Bug 1735738
| Summary: | openssl speed reports errors in FIPS mode | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alicja Kario <hkario> |
| Component: | openssl | Assignee: | Tomas Mraz <tmraz> |
| Status: | CLOSED ERRATA | QA Contact: | Alicja Kario <hkario> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 8.0 | Keywords: | Triaged |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openssl-1.1.1c-6.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:51:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:1840 FEDORA-EPEL-2020-ff94ccbdec has been pushed to the Fedora EPEL 7 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: when running the `openssl speed` command on system running in FIPS mode, the command reports errors Version-Release number of selected component (if applicable): openssl-1.1.1c-2.el8.x86_64 How reproducible: always Steps to Reproduce: 1. set up FIPS mode 2. openssl speed Actual results: (snip) Doing 224 bits ecdh's for 10s: 84198 224-bits ECDH ops in 9.94s Doing 256 bits ecdh's for 10s: 157226 256-bits ECDH ops in 9.96s Doing 384 bits ecdh's for 10s: 8284 384-bits ECDH ops in 9.95s Doing 521 bits ecdh's for 10s: 19413 521-bits ECDH ops in 9.81s Unhandled error in the error queue during ECDH init. 139970670016320:error:0609D0C8:digital envelope routines:int_ctx_new:disabled for FIPS:crypto/evp/pmeth_lib.c:138: Doing 253 bits ecdh's for 10s: 411931797 253-bits ECDH ops in 9.97s WARNING: the error queue contains previous unhandled errors. 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: Unhandled error in the error queue during ECDH init. 139970670016320:error:0609D0C8:digital envelope routines:int_ctx_new:disabled for FIPS:crypto/evp/pmeth_lib.c:138: Doing 448 bits ecdh's for 10s: 400776096 448-bits ECDH ops in 9.94s 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: OpenSSL 1.1.1c FIPS 28 May 2019 built on: Mon Jun 24 13:15:33 2019 UTC options:bn(64,64) md2(char) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG -DPURIFY -DDEVRANDOM="\"/dev/urandom\"" -DSYSTEM_CIPHERS_FILE="/etc/crypto-policies/back-ends/openssl.config" The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes hmac(md5) 42151.11k 126880.09k 312663.52k 450171.50k 542830.70k 530830.60k sha1 103478.49k 262552.57k 509516.54k 699929.08k 769104.77k 765930.01k rc4 371795.88k 598807.05k 687879.61k 724652.41k 728834.24k 701908.21k des cbc 62560.81k 64217.23k 65017.81k 63241.62k 63679.70k 64943.74k des ede3 23557.37k 23918.16k 23636.08k 23589.11k 23413.18k 23831.27k idea cbc 74518.07k 75783.13k 79047.89k 79260.68k 82024.46k 81572.46k seed cbc 75904.01k 80627.24k 78925.23k 77464.91k 79736.38k 80972.03k rc2 cbc 42172.01k 42469.78k 42703.38k 43167.94k 42790.83k 42168.11k rc5-32/12 cbc 210960.66k 231633.10k 233243.65k 240993.03k 238809.21k 244932.58k blowfish cbc 107811.78k 113274.14k 116886.09k 117635.34k 115697.52k 117614.11k cast cbc 94527.58k 102846.07k 104941.79k 106425.79k 106130.38k 106033.59k aes-128 cbc 109133.36k 114201.36k 122301.51k 288228.60k 290161.74k 290508.11k aes-192 cbc 91781.84k 100695.90k 103267.82k 241397.83k 244472.28k 245551.78k aes-256 cbc 80761.26k 86668.20k 88390.96k 206870.34k 210894.52k 214794.79k camellia-128 cbc 86391.94k 130880.67k 152229.03k 161195.07k 163299.38k 160750.13k camellia-192 cbc 69853.55k 97102.37k 117003.99k 116708.51k 120203.22k 118961.59k camellia-256 cbc 73155.75k 105176.59k 115975.39k 119875.69k 119238.81k 116556.54k sha256 61003.50k 140422.87k 267733.28k 331425.21k 361801.22k 364480.13k sha512 43856.57k 173729.50k 303191.13k 454735.68k 525031.71k 532868.77k aes-128 ige 113114.78k 116745.44k 119773.09k 119387.06k 118477.14k 119718.27k aes-192 ige 94297.99k 100060.95k 98231.31k 101077.02k 100999.96k 101096.98k aes-256 ige 81821.27k 85599.12k 84341.73k 86299.91k 82741.95k 84366.60k ghash 1121803.36k 4322659.39k 7199497.83k 8936029.41k 9449800.78k 9107065.58k rand 8343.08k 31241.94k 101446.38k 214173.54k 335310.34k 341128.08k sign verify sign/s verify/s rsa 1024 bits 0.000110s 0.000007s 9113.7 138823.6 rsa 2048 bits 0.000729s 0.000022s 1371.4 45576.3 rsa 3072 bits 0.002255s 0.000045s 443.5 22260.8 rsa 4096 bits 0.005152s 0.000077s 194.1 12977.9 rsa 7680 bits 0.048077s 0.000261s 20.8 3837.0 rsa 15360 bits 0.242927s 0.000982s 4.1 1017.9 sign verify sign/s verify/s dsa 1024 bits 0.000129s 0.000095s 7731.4 10560.0 dsa 2048 bits 0.000315s 0.000271s 3170.5 3683.4 sign verify sign/s verify/s 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288: 224 bits ecdsa (nistp224) 0.0001s 0.0002s 13211.9 5612.6 256 bits ecdsa (nistp256) 0.0000s 0.0001s 34778.2 11782.1 384 bits ecdsa (nistp384) 0.0013s 0.0010s 788.6 1028.7 521 bits ecdsa (nistp521) 0.0004s 0.0008s 2416.6 1221.1 op op/s 224 bits ecdh (nistp224) 0.0001s 8470.6 256 bits ecdh (nistp256) 0.0001s 15785.7 384 bits ecdh (nistp384) 0.0012s 832.6 521 bits ecdh (nistp521) 0.0005s 1978.9 253 bits ecdh (X25519) 0.0000s 41317131.1 448 bits ecdh (X448) 0.0000s 40319526.8 Expected results: no errors printed Additional info: regression compared to RHEL-7, speed was not reporting errors there in FIPS mode