RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1735738 - openssl speed reports errors in FIPS mode
Summary: openssl speed reports errors in FIPS mode
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: openssl
Version: 8.0
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Alicja Kario
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-08-01 11:29 UTC by Alicja Kario
Modified: 2020-05-29 00:56 UTC (History)
0 users

Fixed In Version: openssl-1.1.1c-6.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-04-28 16:51:58 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:1840 0 None None None 2020-04-28 16:52:16 UTC

Description Alicja Kario 2019-08-01 11:29:04 UTC
Description of problem:
when running the `openssl speed` command on system running in FIPS mode, the command reports errors

Version-Release number of selected component (if applicable):
openssl-1.1.1c-2.el8.x86_64

How reproducible:
always

Steps to Reproduce:
1. set up FIPS mode
2. openssl speed

Actual results:
(snip)
Doing 224 bits  ecdh's for 10s: 84198 224-bits ECDH ops in 9.94s
Doing 256 bits  ecdh's for 10s: 157226 256-bits ECDH ops in 9.96s
Doing 384 bits  ecdh's for 10s: 8284 384-bits ECDH ops in 9.95s
Doing 521 bits  ecdh's for 10s: 19413 521-bits ECDH ops in 9.81s
Unhandled error in the error queue during ECDH init.
139970670016320:error:0609D0C8:digital envelope routines:int_ctx_new:disabled for FIPS:crypto/evp/pmeth_lib.c:138:
Doing 253 bits  ecdh's for 10s: 411931797 253-bits ECDH ops in 9.97s
WARNING: the error queue contains previous unhandled errors.
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
Unhandled error in the error queue during ECDH init.
139970670016320:error:0609D0C8:digital envelope routines:int_ctx_new:disabled for FIPS:crypto/evp/pmeth_lib.c:138:
Doing 448 bits  ecdh's for 10s: 400776096 448-bits ECDH ops in 9.94s
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
OpenSSL 1.1.1c FIPS  28 May 2019
built on: Mon Jun 24 13:15:33 2019 UTC
options:bn(64,64) md2(char) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG -DPURIFY -DDEVRANDOM="\"/dev/urandom\"" -DSYSTEM_CIPHERS_FILE="/etc/crypto-policies/back-ends/openssl.config"
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
hmac(md5)        42151.11k   126880.09k   312663.52k   450171.50k   542830.70k   530830.60k
sha1            103478.49k   262552.57k   509516.54k   699929.08k   769104.77k   765930.01k
rc4             371795.88k   598807.05k   687879.61k   724652.41k   728834.24k   701908.21k
des cbc          62560.81k    64217.23k    65017.81k    63241.62k    63679.70k    64943.74k
des ede3         23557.37k    23918.16k    23636.08k    23589.11k    23413.18k    23831.27k
idea cbc         74518.07k    75783.13k    79047.89k    79260.68k    82024.46k    81572.46k
seed cbc         75904.01k    80627.24k    78925.23k    77464.91k    79736.38k    80972.03k
rc2 cbc          42172.01k    42469.78k    42703.38k    43167.94k    42790.83k    42168.11k
rc5-32/12 cbc   210960.66k   231633.10k   233243.65k   240993.03k   238809.21k   244932.58k
blowfish cbc    107811.78k   113274.14k   116886.09k   117635.34k   115697.52k   117614.11k
cast cbc         94527.58k   102846.07k   104941.79k   106425.79k   106130.38k   106033.59k
aes-128 cbc     109133.36k   114201.36k   122301.51k   288228.60k   290161.74k   290508.11k
aes-192 cbc      91781.84k   100695.90k   103267.82k   241397.83k   244472.28k   245551.78k
aes-256 cbc      80761.26k    86668.20k    88390.96k   206870.34k   210894.52k   214794.79k
camellia-128 cbc    86391.94k   130880.67k   152229.03k   161195.07k   163299.38k   160750.13k
camellia-192 cbc    69853.55k    97102.37k   117003.99k   116708.51k   120203.22k   118961.59k
camellia-256 cbc    73155.75k   105176.59k   115975.39k   119875.69k   119238.81k   116556.54k
sha256           61003.50k   140422.87k   267733.28k   331425.21k   361801.22k   364480.13k
sha512           43856.57k   173729.50k   303191.13k   454735.68k   525031.71k   532868.77k
aes-128 ige     113114.78k   116745.44k   119773.09k   119387.06k   118477.14k   119718.27k
aes-192 ige      94297.99k   100060.95k    98231.31k   101077.02k   100999.96k   101096.98k
aes-256 ige      81821.27k    85599.12k    84341.73k    86299.91k    82741.95k    84366.60k
ghash          1121803.36k  4322659.39k  7199497.83k  8936029.41k  9449800.78k  9107065.58k
rand              8343.08k    31241.94k   101446.38k   214173.54k   335310.34k   341128.08k
                  sign    verify    sign/s verify/s
rsa 1024 bits 0.000110s 0.000007s   9113.7 138823.6
rsa 2048 bits 0.000729s 0.000022s   1371.4  45576.3
rsa 3072 bits 0.002255s 0.000045s    443.5  22260.8
rsa 4096 bits 0.005152s 0.000077s    194.1  12977.9
rsa 7680 bits 0.048077s 0.000261s     20.8   3837.0
rsa 15360 bits 0.242927s 0.000982s      4.1   1017.9
                  sign    verify    sign/s verify/s
dsa 1024 bits 0.000129s 0.000095s   7731.4  10560.0
dsa 2048 bits 0.000315s 0.000271s   3170.5   3683.4
                              sign    verify    sign/s verify/s
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
139970670016320:error:06099096:digital envelope routines:EVP_PKEY_derive:operation not supported for this keytype:crypto/evp/pmeth_fn.c:288:
 224 bits ecdsa (nistp224)   0.0001s   0.0002s  13211.9   5612.6
 256 bits ecdsa (nistp256)   0.0000s   0.0001s  34778.2  11782.1
 384 bits ecdsa (nistp384)   0.0013s   0.0010s    788.6   1028.7
 521 bits ecdsa (nistp521)   0.0004s   0.0008s   2416.6   1221.1
                              op      op/s
 224 bits ecdh (nistp224)   0.0001s   8470.6
 256 bits ecdh (nistp256)   0.0001s  15785.7
 384 bits ecdh (nistp384)   0.0012s    832.6
 521 bits ecdh (nistp521)   0.0005s   1978.9
 253 bits ecdh (X25519)   0.0000s 41317131.1
 448 bits ecdh (X448)   0.0000s 40319526.8

Expected results:
no errors printed

Additional info:
regression compared to RHEL-7, speed was not reporting errors there in FIPS mode

Comment 5 errata-xmlrpc 2020-04-28 16:51:58 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:1840

Comment 6 Fedora Update System 2020-05-29 00:56:53 UTC
FEDORA-EPEL-2020-ff94ccbdec has been pushed to the Fedora EPEL 7 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.