Openssl 3.0.8 Fips provider load via OSSL_PROVIDER_load takes long time > 2mins

[ramkumarpvs]

Hi,
The Openssl 3.0.8 FIPS provider loading takes long time ~2mins to load. We understand that it might need to run self tests but the install self tests KATS were run during install and also successful, even then the module load takes long time on every module load.

The following is the stack trace

#0  0x00007ffff5396b54 in read () from /lib64/libc.so.6
#1  0x00007ffff530900b in __GI__IO_file_xsgetn () from /lib64/libc.so.6
#2  0x00007ffff52fe0db in fread () from /lib64/libc.so.6
#3  0x00007fffe70d4491 in SL_RAND_bytes () from /usr/local/lib64/ossl-modules/fips.so
#4  0x00007fffe70d45bf in drbg_get_entropy () from /usr/local/lib64/ossl-modules/fips.so
#5  0x00007fffe70c64ec in fips_get_entropy () from /usr/local/lib64/ossl-modules/fips.so
#6  0x00007fffe70c66a4 in FIPS_drbg_instantiate () from /usr/local/lib64/ossl-modules/fips.so
#7  0x00007fffe70d472b in RAND_init_fips () from /usr/local/lib64/ossl-modules/fips.so
#8  0x00007fffe70d1f39 in do_fips_self_test_init_ossl_ () from /usr/local/lib64/ossl-modules/fips.so
#9  0x00007ffff6c4fe67 in __pthread_once_slow () from /lib64/libpthread.so.0
#10 0x00007fffe71745a9 in CRYPTO_THREAD_run_once () from /usr/local/lib64/ossl-modules/fips.so
#11 0x00007fffe70d2066 in SELF_TEST_post () from /usr/local/lib64/ossl-modules/fips.so
#12 0x00007fffe70d10ba in OSSL_provider_init_int () from /usr/local/lib64/ossl-modules/fips.so
#13 0x00007ffff70957ce in ossl_provider_activate () from /usr/local/lib64/libcrypto.so.3
#14 0x00007ffff7093506 in OSSL_PROVIDER_try_load () from /usr/local/lib64/libcrypto.so.3

The following is fipsmodule.cnf:

[root@localhost ~]# cat /usr/local/ssl/fipsmodule.cnf
[fips_sect]
#activate = 1
install-version = 1
conditional-errors = 1
security-checks = 1
module-mac = AE:13:68:F9:41:81:00:4B:DD:7D:AC:86:F7:E0:E4:CE:5C:DC:E9:C1:76:BD:51:02:87:D9:FE:B3:59:12:63:C9
install-mac = 41:9C:38:C2:8F:59:09:43:2C:AA:2F:58:36:2D:D9:04:F9:6C:56:8B:09:E0:18:3A:2E:D6:CC:69:05:04:E1:11
install-status = INSTALL_SELF_TEST_KATS_RUN

Appreciate any suggestions or steps to speed up the fips module loading.

[FdaSilvaYY]

Lack of entropy ?
Are you running it in a VM ?

[ramkumarpvs]

Yeah, it is a VM AlmaLinux 8.

[ramkumarpvs]

@FdaSilvaYY , isn't this not supported or doesn't work for VM's?

[t8m]

What is the SL_RAND_bytes() function in the stack trace? It is not present in pristine OpenSSL sources.

[ramkumarpvs]

Ah.. looks like from other vendor openssl routines

[t8m]

Then please report this to them.

[ramkumarpvs]

Yes, I raised a case there. Thanks. I think we can close this.