84 lines
2.6 KiB
Text
84 lines
2.6 KiB
Text
Brief instructions on using OpenSSL 0.9.8 FIPS 140-2 test branch.
|
|
|
|
NOTE: this distribution is NOT FIPS140-2 validated. These instructions are
|
|
intended for people who wish to test the OpenSSL FIPS 140-2 1.2 module. More
|
|
complete instructions will be made available after validation.
|
|
|
|
1. Build from test tarball.
|
|
|
|
Download the OpenSSL test 1.2 source tree. The current version has the CVS tag
|
|
FIPS_098_TEST_8 or can be downloaded from:
|
|
|
|
ftp://ftp.openssl.org/snapshot/openssl-fips-test-1.2.0.tar.gz
|
|
|
|
Ignore any instructions in that tree: they are likely to be out of date.
|
|
|
|
If you are using a Unix like environment run the following commands. You may
|
|
NOT specify ANY other options at this stage.
|
|
|
|
./config fipscanisterbuild
|
|
make
|
|
make install
|
|
|
|
This will build and install the test 1.2 module and binaries under
|
|
/usr/local/fips-1.0
|
|
|
|
For Windows you need VC++, perl and NASM installed. This is now a pure VC++
|
|
build: no alternative compilers or tools are required. From a VC++ environment
|
|
do:
|
|
|
|
ms\do_fips
|
|
|
|
It should report that the compile was successful.
|
|
|
|
This will compile binaries into the out32dll directory. They can be copied to
|
|
a more convenient location.
|
|
|
|
2. Link test module to a more recent version of OpenSSL.
|
|
|
|
Once the test module has been installed it can be linked against a more recent
|
|
version of OpenSSL. Currently only versions from the 0.9.8-fips stable branch
|
|
can be used. It has the CVS tag OpenSSL-fips-0_9_8-stable daily snaphots can
|
|
also be downloaded as:
|
|
|
|
ftp://ftp.openssl.org/snapshot/openssl-0.9.8-fips-test-SNAP-YYMMDD.tar.gz
|
|
|
|
For a Unix build the standrd build procedure is followed and the option "fips"
|
|
is passed to either the config or Configure scripts. The fipscanisterbuild
|
|
option MUST NOT be used. Any other options may be included. Static libraries
|
|
can be built using the no-shared option.
|
|
|
|
For example:
|
|
|
|
./config fips
|
|
|
|
./config fips no-shared
|
|
|
|
For Windows builds the options "fips" and --with-fipslibdir=<path> are passed
|
|
to the Configure script where <path> is wherever the module was installed
|
|
For example:
|
|
|
|
perl Configure fips --with-fipslibdir=C:\some\path\fips
|
|
|
|
Then the build process continues in the normal way for example:
|
|
|
|
ms\do_nasm
|
|
nmake -f ms\ntdll.mak
|
|
|
|
for DLLs or
|
|
|
|
ms\do_nasm
|
|
nmake -f ms\nt.mak
|
|
|
|
for static builds.
|
|
|
|
3. Test new version of OpenSSL.
|
|
|
|
The new test FIPS enabled OpenSSL can now be tested in the usual way.
|
|
|
|
Additionally binary compatibility tests against OpenSSL 0.9.8x would be
|
|
MOST welcomed. This will help avoid any major issues when the 0.9.8-fips
|
|
branch is merged into 0.9.8 branch.
|
|
|
|
Any problems should be reported to the openssl-dev mailing list.
|
|
|