Description of problem: When testing on s390x in FIPS mode on RHEL5.5 openssl fails: # prelink -u -a prelink: /usr/bin/sprof: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/gencat: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/getent: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/locale: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/iconv: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/rpcgen: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/localedef: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/bin/getconf: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/sbin/iconvconfig.s390x: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/sbin/rpcinfo: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/sbin/iconvconfig: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/sbin/zdump: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/sbin/zic: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker prelink: /usr/libexec/getconf/POSIX_V6_LP64_OFF64: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker # export OPENSSL_FIPS=1 # openssl speed aes-256-cbc fips.c(151): OpenSSL internal error, assertion failed: FATAL FIPS SELFTEST FAILURE Aborted # echo $? 134 Version-Release number of selected component (if applicable): openssl-0.9.8e-12.el5_4.6 How reproducible: 100% Steps to Reproduce: openssl speed aes-256-cbc openssl speed rsa512 openssl speed rsa4096 openssl speed rsa openssl speed des openssl speed blowfish openssl speed sha1 openssl speed sha256 all encryption methods fail Actual results: Error Expected results: No error (for FIPS supported encryptions) Additional info: Tested only on s390x
With enabled ibmca engine i get the folowing error: # openssl engine -c -tt (dynamic) Dynamic engine loading support [ unavailable ] (ibmca) Ibmca hardware engine support [RSA, DSA, DH, RAND, DES-ECB, DES-CBC, DES-EDE3, DES-EDE3-CBC, AES-128-ECB, AES-128-CBC, AES-192-ECB, AES-192-CBC, AES-256-ECB, AES-256-CBC, SHA1, SHA256] [ available ] # openssl speed -evp aes-128-cbc internal error loading RSA key number 0 1851:error:0406A08D:rsa routines:RSA_new_method:non fips method:rsa_eng.c:183: 1851:error:0D079064:asn1 encoding routines:ASN1_ITEM_EX_COMBINE_NEW:aux error:tasn_new.c:221: 1851:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:402:Type=RSA Note: Both of the errors (in description and the above) appear ONLY when machine is FIPS mode. In none FIPS mode openssl speed shows significant performance gain (ibmca is really used)
openssl speed is not working in the FIPS mode and I think it is not an important bug to fix - the same code is used in FIPS and non-FIPS modes so anyone who wants to benchmark the speed can switch to non-FIPS mode. However the error with the ibmca engine is different. The question with it is though whether the ibmca engine + the HW is FIPS certified or not. If it is, the ibmca engine should be modified to set the RSA_FLAG_FIPS_METHOD on its RSA implementation method. If it is not certified, it means the ibmca engine simply has to be disabled by the administrator in the FIPS mode. Reassigning.
Hello, at this point of time is openssl-ibmca and the underlying crypto HW not completely FIPS certified, but we are working on it. Till the work is finished we should have in RHEL fips_mode=no and ibmca engine on. IBM will request (via standard feature request) to RH a change of this setting as soon as we are with SW and HW FIPS certified. Kind regards, Gonzalo.
This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug.
Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in RHEL5 stream. If the issue is critical for your business, please provide additional business justification through the appropriate support channels (https://access.redhat.com/site/support).