OpenSSL 3.0.1 configured with --with-rand-seed=os,getrandom,devrandom,rdcpu and enable-fips not sufficient for RAND_status to return 1

[biao-billy]

I am upgrading my app to use Curl 7.82.0 + OpenSSL 3.0.1 FIPS. With FIPS enabled, Curl did not initiate handshake because RAND_status() returns 0. You may reference the corresponding curl discussion.

This happens despite the fact that I configured the OpenSSL build with --with-rand-seed and specify all seeding methods supported by the FIPS provider.

My app runs in a RHEL 7 VM with the OS itself being fips enabled.

Please advise what could be the issue here.

TIA, Billy

Config output:

Command line (with current working directory = .):

    /usr/bin/perl ./Configure -fPIC enable-fips --with-rand-seed=os,getrandom,devrandom,rdcpu shared no-tests no-idea no-rc5 no-srp no-ec2m --prefix=/home/<user>/repo/<proj>/foss/openssl-3.0.1/dist --api=1.1.1 --libdir=lib

Perl information:

    /usr/bin/perl
    5.16.3 for x86_64-linux-thread-multi

Enabled features:

    acvp-tests
    aria
    asm
    async
    autoalginit
    autoerrinit
    autoload-config
    bf
    blake2
    bulk
    cached-fetch
    camellia
    capieng
    cast
    chacha
    cmac
    cmp
    cms
    comp
    ct
    deprecated
    des
    dgram
    dh
    dsa
    dso
    dtls
    dynamic-engine
    ec
    ecdh
    ecdsa
    engine
    err
    filenames
    fips
    fips-securitychecks
    gost
    legacy
    loadereng
    makedepend
    md4
    mdc2
    module
    multiblock
    nextprotoneg
    ocb
    ocsp
    padlockeng
    pic
    pinshared
    poly1305
    posix-io
    psk
    rc2
    rc4
    rdrand
    rfc3779
    rmd160
    scrypt
    secure-memory
    seed
    shared
    siphash
    siv
    sm2
    sm3
    sm4
    sock
    srtp
    sse2
    ssl
    ssl-trace
    static-engine
    stdio
    threads
    tls
    ts
    ui-console
    whirlpool
    tls1
    tls1-method
    tls1_1
    tls1_1-method
    tls1_2
    tls1_2-method
    tls1_3
    dtls1
    dtls1-method
    dtls1_2
    dtls1_2-method

Disabled features:

    afalgeng            [too-old-kernel] OPENSSL_NO_AFALGENG
    asan                [default]        OPENSSL_NO_ASAN
    buildtest-c++       [default]
    crypto-mdebug       [default]        OPENSSL_NO_CRYPTO_MDEBUG
    devcryptoeng        [default]        OPENSSL_NO_DEVCRYPTOENG
    ec2m                [option]         OPENSSL_NO_EC2M
    ec_nistp_64_gcc_128 [default]        OPENSSL_NO_EC_NISTP_64_GCC_128
    egd                 [default]        OPENSSL_NO_EGD
    external-tests      [default]        OPENSSL_NO_EXTERNAL_TESTS
    fuzz-afl            [default]        OPENSSL_NO_FUZZ_AFL
    fuzz-libfuzzer      [default]        OPENSSL_NO_FUZZ_LIBFUZZER
    idea                [option]         OPENSSL_NO_IDEA (skip crypto/idea)
    ktls                [default]        OPENSSL_NO_KTLS
    md2                 [default]        OPENSSL_NO_MD2 (skip crypto/md2)
    msan                [default]        OPENSSL_NO_MSAN
    rc5                 [option]         OPENSSL_NO_RC5 (skip crypto/rc5)
    sctp                [default]        OPENSSL_NO_SCTP
    srp                 [option]         OPENSSL_NO_SRP (skip crypto/srp)
    tests               [option]         OPENSSL_NO_TESTS
    trace               [default]        OPENSSL_NO_TRACE
    ubsan               [default]        OPENSSL_NO_UBSAN
    unit-test           [default]        OPENSSL_NO_UNIT_TEST
    uplink              [no uplink_arch] OPENSSL_NO_UPLINK
    weak-ssl-ciphers    [default]        OPENSSL_NO_WEAK_SSL_CIPHERS
    zlib                [default]
    zlib-dynamic        [default]
    ssl3                [default]        OPENSSL_NO_SSL3
    ssl3-method         [default]        OPENSSL_NO_SSL3_METHOD

Config target attributes:

    AR => "ar",
    ARFLAGS => "qc",
    CC => "gcc",
    CFLAGS => "-Wall -O3",
    CXX => "g++",
    CXXFLAGS => "-Wall -O3",
    HASHBANGPERL => "/usr/bin/env perl",
    RANLIB => "ranlib",
    RC => "windres",
    asm_arch => "x86_64",
    bn_ops => "SIXTY_FOUR_BIT_LONG",
    build_file => "Makefile",
    build_scheme => [ "unified", "unix" ],
    cflags => "-pthread -m64",
    cppflags => "",
    cxxflags => "-std=c++11 -pthread -m64",
    defines => [ "OPENSSL_BUILDING_OPENSSL" ],
    disable => [  ],
    dso_ldflags => "-Wl,-z,defs",
    dso_scheme => "dlfcn",
    enable => [ "afalgeng" ],
    ex_libs => "-ldl -pthread",
    includes => [  ],
    lflags => "",
    lib_cflags => "",
    lib_cppflags => "-DOPENSSL_USE_NODELETE -DL_ENDIAN",
    lib_defines => [  ],
    module_cflags => "-fPIC",
    module_cxxflags => undef,
    module_ldflags => "-Wl,-znodelete -shared -Wl,-Bsymbolic",
    multilib => "64",
    perl_platform => "Unix",
    perlasm_scheme => "elf",
    shared_cflag => "-fPIC",
    shared_defflag => "-Wl,--version-script=",
    shared_defines => [  ],
    shared_ldflag => "-Wl,-znodelete -shared -Wl,-Bsymbolic",
    shared_rcflag => "",
    shared_sonameflag => "-Wl,-soname=",
    shared_target => "linux-shared",
    thread_defines => [  ],
    thread_scheme => "pthreads",
    unistd => "<unistd.h>",

Recorded environment:

    AR =
    BUILDFILE =
    CC =
    CFLAGS =
    CPPFLAGS =
    CROSS_COMPILE =
    CXX =
    CXXFLAGS =
    HASHBANGPERL =
    LDFLAGS =
    LDLIBS =
    OPENSSL_LOCAL_CONFIG_DIR =
    PERL =
    RANLIB =
    RC =
    RCFLAGS =
    WINDRES =
    __CNF_CFLAGS =
    __CNF_CPPDEFINES =
    __CNF_CPPFLAGS =
    __CNF_CPPINCLUDES =
    __CNF_CXXFLAGS =
    __CNF_LDFLAGS =
    __CNF_LDLIBS =

Makevars:

    AR              = ar
    ARFLAGS         = qc
    CC              = gcc
    CFLAGS          = -Wall -O3 -fPIC
    CPPDEFINES      =
    CPPFLAGS        =
    CPPINCLUDES     =
    CXX             = g++
    CXXFLAGS        = -Wall -O3 -fPIC
    HASHBANGPERL    = /usr/bin/env perl
    LDFLAGS         =
    LDLIBS          =
    PERL            = /usr/bin/perl
    RANLIB          = ranlib
    RC              = windres
    RCFLAGS         =

NOTE: These variables only represent the configuration view.  The build file
template may have processed these variables further, please have a look at the
build file for more exact data:
    Makefile

build file:

    Makefile

build file templates:

    Configurations/common0.tmpl
    Configurations/unix-Makefile.tmpl

[paulidale]

The FIPS provide does not support any seed sources. Everything comes from libcrypto. The problem should be identical without FIPS . If it isn't, I suspect there is a provider loading issue. Calling EVP_default_properties_enable_fips() does not load the FIPS provider, it just mandates it use.

If the problem exists outside of the FIPS, could you please give us the OpenSSL error stack after the problem occurs?

[biao-billy]

Hi @paulidale,

By reading the INSTALL.md in the OpenSSL 3.0.1 source, seed sources that are not supported by the FIPS provider are explicitly called out with "This source is ignored by the FIPS provider". Example:

### egd

Check for an entropy generating daemon.
This source is ignored by the FIPS provider.

### rdcpu

Use the `RDSEED` or `RDRAND` command if provided by the CPU.

### librandom

Use librandom (not implemented yet).
This source is ignored by the FIPS provider.

So I am quite surprised to learn FIPS provider does not support any seed sources.

The problem does not exist outside of FIPS (at least not in the context of LibCurl) - without calling EVP_default_properties_enable_fips(), my app works fine.

In the context of LibCurl, the failure of "Insufficient randomness" is in this code block. Note rand_enough() is a thin wrapper of RAND_status()

static CURLcode ossl_seed(struct Curl_easy *data)
{
  /* This might get called before it has been added to a multi handle */
  if(data->multi && data->multi->ssl_seeded)
    return CURLE_OK;

  if(rand_enough()) {
    /* OpenSSL 1.1.0+ should return here */
    if(data->multi)
      data->multi->ssl_seeded = TRUE;
    return CURLE_OK;
  }
#ifdef HAVE_RANDOM_INIT_BY_DEFAULT
  /* with OpenSSL 1.1.0+, a failed RAND_status is a showstopper */
  failf(data, "Insufficient randomness");
  return CURLE_SSL_CONNECT_ERROR;
#else

Can you please elaborate on what you meant by a "provider loading issue"? And what might have caused it?

Thanks, Billy

[paulidale]

Like I wrote, the FIPS provider has no entropy sources. NIST changed the rules late in the game and it was deemed better to use an external entropy source (with caveat) than to try to get anything to pass the newly introduced mandatory testing. This is what was done. The FIPS provider calls back into libcrypto to gather its entropy.

My guess is that you are not correctly loading the FIPS provider and calling EVP_default_properties_enable_fips() mandates it use -- i.e. you are not finding any algorithms. My suggestion would be to set up a configuration file that loads the FIPS and base providers or to do the same manually. This is all well covered in the migration guide man page.

[biao-billy]

I did read thru the migration guide, but failed to see why the following code isn't sufficient. The function was invoked before libcurl transfer, and it succeeded.

bool OPENSSL_FIPS_CONTROL::enable_fips_mode() {

    if (!EVP_default_properties_is_fips_enabled(NULL)) {
        EVP_set_default_properties(NULL, "fips=yes");
        EVP_set_default_properties(NULL, "provider=fips");
        if (!EVP_default_properties_enable_fips(NULL, 1)) {
            SvcLog(LEVEL_ERROR, "Failed to enter FIPS mode; error code = %lu\n", ERR_get_error());
            return false;
        } else {
            SvcLog(LEVEL_INFO, "Entered FIPS mode successfully.\n");
        }
    } else {
        SvcLog(LEVEL_VERBOSE, "FIPS mode has already been enabled.\n");
    }

    return true;
}

I'll read again. At the mean time, more hints are appreciated.

[beldmit]

You also need to load the fips provider. Usually it's done via the configuration file.

[biao-billy]

Thanks @beldmit.

The code base (which I am migrating from 1.0.2 fips to 3.0.1 fips) does not use config file. I just found out OSSL_PROVIDER_available(NULL, "fips") is returning 0. So my app doesn't even think fips provider is available for loading. And OSSL_PROVIDER_load() did fail.

In OpenSSL 3.0, must I use config file to convey the fact that the provider is available? Is there a programatic way to do so?

I have fips.so in LD_LIBRARY_PATH.

Billy

[beldmit]

If you use Linux, try strace to see where your application looks for fips.so

[biao-billy]

I found the OSSL_PROVIDER_set_default_search_path API, called it with the path to my fips.so location. But OSSL_PROVIDER_available(NULL, "fips") still don't think it's available.

I think I'll create another issue and continue the inquiry over there..

[biao-billy]

It's pretty clear from the FIPS module guide that config file is required even if FIPS module is to be loaded explicitly.

Applications may choose to load the FIPS provider explicitly rather than relying on config to do this. The config file is still necessary in order to hold the FIPS module config data (such as its self test status and integrity data)

Closing this issue. Thanks all.

[paulidale]

        EVP_set_default_properties(NULL, "fips=yes");
        EVP_set_default_properties(NULL, "provider=fips");
        if (!EVP_default_properties_enable_fips(NULL, 1)) {

The first two of these lines to nothing, the third replaces the default properties.

Also forcing "provider=fips" will prevent access to the encode/decode routines so loading things from file will then fail.

To load without config, you'll want something like these two:
PROVIDER_load(NULL, "fips");
PROVIDER_load(NULL, "base");
but the FIPS provider will need its checksum etc in a config file.