[openssl.org #1706] FIPS-compliant OpenSSL for x86_64 platform

[David Woodhouse via RT]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Dear Sir or Madam!

 

We're implementing our own web-server intended to run on Win32 platform
and using OpenSSL for TLS/SSL support. We're obliged to be
FIPS-certified and we're using OpenSSL 0.9.7 with FIPS module for these
purposes. Recently, we were requested to support amd64 platform. I've
tried to build OpenSSL 0.9.8, but it failed to build successfully
neither with cross-compiler, nor with native x86_64 gcc compiler.
Anyway, I had to modify makefiles in both approaches.

 

Is there any method to build 64-bit version of FIPS-compliant OpenSSL?
Thank you!

 

Alexey Nevolin
Project Manager,
ScriptLogic Development Center, St. Petersburg, Russia

Contracted through Exigen Services

Alexey.Nevolin@...
[phone] x7112 Phone
[phone] FAX

 

Dear Sir or Madam!

 

We’re implementing our own web-server intended to run on Win32 platform and using OpenSSL for TLS/SSL support. We’re obliged to be FIPS-certified and we’re using OpenSSL 0.9.7 with FIPS module for these purposes. Recently, we were requested to support amd64 platform. I’ve tried to build OpenSSL 0.9.8, but it failed to build successfully neither with cross-compiler, nor with native x86_64 gcc compiler. Anyway, I had to modify makefiles in both approaches.

 

Is there any method to build 64-bit version of FIPS-compliant OpenSSL? Thank you!

 

Alexey Nevolin
Project Manager,
ScriptLogic Development Center, St. Petersburg, Russia

Contracted through Exigen Services

Alexey.Nevolin@...
[phone] x7112 Phone
[phone] FAX

 

[David Schwartz]

> We’re implementing our own web-server intended to run on Win32
> platform and using OpenSSL for TLS/SSL support. We’re obliged
> to be FIPS-certified and we’re using OpenSSL 0.9.7 with FIPS
> module for these purposes. Recently, we were requested to support
> amd64 platform. I’ve tried to build OpenSSL 0.9.8, but it failed
> to build successfully neither with cross-compiler, nor with
> native x86_64 gcc compiler. Anyway, I had to modify makefiles in
> both approaches.
 
> Alexey Nevolin

It's awfully hard to investigate a problem or find workarounds for a problem when the only description you have is "it failed to build successfully". Perhaps I could find a way to avoid the modifications you needed, except you don't tell me what they are.

Do you just like making people do extra work in order to help you? Yes, I could get to my amd64 Win32 machine, try the build process a few different ways, see what errors I get, then look for workarounds for them. But you've already done the first two steps, and making me redo them in order to help you seems like a complete waste of my time.

If you're developing a real application that requires FIPS compliance, surely spending an extra five minutes describing the actual problems you had, rather than making people guess and possibly solving problems other than the ones you are actually facing, would be a productive use of your time.

DS


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@...
Automated List Manager                           majordomo@...

[Brad House]

>> We’re implementing our own web-server intended to run on Win32
>> platform and using OpenSSL for TLS/SSL support. We’re obliged
>> to be FIPS-certified and we’re using OpenSSL 0.9.7 with FIPS
>> module for these purposes. Recently, we were requested to support
>> amd64 platform. I’ve tried to build OpenSSL 0.9.8, but it failed
>> to build successfully neither with cross-compiler, nor with
>> native x86_64 gcc compiler. Anyway, I had to modify makefiles in
>> both approaches.
>  
>> Alexey Nevolin
>
> It's awfully hard to investigate a problem or find workarounds for a problem when the only description you have is "it failed to build successfully". Perhaps I could find a way to avoid the modifications you needed, except you don't tell me what they are.
>
> Do you just like making people do extra work in order to help you? Yes, I could get to my amd64 Win32 machine, try the build process a few different ways, see what errors I get, then look for workarounds for them. But you've already done the first two steps, and making me redo them in order to help you seems like a complete waste of my time.
>
> If you're developing a real application that requires FIPS compliance, surely spending an extra five minutes describing the actual problems you had, rather than making people guess and possibly solving problems other than the ones you are actually facing, would be a productive use of your time.

Heh, well, if you know anything about the fips build process
on windows, you know FIPS-1.1.2 (based on OpenSSL 0.9.7) will
only compile for 32bit Windows since it requires the use of
Mingw/MSYS to build the fips canister.  Since Mingw/MSYS is
only available as a 32bit compiler (well, there are 64bit
snapshots now, but most likely the build scripts aren't aware
of that since FIPS 1.1 predates any 64bit mingw), you're not going
to get a 64bit windows binary with the currently validated FIPS
release.

The new FIPS-1.2.0 (based off OpenSSL 0.9.8) will supposedly be
fully buildable using Visual Studio 2005 (or higher I assume).
I haven't personally tried the snapshot available here:
ftp://ftp.openssl.org/snapshot/openssl-fips-test-1.2.0.tar.gz
But I know it was one of the primary features, and it should
also support 64bit Windows.  It's validation is not yet complete
so is not suitable for anything more than testing at this point
in time.

-Brad

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@...
Automated List Manager                           majordomo@...

[David Schwartz]

> Heh, well, if you know anything about the fips build process
> on windows, you know FIPS-1.1.2 (based on OpenSSL 0.9.7) will
> only compile for 32bit Windows since it requires the use of
> Mingw/MSYS to build the fips canister.  Since Mingw/MSYS is
> only available as a 32bit compiler (well, there are 64bit
> snapshots now, but most likely the build scripts aren't aware
> of that since FIPS 1.1 predates any 64bit mingw), you're not going
> to get a 64bit windows binary with the currently validated FIPS
> release.

Depending on how much OpenSSL functionality you need, it shouldn't be too
terribly hard to wrap a 32-bit library for use on a 64-bit platform by other
64-bit modules.

I have had to do the reverse in the past where I could only get OpenSSL to
build as a 64-bit library on some platform (Digital UNIX?) and my
application was not ready to compile on a 64-bit platform. It's made harder
by the fact that many OpenSSL 'functions' are really macros that pull guts
out of OpenSSL structures.

But if you can make a COM object or other kind of 'server' out of the
OpenSSL library, you should be able to use a 32-bit Win32 binary on a 64-bit
Win32 platform along with other 64-bit executables.

DS


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@...
Automated List Manager                           majordomo@...

[David Woodhouse via RT]

> We're implementing our own web-server intended to run on Win32 platform
> and using OpenSSL for TLS/SSL support. We're obliged to be
> FIPS-certified and we're using OpenSSL 0.9.7 with FIPS module for these
> purposes. Recently, we were requested to support amd64 platform. I've
> tried to build OpenSSL 0.9.8, but it failed to build successfully
> neither with cross-compiler, nor with native x86_64 gcc compiler.
> Anyway, I had to modify makefiles in both approaches.
>
>  
>
> Is there any method to build 64-bit version of FIPS-compliant OpenSSL?

Not for the moment. As mentioned on openssl-dev (see
http://marc.info/?t=121451378600008&r=1&w=2), validated 0.9.7-based code
does not support Win64 and never will. 0.9.8-based code does support
Win64, but it's not yet validated. I'm dismissing this case. A.


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@...
Automated List Manager                           majordomo@...

[Andy Polyakov]

> It's awfully hard to investigate a problem or find workarounds for a problem when the only description you have is "it failed to build successfully". Perhaps I could find a way to avoid the modifications you needed, except you don't tell me what they are.

Don't expect RT submitters to be subscribed to openssl-dev. Reply to
rt@... if you want them to "hear" you. A.
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@...
Automated List Manager                           majordomo@...