-SWp7JaYWvAQV+D8aMU/[email protected]> wrote: > > Matt Caswell <[email protected]> wrote: > >> All of our openssl releases are backwards compatible with older fips > >> providers, no issues are currently known. > >> > >> To be clear, the above means that libcrypto.so from openssl 3.5 will > >> work with the fips.so library from 3.4 and earlier releases. It > does > >> not imply any forward compatibility, i.e. the fips.so file from 3.5 > is > >> not guaranteed to work with the libcrypto.so library from 3.4 and > >> earlier. > >> > > > Actually we test in both directions, e.g. 3.5 library with 3.4 fips > > test run is here: > > But, do you promise it will always work? > Yes. At least within the same major version. We *may* choose to extend the promise across some major versions (e.g. we may choose to promise that 3.x providers will still work with 4.x libcrypto and vice versa) but that would be on a case by case basis. > > I would think that makes it impossible to add new ABI, or change the ABI > that > openssl provides. > Within the same major version we only ever make additions to the ABI. So newer versions may expose more functions at the fips.so level. But the provider interface is designed such that libcrypto can discover the capabilities that any particular provider supports. So if a new libcrypto encounters an older fips provider, it will only use the things that that provider can do. Similarly if an older libcrypto is used with a newer fips.so, then it won't know how to deal with new functions made available by the fips.so - but that's ok. It will just continue to use the old functions. Matt > > -- > Michael Richardson <mcr+IETF-SWp7JaYWvAQV+D8aMU/[email protected]> . o O ( IPv6 IøT consulting ) > Sandelman Software Works Inc, Ottawa and Worldwide > > > > > -- You received this message because you are subscribed to the Google Groups "openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAODx15eqJL_uajbjC4CEHZnz2opZXrhMYO5izRmT98B4%3DRZQ%2Bw%40mail.gmail.com.