Hello Kazuki, or anyone else affected, Accepted openssl into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssl/1.0.2g- 1ubuntu4.3 in a few hours, and then in the -proposed repository.
Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance! ** Also affects: openssl (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: openssl (Ubuntu Xenial) Status: New => Fix Committed ** Tags added: verification-needed -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1593953 Title: EC_KEY_generate_key() causes FIPS self-test failure Status in openssl package in Ubuntu: Fix Released Status in openssl source package in Xenial: Fix Committed Bug description: EC_KEY_generate_key() internally calls fips_pkey_signature_test() which performs a pairwise check by ECDSA signing/verifying, but some groups don't support ECDSA. For example, `openssl ecparam -genkey -name Oakley-EC2N-4` fails. Unfortunately `openssl ecparam` doesn't give any useful information so I modified a bit: ~~~ diff --git a/apps/ecparam.c b/apps/ecparam.c index 71b67f4..db89c2f 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -585,6 +585,7 @@ int MAIN(int argc, char **argv) if (!EC_KEY_generate_key(eckey)) { EC_KEY_free(eckey); + ERR_print_errors(bio_err); goto end; } if (outformat == FORMAT_ASN1) ~~~ And I got: ~~~ $ LD_LIBRARY_PATH=$(pwd)/target/lib ./target/bin/openssl ecparam -genkey -name Oakley-EC2N-4 -----BEGIN EC PARAMETERS----- BgA= -----END EC PARAMETERS----- 140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no inverse:bn_gcd.c:525: 140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no inverse:bn_gcd.c:525: 140614096975512:error:2A067003:lib(42):ECDSA_sign_setup:BN lib:ecs_ossl.c:206: 140614096975512:error:2A06502A:lib(42):ECDSA_do_sign:reason(42):ecs_ossl.c:302: 140614096975512:error:2D079089:FIPS routines:fips_pkey_signature_test:test failure:fips_post.c:166: 140614096975512:error:2D06A07F:FIPS routines:FIPS_CHECK_EC:pairwise test failed:ec_key.c:249: ~~~ I'm using Ubuntu 16.04 and openssl 1.0.2g-1ubuntu4.1. This was originally reported at Ruby's issue tracker: https://bugs.ruby-lang.org/issues/12504 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1593953/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : [email protected] Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
