Re: How to test a build of the FIPS provider
Ronny Kiel <[email protected]> Thu, 26 Mar 2026 19:53:32 +0100
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <CAJmL2NR5+nZk+yMgh3XTY-4jEgZEtv+JpCJKB-S4A+qjsDMqfQ@mail.gmail.com> |
--0000000000004048c3064df1e7fa Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Okaay LargePrefPlaceholder-XKUz1MEJBwkOM Kenneth Goldman <kgoldman-r/[email protected]> schrieb am Do., 26. M=C3=A4rz 2026, 1= 9:51: > Getting back to this, I followed the instructions below. > > > openssl list -providers > Providers: > base > name: OpenSSL Base Provider > version: 3.6.1 > status: active > fips > name: OpenSSL FIPS Provider > version: 3.6.1 > status: active > > How do I ensure that the program uses the fips module? I try: > > provider =3D OSSL_PROVIDER_load(NULL, "fips"); > irc =3D EVP_set_default_properties(NULL, "provider=3Dfips"); > sha =3D EVP_MD_fetch(NULL, HASHALG, "fips=3Dyes"); > sha =3D EVP_MD_fetch(NULL, HASHALG, "provider=3Dfips"); > > All of these seem successful, but this NULL is also successful, so > how do ensure that the fips module is being used? > > sha =3D EVP_MD_fetch(NULL, HASHALG, NULL); > > Even though I have a base provider (see above), base fails, with > or without the OSSL_PROVIDER_load() or OSSL_PROVIDER_load() calls. > > sha =3D EVP_MD_fetch(NULL, HASHALG, "provider=3Dbase"); > > > > On 1/28/2026 6:26 PM, Ken Goldman wrote: > > On 1/19/2026 6:49 PM, Ken Goldman wrote: > > Fedora 42, x86 - I built openssl 3.6.1 with enable-fips and got fips.so > > I'd like to test it locally, as non-root, but not install it in the syste= m > area. Are there instructions for this? > > I want to test the EVP API, not TLS or the command line. > > For the record, here are working instructions, creating > a fips build in myopenssl: > > ./config -shared --prefix=3D/home/kgold/myopenssl --libdir=3Dlib -- > openssldir=3D/home/kgold/myopenssl -Wl,-rpath,$HOME/myopenssl/lib --debug > zlib enable-fips > make > creates > ./providers/libfips.a > ./providers/fips.so > make install > installs to myopenssl directory > make test > make install_fips > creates > /home/kgold/myopenssl/lib/ossl-modules/fips.so > /home/kgold/myopenssl/fipsmodule.cnf > > openssl.cnf > add > .pragma includedir:*/home/myopenssl/* > uncomment > .include fipsmodule.cnf > comment > #default =3D default_sect > add > base =3D default_sect > fips =3D fips_sect > in default_sect, uncomment > activate =3D 1 > > fipsmodule.cnf > add > module =3D /home/myopenssl/lib/ossl-modules/fips.so > > LNFLAGS +=3D -L/home/myopenssl/lib -Wl,-rpath=3D/home/myopenssl/lib -lcry= pto > > Test with > openssl list -providers > > Providers: > base > name: OpenSSL Base Provider > version: 3.6.1 > status: active > fips > name: OpenSSL FIPS Provider > version: 3.6.1 > status: active > > > -- > > Work 1-914-945-2415 > > -- > You received this message because you are subscribed to the Google Groups > "openssl-users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org > To view this discussion visit > https://groups.google.com/a/openssl.org/d/msgid/openssl-users/SJ0PR15MB52= 787DE3EDD3BFEAA9D17D81F256A%40SJ0PR15MB5278.namprd15.prod.outlook.com > <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/SJ0PR15MB5= 2787DE3EDD3BFEAA9D17D81F256A%40SJ0PR15MB5278.namprd15.prod.outlook.com?utm_= medium=3Demail&utm_source=3Dfooter> > . > --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/CAJmL2NR5%2BnZk%2ByMgh3XTY-4jEgZEtv%2BJpCJKB-S4A%2BqjsDMqf= Q%40mail.gmail.com. --0000000000004048c3064df1e7fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div>Okaay</div><div><br></div><div data-smartmail=3D"gma= il_signature">LargePrefPlaceholder-XKUz1MEJBwkOM</div></div><br><div class= =3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr= ">Kenneth Goldman <<a href=3D"mailto:kgoldman-r/[email protected]">kgoldman-9BUKV/[email protected]= m.com</a>> schrieb am Do., 26. M=C3=A4rz 2026, 19:51:<br></div><blockquo= te class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc so= lid;padding-left:1ex"><u></u> <div> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">Getting back to th= is, I followed the instructions below.<br> <br> > openssl list -providers<br> Providers:<br> =C2=A0 base<br> =C2=A0=C2=A0=C2=A0 name: OpenSSL Base Provider<br> =C2=A0=C2=A0=C2=A0 version: 3.6.1<br> =C2=A0=C2=A0=C2=A0 status: active<br> =C2=A0 fips<br> =C2=A0=C2=A0=C2=A0 name: OpenSSL FIPS Provider<br> =C2=A0=C2=A0=C2=A0 version: 3.6.1<br> =C2=A0=C2=A0=C2=A0 status: active<br> <br> How do I ensure that the program uses the fips module? I try:<br> <br> =C2=A0=C2=A0=C2=A0=C2=A0provider =3D OSSL_PROVIDER_load(NULL, "fips&qu= ot;);<br> =C2=A0=C2=A0=C2=A0=C2=A0irc =3D EVP_set_default_properties(NULL, "prov= ider=3Dfips");<br> =C2=A0=C2=A0=C2=A0=C2=A0sha =3D EVP_MD_fetch(NULL, HASHALG, "fips=3Dye= s");<br> =C2=A0=C2=A0=C2=A0=C2=A0sha =3D EVP_MD_fetch(NULL, HASHALG, "provider= =3Dfips");<br> <br> All of these seem successful, but this NULL is also successful, so<br> how do ensure that the fips module is being used?<br> <br> =C2=A0=C2=A0=C2=A0=C2=A0sha =3D EVP_MD_fetch(NULL, HASHALG, NULL);<br> <br> Even though I have a base provider (see above), base fails, with<br> or without the OSSL_PROVIDER_load() or OSSL_PROVIDER_load() calls.<br> <br> =C2=A0=C2=A0=C2=A0=C2=A0sha =3D EVP_MD_fetch(NULL, HASHALG, "provider= =3Dbase");<br> <br> <br> <br> On 1/28/2026 6:26 PM, Ken Goldman wrote:<br> </font></span></p> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">On 1/19/2026 6:49 = PM, Ken Goldman wrote:<br> </font></span></p> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">Fedora 42, x86 - I= built openssl 3.6.1 with enable-fips and got fips.so<br> <br> I'd like to test it locally, as non-root, but not install it in the sys= tem area. Are there instructions for this?<br> <br> I want to test the EVP API, not TLS or the command line. </font></span></p> <br> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">For the record, he= re are working instructions, creating<br> a fips build in myopenssl:<br> <br> ./config -shared --prefix=3D/home/kgold/myopenssl --libdir=3Dlib -- openssl= dir=3D/home/kgold/myopenssl -Wl,-rpath,$HOME/myopenssl/lib --debug zlib ena= ble-fips<br> make<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0creates<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0./providers/libfips.a<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0./providers/fips.so<br> make install<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0installs to myopenssl directory<br> make test<br> make install_fips<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0creates<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/home/kgold/myopenssl/lib/ossl-modules/fips.s= o<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/home/kgold/myopenssl/fipsmodule.cnf<br> <br> openssl.cnf<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0add<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 .pragma includedir:</font>= </span><span lang=3D"en-us"></span><span lang=3D"en-us"></span><span lang= =3D"en-us"><i><font face=3D"Aptos">/home/myopenssl/</font></i></span><span = lang=3D"en-us"></span><span lang=3D"en-us"></span><span lang=3D"en-us"><fon= t face=3D"Aptos"><br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0uncomment<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 .include fipsmodule.cnf<br= > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0comment<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 #default =3D default_sect<= br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0add<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 base =3D default_sect<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 fips =3D fips_sect<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0in default_sect, uncomment<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 activate =3D 1<br> <br> fipsmodule.cnf<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0add<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 module =3D /home/myopenssl= /lib/ossl-modules/fips.so<br> <br> LNFLAGS +=3D -L/home/myopenssl/lib -Wl,-rpath=3D/home/myopenssl/lib -lcrypt= o<br> <br> Test with<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0openssl list -providers<br> <br> Providers:<br> =C2=A0=C2=A0 base<br> =C2=A0=C2=A0=C2=A0=C2=A0 name: OpenSSL Base Provider<br> =C2=A0=C2=A0=C2=A0=C2=A0 version: 3.6.1<br> =C2=A0=C2=A0=C2=A0=C2=A0 status: active<br> =C2=A0=C2=A0 fips<br> =C2=A0=C2=A0=C2=A0=C2=A0 name: OpenSSL FIPS Provider<br> =C2=A0=C2=A0=C2=A0=C2=A0 version: 3.6.1<br> =C2=A0=C2=A0=C2=A0=C2=A0 status: active<br> </font></span></p> <br> <br> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">--</font></span></= p> <p dir=3D"LTR"><span lang=3D"en-us"><font face=3D"Aptos">Work 1-914-945-241= 5</font></span></p> <br> </div> <p></p> -- <br> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org" target=3D"= _blank" rel=3D"noreferrer">openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org</a>.<br> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/SJ0PR15MB52787DE3EDD3BFEAA9D17D81F256A%40SJ0PR1= 5MB5278.namprd15.prod.outlook.com?utm_medium=3Demail&utm_source=3Dfoote= r" target=3D"_blank" rel=3D"noreferrer">https://groups.google.com/a/openssl= .org/d/msgid/openssl-users/SJ0PR15MB52787DE3EDD3BFEAA9D17D81F256A%40SJ0PR15= MB5278.namprd15.prod.outlook.com</a>.<br> </blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/CAJmL2NR5%2BnZk%2ByMgh3XTY-4jEgZEtv%2BJpCJKB-S4= A%2BqjsDMqfQ%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https= ://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAJmL2NR5%2BnZk%2B= yMgh3XTY-4jEgZEtv%2BJpCJKB-S4A%2BqjsDMqfQ%40mail.gmail.com</a>.<br /> --0000000000004048c3064df1e7fa--