FIPS Library and Windows Mobile 6 - Revision history

Jwalton: Added FIPS category.

2014-03-12T11:36:28Z

Added FIPS category.

JEichenberger at 22:19, 27 January 2014

2014-01-27T22:19:49Z

JEichenberger: /* Testing the OpenSSL Libraries */

2014-01-27T22:07:21Z

Testing the OpenSSL Libraries

JEichenberger: /* Downloads */

2014-01-27T21:59:46Z

Downloads

JEichenberger: /* Troubleshooting OpenSSL builds for WM6 */

2014-01-27T21:18:53Z

Troubleshooting OpenSSL builds for WM6

JEichenberger: /* ceutils Downloads */

2014-01-27T20:48:40Z

ceutils Downloads

JEichenberger: /* Testing the OpenSSL Canister */

2014-01-27T20:46:22Z

Testing the OpenSSL Canister

JEichenberger at 20:33, 27 January 2014

2014-01-27T20:33:08Z

JEichenberger: /* Problem files */

2014-01-27T20:31:47Z

Problem files

JEichenberger: /* Checking Results */

2014-01-27T20:30:50Z

Checking Results

← Older revision		Revision as of 11:36, 12 March 2014
Line 172:		Line 172:
	*[https://sites.google.com/a/essemer.com.au/www/ceutils.zip ceutils.zip]: This is a set of executable files useful in testing results.		*[https://sites.google.com/a/essemer.com.au/www/ceutils.zip ceutils.zip]: This is a set of executable files useful in testing results.
	*[[Media:Fips-test.c\|fips-test.c]]: a test program to dump critical FIPS parameters that can also be used to test FIPS mode.		*[[Media:Fips-test.c\|fips-test.c]]: a test program to dump critical FIPS parameters that can also be used to test FIPS mode.
		+
		+	[[Category:FIPS 140]]

← Older revision		Revision as of 22:19, 27 January 2014
Line 159:		Line 159:

	{{TODO\|A more complete example might be helpful here}}		{{TODO\|A more complete example might be helpful here}}
		+
		+	== Caveats ==
		+
		+	*Just because one can build a FIPS canister together with FIPS capable OpenSSL libraries in no way means that the result meets NIST requirements as a FIPS validated program. One must carefully follow additional restrictions set forth in the User's Guide in order to take advantage of validation efforts for existing certified versions.
		+	*This document describes basic technical details required to build static libraries. Static libraries can be used by applications such as the test application so long as they are built with the proper SHA1 digest. Applications always load at the same virtual address, which makes it easy for them to use static libraries. Any program that does not consistently load at the same address, such as a Dynamic Link Library, cannot enable FIPS.
		+	*With great effort one can create Dynamic Link Libraries for OpenSSL that are FIPS capable. If in addition to that one can insure that libeay32.dll loads consistently at the same address and contains the proper FIPS digest, FIPS mode is then possible for any application that uses that solution, regardless where in memory that application may load.

	== Downloads ==		== Downloads ==

@@ Line 146: / Line 146: @@
 == Testing the OpenSSL Libraries ==
-{{TODO|This is incomplete}}
 == Downloads ==

← Older revision		Revision as of 21:59, 27 January 2014
Line 153:		Line 153:
	*[[Media:Build_WM6_OpenSSL-FIPS.tar.gz\|Build_WM6_OpenSSL-FIPS.tar.gz]]: The set of batch files and patch files used by these instructions.		*[[Media:Build_WM6_OpenSSL-FIPS.tar.gz\|Build_WM6_OpenSSL-FIPS.tar.gz]]: The set of batch files and patch files used by these instructions.
	*[https://sites.google.com/a/essemer.com.au/www/ceutils.zip ceutils.zip]: This is a set of executable files useful in testing results.		*[https://sites.google.com/a/essemer.com.au/www/ceutils.zip ceutils.zip]: This is a set of executable files useful in testing results.
		+	*[[Media:Fips-test.c\|fips-test.c]]: a test program to dump critical FIPS parameters that can also be used to test FIPS mode.

@@ Line 137: / Line 137: @@
 **The line that adds coredll.lib and others should not be dependent upon TARGETCPU x86.
-Also note that fips_standalone_sha1.exe is required for Windows Mobile builds, but is only provided by Windows XP builds.
+Also note that fips_standalone_sha1.exe is required for Windows Mobile builds, but is only provided by Windows XP builds.  Building that executable as part of the FIPS canister for XP may also be a challenge if you have a 64-bit OS.
 == Testing the OpenSSL Canister ==

← Older revision		Revision as of 20:48, 27 January 2014
Line 152:		Line 152:
	*[http://www.openssl.org/source/openssl-fips-2.0.5.tar.gz openssl-fips-2.0.5.tar.gz]: A recent version of the OpenSSL-FIPS source.		*[http://www.openssl.org/source/openssl-fips-2.0.5.tar.gz openssl-fips-2.0.5.tar.gz]: A recent version of the OpenSSL-FIPS source.
	*[[Media:Build_WM6_OpenSSL-FIPS.tar.gz\|Build_WM6_OpenSSL-FIPS.tar.gz]]: The set of batch files and patch files used by these instructions.		*[[Media:Build_WM6_OpenSSL-FIPS.tar.gz\|Build_WM6_OpenSSL-FIPS.tar.gz]]: The set of batch files and patch files used by these instructions.
		+	*[https://sites.google.com/a/essemer.com.au/www/ceutils.zip ceutils.zip]: This is a set of executable files useful in testing results.

@@ Line 13: / Line 13: @@
 Use the following commands to build the OpenSSL FIPS Object Module and OpenSSL FIPS Capable library.
 Before running the commands
-*download [https://sites.google.com/a/essemer.com.au/www/wcecompat-1.2.zip wcecompat-1.2.zip], [http://www.openssl.org/source/openssl-fips-2.0.5.tar.gz openssl-fips-2.0.5.tar.gz], [http://www.openssl.org/source/openssl-1.0.1e.tar.gz openssl-1.0.1e.tar.gz], and [[Media:Build_WM6_OpenSSL-FIPS.tar.gz|Build_WM6_OpenSSL-FIPS.tar.gz]]
+*download [https://sites.google.com/a/essemer.com.au/www/wcecompat-1.2.zip wcecompat-1.2.zip], [http://www.openssl.org/source/openssl-fips-2.0.5.tar.gz openssl-fips-2.0.5.tar.gz], and [[Media:Build_WM6_OpenSSL-FIPS.tar.gz|Build_WM6_OpenSSL-FIPS.tar.gz]]
 *place all files in the same directory (the 'root' directory mentioned below)
@@ Line 139: / Line 139: @@
 Also note that fips_standalone_sha1.exe is required for Windows Mobile builds, but is only provided by Windows XP builds.
 {{TODO|This is incomplete}}
 == Testing the OpenSSL Libraries ==
 == Downloads ==
 *[https://sites.google.com/a/essemer.com.au/www/wcecompat-1.2.zip wcecompat-1.2.zip]: This is the original source for wcecompat.  Although there is at least one newer version available, it is not recommended for use due to unresolved issues seen with that version.
 *[http://www.openssl.org/source/openssl-fips-2.0.5.tar.gz openssl-fips-2.0.5.tar.gz]: A recent version of the OpenSSL-FIPS source.
 *[[Media:Build_WM6_OpenSSL-FIPS.tar.gz|Build_WM6_OpenSSL-FIPS.tar.gz]]: The set of batch files and patch files used by these instructions.

@@ Line 121: / Line 121: @@
 **ssleay32.lib
-== Problem files ==
+== Troubleshooting OpenSSL builds for WM6 ==
 With most branches of OpenSSL code one must make changes before a successful build is possible for Windows Mobile 6.
-The first thing to try when having troubles compare files in the branch used against tips.  Most issues are already solved on tips.
+The first thing to try when having troubles compare files against tips.  Most issues are already solved on tips.
 Some of the files likely to have issues are:
 *apps\apps.c

@@ Line 115: / Line 115: @@
          fips_premain.c.sha1
 </pre>
-* As mentioned before, the OpenSSL build itself may not complete without additional work.  Once it does complete, however, you will find many executable files and PDB files in the out32_ARMV4I folder, including
+* As mentioned before, the OpenSSL build itself may not complete without additional work.  Once it does complete, however, you will find many executable files and PDB files in the out32_ARMV4I folder, together with a few LIB files.  Look for:
 **openssl.exe
 **libeaycompat32.lib