openssl usage for fips provider

[sanumesh]

Hello

Can you please let me know if this an usage issue or a bug in openssl command line when multiple providers are listed, and we try to use fips provider:

I am checking this on OpenSSL 3.0.13 version with configuration as:
./Configure aix-cc enable-fips
make
make install

With only default provider, it works fine:
#/usr/local/bin/openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.0.13
status: active
#/usr/local/bin/openssl md5 test.txt
MD5(test.txt)= f5ac8127b3b6b85cdc13f237c6005d80

With only FIPS provider, it works fine:
#/usr/local/bin/openssl list -providers
Providers:
fips
name: OpenSSL FIPS Provider
version: 3.0.13
status: active
#/usr/local/bin/openssl md5 -provider fips test.txt
md5: Unknown option or message digest: md5
md5: Use -help for summary.
00000001:error:0308010C:digital envelope routines:(unknown function):unsupported:crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (md5 : 102), Properties ()
Command is expected to fail as MD5 is not FIPS approved

With both default and FIPS provider:
#/usr/local/bin/openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.0.13
status: active
fips
name: OpenSSL FIPS Provider
version: 3.0.13
status: active
#/usr/local/bin/openssl md5 -provider fips test.txt
MD5(test.txt)= f5ac8127b3b6b85cdc13f237c6005d80
With -provider fips option, I expected command to give error, however it works fine.

Can you please let me know if this usage issue or a bug?

Thanks

[mattcaswell]

With both default and FIPS provider:
#/usr/local/bin/openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.0.13
status: active
fips
name: OpenSSL FIPS Provider
version: 3.0.13
status: active

My assumption is that, in order to get this result, you have created a config file that explicitly loads and activates both the default and fips providers.

#/usr/local/bin/openssl md5 -provider fips test.txt
MD5(test.txt)= f5ac8127b3b6b85cdc13f237c6005d80
With -provider fips option, I expected command to give error, however it works fine.

On the above assumption, and you are using the same config file, then this is the expected behaviour. The config file load and activates both the default and fips providers. You explicitly also load the fips provider via command line - but this has no effect because it was already loaded via config - and it does not suppress the already loaded default provider.

[sanumesh]

Thanks Matt.

Yes, I used the config file to load and activate both default and fips.
But should this behavior of loading all the providers be changed ?

I mean, through config file we can have multiple providers activated. But I think, when we execute the openssl command and specify to use a particular provider through the -provider option, then it should be given preference than what is mentioned in the configuration file and only that mentioned command line provider be loaded ?

If I were ask this differently, in case if we have multiple providers activated through config file, then how can we specify openssl command line to use and load a particular provider ?

Thanks

[mattcaswell]

But should this behavior of loading all the providers be changed ?

I don't think so. Most people want the config file they specify to be loaded and used - so it makes sense to me that it should do that. The "-provider" option is "additive" in that you get the option to add extra providers to those already loaded via config. If you don't want the config to be used, then you should specify a different config file. Plausibly I could see an option being added which is "unload all other providers" or something - but that might be quite tricky to get right.

If I were ask this differently, in case if we have multiple providers activated through config file, then how can we specify openssl command line to use and load a particular provider ?

Use a different config file that only configures the fips provider but does not activate it or the default provider. Use that config file for the command line and specify the providers you want explicitly via "-provider".