group.of.nepali.translators team mailing list archive

[Chris J Arges <1593953@xxxxxxxxxxxxxxxxxx>]

Hello Kazuki, or anyone else affected,

Accepted openssl into xenial-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/openssl/1.0.2g-
1ubuntu4.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
enable and use -proposed.  Your feedback will aid us getting this update
out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, and change the tag
from verification-needed to verification-done. If it does not fix the
bug for you, please add a comment stating that, and change the tag to
verification-failed.  In either case, details of your testing will help
us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Also affects: openssl (Ubuntu Xenial)
   Importance: Undecided
       Status: New

** Changed in: openssl (Ubuntu Xenial)
       Status: New => Fix Committed

** Tags added: verification-needed

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1593953

Title:
  EC_KEY_generate_key() causes FIPS self-test failure

Status in openssl package in Ubuntu:
  Fix Released
Status in openssl source package in Xenial:
  Fix Committed

Bug description:
  EC_KEY_generate_key() internally calls fips_pkey_signature_test()
  which performs a pairwise check by ECDSA signing/verifying, but some
  groups don't support ECDSA.

  For example, `openssl ecparam -genkey -name Oakley-EC2N-4` fails.
  Unfortunately `openssl ecparam` doesn't give any useful information so
  I modified a bit:

  ~~~
  diff --git a/apps/ecparam.c b/apps/ecparam.c
  index 71b67f4..db89c2f 100644
  --- a/apps/ecparam.c
  +++ b/apps/ecparam.c
  @@ -585,6 +585,7 @@ int MAIN(int argc, char **argv)
   
           if (!EC_KEY_generate_key(eckey)) {
               EC_KEY_free(eckey);
  +            ERR_print_errors(bio_err);
               goto end;
           }
           if (outformat == FORMAT_ASN1)
  ~~~

  And I got:

  ~~~
  $ LD_LIBRARY_PATH=$(pwd)/target/lib ./target/bin/openssl ecparam -genkey -name Oakley-EC2N-4
  -----BEGIN EC PARAMETERS-----
  BgA=
  -----END EC PARAMETERS-----
  140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no inverse:bn_gcd.c:525:
  140614096975512:error:0306E06C:bignum routines:BN_mod_inverse:no inverse:bn_gcd.c:525:
  140614096975512:error:2A067003:lib(42):ECDSA_sign_setup:BN lib:ecs_ossl.c:206:
  140614096975512:error:2A06502A:lib(42):ECDSA_do_sign:reason(42):ecs_ossl.c:302:
  140614096975512:error:2D079089:FIPS routines:fips_pkey_signature_test:test failure:fips_post.c:166:
  140614096975512:error:2D06A07F:FIPS routines:FIPS_CHECK_EC:pairwise test failed:ec_key.c:249:
  ~~~

  I'm using Ubuntu 16.04 and openssl 1.0.2g-1ubuntu4.1.

  
  This was originally reported at Ruby's issue tracker:

  https://bugs.ruby-lang.org/issues/12504

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1593953/+subscriptions