John Firebaugh wrote:
When compiled with SSE2 optimizations (OPENSSL_IA32_SSE2), FIPS_mode_set fails on x86 CPUs without SSE or SSE2 support due to an explict check of bits 25 and 26 of OPENSSL_ia32cap. Is there a particular reason for this? I thought that all SSE2 optimizations were conditional on a runtime CPUID check via OPENSSL_ia32cap, so should work fine with or without SSE/SSE2 support. Why fail FIPS mode unconditionally?
You're referring to the as-yet-to-be validated v1.2 OpenSSl FIPS Object Module. You are correct that from a technical perspective SSE support could be optional. However, FIPS 140-2 imposes many non-technical considerations.
Since we were (as always) working with a limited budget for this validation we could only afford to test on a limited number of platforms (distinct code paths). Each platform test has an incremental cost of several thousand dollars. So for x86 we chose one platform as the no-asm case, and one with assembler optimizations including SSE/SSE2. We (my call, actually, I'll take the blame) chose to omit the case of non-SSE2 capable assembler, as three separate x86 platforms would have exceeded our budget.
On a non-SSE capable processor you'll have to use the no-asm version, sorry. Contributions to defray validation test lab fees are always welcome. -Steve M. -- Steve Marquess Open Source Software institute [EMAIL PROTECTED] ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
