On Tue, Nov 05, 2013, [email protected] wrote: > I updated my local source tree with the "PBKDF2 should be efficient. [...]" > changes in the OpenSSL_1_0_1-stable branch, and when I generate an RSA key > pair in FIPS mode, it cores. > > # setenv OPENSSL_FIPS 1 > # openssl genrsa -out ./mykey -des3 2048 > Generating RSA private key, 2048 bit long modulus > ...............+++ > ..............................+++ > e is 65537 (0x10001) > Enter pass phrase for ./mykey: > Verifying - Enter pass phrase for ./mykey: > Segmentation fault (core dumped) > > If I revert those changes, it works as expected: > > # openssl genrsa -out ./mykey -des3 2048 > Generating RSA private key, 2048 bit long modulus > ...............+++ > ..............................+++ > e is 65537 (0x10001) > Enter pass phrase for ./mykey: > Verifying - Enter pass phrase for ./mykey: > # > > > I'm still investigating here to rule out anything I may have done to > introduce a problem, but it looks like a regression so far. >
It was due to an uninitialised context being passed to HMAC_Init_ex() and would affect non-FIPS builds too. I've just commited a fix. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
