OpenSSL 3.0 - Revision history

Matt at 12:36, 20 September 2021

2021-09-20T12:36:15Z

Mspncp: /* Completing the installation of the FIPS Module */

2021-05-02T13:05:03Z

Completing the installation of the FIPS Module

Richsalz: add ref to PR 14710

2021-04-30T14:44:22Z

add ref to PR 14710

Mspncp at 16:06, 27 April 2021

2021-04-27T16:06:42Z

Mspncp: Pimp the 'READ ME FIRST'

2021-04-27T16:03:53Z

Pimp the 'READ ME FIRST'

Mspncp: /* Completing the installation of the FIPS Module */

2021-04-27T15:51:02Z

Completing the installation of the FIPS Module

Richsalz: put text at front, to fix issue #14663

2021-04-27T14:53:46Z

put text at front, to fix issue #14663

Matt: /* Loading the FIPS module at the same time as other providers */

2021-03-18T12:08:12Z

Loading the FIPS module at the same time as other providers

Matt: /* Using the FIPS module in SSL/TLS */

2021-03-17T10:39:30Z

Using the FIPS module in SSL/TLS

Matt: /* Making all applications use the FIPS module by default */

2021-03-17T10:38:23Z

Making all applications use the FIPS module by default

@@ Line 1: / Line 1: @@
 __NUMBEREDHEADINGS__ <!-- https://www.mediawiki.org/wiki/Extension:NumberedHeadings -->
 '''READ ME FIRST:'''
-The project is planning on having a FIPS 140-2 (not 140-3) validated module which means that the schedule is driven by the NIST deadline for 140-2 which is near the end of September, 2021.
+This page is no longer being maintained. Refer instead to the OpenSSL 3.0 [https://www.openssl.org/docs/man3.0/man7/migration_guide.html migration guide] for the most up to date information.
 == Main Changes in OpenSSL 3.0 from OpenSSL 1.1.1 ==

← Older revision		Revision as of 13:05, 2 May 2021
Line 131:		Line 131:


−	~~'''Update:'''~~ Starting with OpenSSL 3.0.0 alpha16, no separate installation step for the FIPS module (a.k.a FIPS provider) is necessary anymore. It will be built and installed automatically if FIPS support has been configured. The ~~new~~ documentation can be ~~previewed~~ in the [https://github.com/openssl/openssl/blob/~~92010acff9e9e32b8c183079a70d164759eeb62a~~/README-FIPS.md README-FIPS] file ~~of pull request [https://github.com/openssl/openssl/pull/13684 #13684]. The documentation in~~ the ~~remaining section applies to alpha versions up to OpenSSL 3.0.0 alpha15~~.	+	Starting with OpenSSL 3.0.0 alpha16, no separate installation step for the FIPS module (a.k.a FIPS provider) is necessary anymore. It will be built and installed automatically if FIPS support has been configured. The current documentation can be found in the [https://github.com/openssl/openssl/blob/master/README-FIPS.md README-FIPS] file on the master branch.

		+	''The documentation in the remaining section applies to alpha versions up to OpenSSL 3.0.0 alpha15.''

	Once OpenSSL has been built and installed you will need to take explicit steps to complete the installation of the FIPS module (if you wish to use it). The OpenSSL 3.0 FIPS support is in the form of the FIPS provider which, on Unix, is in a `fips.so` file. On Windows this will be called `fips.dll`. Following installation of OpenSSL 3.0 the default location for this file is '/usr/local/lib/ossl-modules/fips.so' on Unix or 'C:\Program Files\OpenSSL\lib\ossl-modules\fips.dll' on Windows.		Once OpenSSL has been built and installed you will need to take explicit steps to complete the installation of the FIPS module (if you wish to use it). The OpenSSL 3.0 FIPS support is in the form of the FIPS provider which, on Unix, is in a `fips.so` file. On Windows this will be called `fips.dll`. Following installation of OpenSSL 3.0 the default location for this file is '/usr/local/lib/ossl-modules/fips.so' on Unix or 'C:\Program Files\OpenSSL\lib\ossl-modules\fips.dll' on Windows.

@@ Line 7: / Line 7: @@
 The project is planning on having a FIPS 140-2 (not 140-3) validated module which means that the schedule is driven by the NIST deadline for 140-2 which is near the end of September, 2021.
-The team is focused on development, and this page is somewhat out of date, in terms of content and schedule. It is expected that much of the content here will be in the FIPS, or other, documentation in the 3.0 release.
+The team is focused on development, and this page is somewhat out of date, in terms of content and schedule. It is expected that much of the content here will be in the FIPS, or other, documentation in the 3.0 release. This is being started in [https://github.com/openssl/openssl/pull/14710 PR 14710].
 The current list of items being worked on, can be found at their [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677 OpenSSL Project Kanban Board on ZenHub].

@@ Line 9: / Line 9: @@
 The team is focused on development, and this page is somewhat out of date, in terms of content and schedule. It is expected that much of the content here will be in the FIPS, or other, documentation in the 3.0 release.
-The current list of items being worked on, can be found at their [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677 OpenSSL Project Kanban Board on ZenHub]. You can also search GitHub issues for the list of [https://github.com/openssl/openssl/issues?q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+milestone%3A%223.0.0+beta1%22 items that must be done for 3.0 ("blockers")] and the list of [https://github.com/openssl/openssl/issues?page=1&q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+no%3Amilestone Items that are "nice to have" but not committed].
+The current list of items being worked on, can be found at their [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677 OpenSSL Project Kanban Board on ZenHub].
 == Main Changes in OpenSSL 3.0 from OpenSSL 1.1.1 ==

@@ Line 9: / Line 9: @@
 The team is focused on development, and this page is somewhat out of date, in terms of content and schedule. It is expected that much of the content here will be in the FIPS, or other, documentation in the 3.0 release.
-The current list of items being worked on, can be found at their Kanban board, [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677]. The list of items that must be done for 3.0 ("blockers") can be found at [https://github.com/openssl/openssl/issues?q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+milestone%3A%223.0.0+beta1%22]. The list of items that are "nice to have" but not committed can be found at [https://github.com/openssl/openssl/issues?page=1&q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+no%3Amilestone]
+The current list of items being worked on, can be found at their [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677 OpenSSL Project Kanban Board on ZenHub]. You can also search GitHub issues for the list of [https://github.com/openssl/openssl/issues?q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+milestone%3A%223.0.0+beta1%22 items that must be done for 3.0 ("blockers")] and the list of [https://github.com/openssl/openssl/issues?page=1&q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+no%3Amilestone Items that are "nice to have" but not committed].
 == Main Changes in OpenSSL 3.0 from OpenSSL 1.1.1 ==

← Older revision		Revision as of 15:51, 27 April 2021
Line 127:		Line 127:

	== Completing the installation of the FIPS Module ==		== Completing the installation of the FIPS Module ==
		+
		+
		+	'''Update:''' Starting with OpenSSL 3.0.0 alpha16, no separate installation step for the FIPS module (a.k.a FIPS provider) is necessary anymore. It will be built and installed automatically if FIPS support has been configured. The new documentation can be previewed in the [https://github.com/openssl/openssl/blob/92010acff9e9e32b8c183079a70d164759eeb62a/README-FIPS.md README-FIPS] file of pull request [https://github.com/openssl/openssl/pull/13684 #13684]. The documentation in the remaining section applies to alpha versions up to OpenSSL 3.0.0 alpha15.
		+

	Once OpenSSL has been built and installed you will need to take explicit steps to complete the installation of the FIPS module (if you wish to use it). The OpenSSL 3.0 FIPS support is in the form of the FIPS provider which, on Unix, is in a `fips.so` file. On Windows this will be called `fips.dll`. Following installation of OpenSSL 3.0 the default location for this file is '/usr/local/lib/ossl-modules/fips.so' on Unix or 'C:\Program Files\OpenSSL\lib\ossl-modules\fips.dll' on Windows.		Once OpenSSL has been built and installed you will need to take explicit steps to complete the installation of the FIPS module (if you wish to use it). The OpenSSL 3.0 FIPS support is in the form of the FIPS provider which, on Unix, is in a `fips.so` file. On Windows this will be called `fips.dll`. Following installation of OpenSSL 3.0 the default location for this file is '/usr/local/lib/ossl-modules/fips.so' on Unix or 'C:\Program Files\OpenSSL\lib\ossl-modules\fips.dll' on Windows.

← Older revision		Revision as of 14:53, 27 April 2021
Line 2:		Line 2:

	OpenSSL 3.0 is the next release of OpenSSL that is currently in development. This page is intended as a collection of notes for people downloading the alpha/beta releases or who are planning to upgrade from a previous version of OpenSSL to 3.0.		OpenSSL 3.0 is the next release of OpenSSL that is currently in development. This page is intended as a collection of notes for people downloading the alpha/beta releases or who are planning to upgrade from a previous version of OpenSSL to 3.0.
		+
		+	'''READ ME FIRST:'''
		+
		+	The project is planning on having a FIPS 140-2 (not 140-3) validated module which means that the schedule is driven by the NIST deadline for 140-2 which is near the end of September, 2021.
		+
		+	The team is focused on development, and this page is somewhat out of date, in terms of content and schedule. It is expected that much of the content here will be in the FIPS, or other, documentation in the 3.0 release.
		+
		+	The current list of items being worked on, can be found at their Kanban board, [https://app.zenhub.com/workspaces/300-beta-1-573bc8d2d31e1e9a73fff29f/board?repos=7634677]. The list of items that must be done for 3.0 ("blockers") can be found at [https://github.com/openssl/openssl/issues?q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+milestone%3A%223.0.0+beta1%22]. The list of items that are "nice to have" but not committed can be found at [https://github.com/openssl/openssl/issues?page=1&q=is%3Aopen+label%3A%22triaged%3A+OTC+evaluated%22+no%3Amilestone]

	== Main Changes in OpenSSL 3.0 from OpenSSL 1.1.1 ==		== Main Changes in OpenSSL 3.0 from OpenSSL 1.1.1 ==

@@ Line 398: / Line 398: @@
     EVP_set_default_properties(NULL, "fips=yes");
-If a fetch function has both an explicit property query specified, and a default property query is defined then the two queries are merged together and both apply. It is also possible for a locally specified property query to override the default properties.
+If a fetch function has both an explicit property query specified, and a default property query is defined then the two queries are merged together and both apply. The local property query overrides the default properties if the same property name is specified in both.
 There are two important built-in properties that you should be aware of:

@@ Line 495: / Line 495: @@
 === Using the FIPS module in SSL/TLS ===
-Writing an application that uses libssl in conjunction with the FIPS module is much the same as writing a normal libssl application. If you are using global properties and the default library context to specify usage of FIPS validated algorithms then this will happen automatically for all cryptographic algorithms in libssl. If you are using a non-default library context to load the FIPS provider then you can supply this to libssl using the function SSL_CTX_new_ex(). This works as a drop in replacement for the function SSL_CTX_new() except it provides you with the capability to specify the library context to be used. You can also use this same function to specify libssl specific properties to use.
+Writing an application that uses libssl in conjunction with the FIPS module is much the same as writing a normal libssl application. If you are using global properties and the default library context to specify usage of FIPS validated algorithms then this will happen automatically for all cryptographic algorithms in libssl. If you are using a non-default library context to load the FIPS provider then you can supply this to libssl using the function SSL_CTX_new_ex(). This works as a drop in replacement for the function SSL_CTX_new() except it provides you with the capability to specify the library context to be used. You can also use the same function to specify libssl specific properties to use.
 In this first example we create two SSL_CTX objects using two different library contexts.

@@ Line 287: / Line 287: @@
 One simple approach is to cause all applications that are using OpenSSL to only use the FIPS module for cryptographic algorithms by default.
-This approach can be done purely via configuration. As long as applications are built and linked against OpenSSL 3.0 and do not override the loading of the default config file or its settings then they will automatically start using the FIPS module without the need for any further code changes.
+This approach can be done purely via configuration. As long as applications are built and linked against OpenSSL 3.0 and do not override the loading of the default config file or its settings then they can automatically start using the FIPS module without the need for any further code changes.
 To do this the default OpenSSL config file will have to be modified. The location of this config file will depend on the platform, and any options that were given during the build process. You can check the location of the config file by running this command: