Public bug reported:
EC_KEY_generate_key() internally calls fips_pkey_signature_test() which
performs a pairwise check by ECDSA signing/verifying, but some groups
don't support ECDSA.
For example, `openssl ecparam -genkey -name Oakley-EC2N-4` fails.
Unfortunately `openssl ecparam` doesn't give any useful information so I
modified a bit:
~~~
diff --git a/apps/ecparam.c b/apps/ecparam.c
index 71b67f4..db89c2f 100644
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -585,6 +585,7 @@ int MAIN(int argc, char **argv)
if (!EC_KEY_generate_key(eckey)) {
EC_KEY_free(eckey);
+ ERR_print_errors(bio_err);
goto end;
}
if (outformat == FORMAT_ASN1)
~~~
And I got:
~~~
$ LD_LIBRARY_PATH=$(pwd)/target/lib ./target/bin/openssl ecparam -genkey -name
Oakley-EC2N-4
-----BEGIN EC PARAMETERS-----
BgA=
-----END EC PARAMETERS-----
140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no
inverse:bn_gcd.c:525:
140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no
inverse:bn_gcd.c:525:
140614096975512:error:2A067003:lib(42):ECDSA_sign_setup:BN lib:ecs_ossl.c:206:
140614096975512:error:2A06502A:lib(42):ECDSA_do_sign:reason(42):ecs_ossl.c:302:
140614096975512:error:2D079089:FIPS routines:fips_pkey_signature_test:test
failure:fips_post.c:166:
140614096975512:error:2D06A07F:FIPS routines:FIPS_CHECK_EC:pairwise test
failed:ec_key.c:249:
~~~
I'm using Ubuntu 16.04 and openssl 1.0.2g-1ubuntu4.1.
This was originally reported at Ruby's issue tracker:
https://bugs.ruby-lang.org/issues/12504
** Affects: openssl (Ubuntu)
Importance: Undecided
Status: New
** Tags: xenial
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1593953
Title:
EC_KEY_generate_key() causes FIPS self-test failure
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1593953/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
