oqs openssl build errors.

[pals-ucb]

Hello,
I am part of a group in ucb and we just started our project on "PQ IoT Devices using DTLS" few weeks ago.
We got our prototype code working on standard openssl 1.1 and now we are trying to integrate this with OQS and OQS-OPENSSL. After that we want to study DTLS performance.

I am running into build errors (actually linker errors). I guess this could be a mismatch between the flags used in liboqs build and that in openssl. However, not able to figure this out. Also, liboqs is built as static library and installed on the system using make install, and then oqs-openssl is configured and built.

Note: We are working on CentOS Stream 9. I think this is not an issue, but in case.

Workspace details and branches (Note: the two repositories are on independent directories)

[pals@localhost liboqs]$ pwd
/home/pals/Workspace/liboqs
[pals@localhost liboqs]$ git branch

• main

[pals@localhost liboqs]$ git log --oneline | head -5
6c20a7d update BIKE documentation [skip ci] (#1509)
0b64ca3 Update Classic McEliece (#1470)
f032c20 Trigger liboqs-python CI via GitHub API (#1507)
93e7847 README correction to docs path & additional gitignore to macos + vscode (#1503)
65adc84 create deb package and retain as artifact (#1501)

[pals@localhost liboqs]$ cd ..
[pals@localhost Workspace]$ cd oqs-openssl/
[pals@localhost oqs-openssl]$ pwd
/home/pals/Workspace/oqs-openssl
[pals@localhost oqs-openssl]$ git branch

• OQS-OpenSSL_1_1_1-stable
  [pals@localhost oqs-openssl]$ git log --oneline | head -5
  98ce60974b Add deprecation message to README.md [skip ci] (qTESLA segmentation fault on ARM #463)
  caac43c14e 2023-07 snapshot release
  d13457c84f Prepare 2023-06 snapshot release candidate 1 [skip ci]
  aabb8ffb6f Updated generate.yml to support liboqs 0.8.0 algorithm changes (Specified the intended use of liboqs default algorithms #456)
  94df6b13d9 Code point documentation update (Should liboqs master branch provide optimized AES and SHA-3? #458)

[pals@localhost oqs-openssl]$ make
make depend && make _all
make[1]: Entering directory '/home/pals/Workspace/oqs-openssl'
make[1]: Leaving directory '/home/pals/Workspace/oqs-openssl'
make[1]: Entering directory '/home/pals/Workspace/oqs-openssl'
rm -f apps/openssl
${LDCMD:-gcc} -pthread -m64 -Ioqs/include -Wa,--noexecstack -Wall -O3 -L. -Loqs/lib -Loqs/lib64
-o apps/openssl apps/asn1pars.o apps/ca.o apps/ciphers.o apps/cms.o apps/crl.o apps/crl2p7.o apps/dgst.o apps/dhparam.o apps/dsa.o apps/dsaparam.o apps/ec.o apps/ecparam.o apps/enc.o apps/engine.o apps/errstr.o apps/gendsa.o apps/genpkey.o apps/genrsa.o apps/nseq.o apps/ocsp.o apps/openssl.o apps/passwd.o apps/pkcs12.o apps/pkcs7.o apps/pkcs8.o apps/pkey.o apps/pkeyparam.o apps/pkeyutl.o apps/prime.o apps/rand.o apps/rehash.o apps/req.o apps/rsa.o apps/rsautl.o apps/s_client.o apps/s_server.o apps/s_time.o apps/sess_id.o apps/smime.o apps/speed.o apps/spkac.o apps/srp.o apps/storeutl.o apps/ts.o apps/verify.o apps/version.o apps/x509.o
apps/libapps.a -lssl -lcrypto -ldl -pthread -loqs
/usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o): in function oqs_fetch_ossl_objects': ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x10): undefined reference to EVP_MD_fetch'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x27): undefined reference to EVP_MD_fetch' /usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x3e): undefined reference to EVP_MD_fetch'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x55): undefined reference to EVP_MD_fetch' /usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x6c): undefined reference to EVP_MD_fetch'
/usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o):ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0x83): more undefined references to EVP_MD_fetch' follow /usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o): in function oqs_fetch_ossl_objects':
ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0xc8): undefined reference to EVP_CIPHER_fetch' /usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0xdf): undefined reference to EVP_CIPHER_fetch'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_fetch_ossl_objects+0xf6): undefined reference to EVP_CIPHER_fetch' /usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o): in function oqs_free_ossl_objects':
ossl_helpers.c:(.text.oqs_free_ossl_objects+0xc): undefined reference to EVP_MD_free' /usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x18): undefined reference to EVP_MD_free'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x24): undefined reference to EVP_MD_free' /usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x30): undefined reference to EVP_MD_free'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x3c): undefined reference to EVP_MD_free' /usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o):ossl_helpers.c:(.text.oqs_free_ossl_objects+0x48): more undefined references to EVP_MD_free' follow
/usr/bin/ld: /usr/local/lib64/liboqs.a(ossl_helpers.c.o): in function oqs_free_ossl_objects': ossl_helpers.c:(.text.oqs_free_ossl_objects+0x6c): undefined reference to EVP_CIPHER_free'
/usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x78): undefined reference to EVP_CIPHER_free' /usr/bin/ld: ossl_helpers.c:(.text.oqs_free_ossl_objects+0x88): undefined reference to EVP_CIPHER_free'
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:6524: apps/openssl] Error 1
make[1]: Leaving directory '/home/pals/Workspace/oqs-openssl'
make: *** [Makefile:175: all] Error 2
[pals@localhost oqs-openssl]$

[baentsch]

The symbols causing you grief (e.g., EVP_MD_fetch) are OpenSSL3 symbols. Linking those into (oqs-)OpenSSL111 is futile. Please read and heed the Note in the documentation.

In general, your goal (doing a PQ-DTLS integration) is very interesting, so can I ask why you do this with an obsolete code base? Wouldn't it be more interesting to do this with OpenSSL master (to possibly contribute your work upstream/preserve it)?

[pals-ucb]

Thanks for the response. I did figure that these symbols come from OpenSSL 3, and in the process of finding out the matching commits in open SSL111 and liboqs. Tried a few combinations and failed.
So, I will try and follow your documentation.

To answer your second question. Absolutely, you are correct. The team from Berkeley is motivated to switch to OpenSSL 3 ASAP.
We have defined the project into few phases. One of that phase is to show a POC using openSSL 1.1.1 by August 8th. Hence this thread.
The next phase is to take the POC and discuss with few folks in OQS (like you) and get their feedback on how to move this to 3.
So, going to work on this in few weeks.

[baentsch]

to show a POC using openSSL 1.1.1 by August 8th

That's a tough challenge given there's no DTLS1.3 support in OpenSSL -- and I'm not entirely sure how to add PQ to DTL1.2 without significant protocol changes--but then again, I also didn't try that (DTLS1.2).... Looking forward to seeing your results/further dicussions!

[pals-ucb]

Thanks for the comment. We realized the lack of support for DTL1.3 in openSSL 3. One of the reasons, why we took this step of trying DTL1.2. My hope is to get some understanding of what is working and what is not and then have a plan.

Meanwhile, let me know if would like to have this discussion on a different channel or slack group or something. We can chat.

Current progress, from yesterday. So, made some significant progress.
I read your direction and then went through step by step; however, I was still having the same issue.
Then I read the note that liboqs must be built against openSSL1.1.1u and realized the mistake.
The newer linux distros like Centos Stream 9 installs OpenSSL3.0 headers and libs.
So, I got a git pull of the OpenSSL1.1.1., built that and installed locally. (May be help someone doing some experiement)

./config --prefix=/home/pals/Workspace/openssl-1.1.1 --openssldir=/home/pals/Workspace/openssl-1.1.1
make -j
Then used that to build the liboqs.
cmake -GNinja -DCMAKE_INSTALL_PREFIX=/home/pals/Workspace/oqs-openssl/oqs -DOPENSSL_ROOT_DIR=/home/pals/Workspace/openssl-1.1.1 ..
ninja
ninja install

Finally, built the oqs_openssl1.1.1. and it built clean.

Then I linked by test DTL1.2 application against this oqs_openssl
I am using regular RSA and it works fine. I expected this would.

Now, I am going to really switch to kyber and see what works.
This is new frontier for me, and I have to look at what API to use to select the kyber cipher.
Any help or pointers will be useful.

[baentsch]

Then I read the note that liboqs must be built against openSSL1.1.1u and realized the mistake.

That was not quite the note I was pointing to. What I pointed to was

Note: This will only work correctly, if the OpenSSL version used to build liboqs is a version below 3.0.0. If the standard OpenSSL on the build system or the version pointed to by the above -DOPENSSL_ROOT_DIR=... command is a version >= 3.0.0, then you must add the option -DOQS_USE_OPENSSL=OFF to the above cmake build command to successfully complete the subsequent build steps for this package.

--> Just setting -DOQS_USE_OPENSSL=OFF when building liboqs creates a binary that can be used in any other package (incl. old openssl).

Any help or pointers will be useful.

The liboqs KEM APIs are documented here and sample use case is here.

[pals-ucb]

Ok. Got it. /pals Mobile response

…

________________________________ From: Michael Baentsch ***@***.***> Sent: Sunday, July 30, 2023 9:54:04 PM To: open-quantum-safe/liboqs ***@***.***> Cc: pals-ucb ***@***.***>; Author ***@***.***> Subject: Re: [open-quantum-safe/liboqs] oqs openssl build errors. (Discussion #1517) Then I read the note that liboqs must be built against openSSL1.1.1u and realized the mistake. That was not quite the note I was pointing to. What I pointed to was Note: This will only work correctly, if the OpenSSL version used to build liboqs is a version below 3.0.0. If the standard OpenSSL on the build system or the version pointed to by the above -DOPENSSL_ROOT_DIR=... command is a version >= 3.0.0, then you must add the option -DOQS_USE_OPENSSL=OFF to the above cmake build command to successfully complete the subsequent build steps for this package.

--> Just setting -DOQS_USE_OPENSSL=OFF when building liboqs creates a binary that can be used in any other package (incl. old openssl). Any help or pointers will be useful. The liboqs KEM APIs are documented here<https://github.com/open-quantum-safe/liboqs/blob/main/src/kem/kem.h> and sample use case is here<https://github.com/open-quantum-safe/liboqs/blob/main/tests/example_kem.c>. — Reply to this email directly, view it on GitHub<#1517 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BBTC5BAWBBTAJDKI77K3RFLXS426ZANCNFSM6AAAAAA24VOZ3E>. You are receiving this because you authored the thread.Message ID: ***@***.***>