intel / intel/QAT_Engine

failure to connect using AES128-SHA256 and provider

Open
#282 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
443
Forks
137
PR merge metrics
No merged PRs in 30d

Description

Please advise.
we start openssl s_server :

openssl s_server -key /disk/server.pem.key -cert /disk/server.pem.cert -provider qatprovider
(key is RSA key)

then we run client:
openssl s_client -connect localhost:4433 -tls1_2 -cipher AES128-SHA256

the connection fails with error
**"140737354077856:error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac:s3_pkt.c:480:"**

the server says:
ERROR
**0017FFF7FF7F0000:error:0A0000F4:SSL routines:(unknown function):unexpected message:ssl/statem/statem_srvr.c:312:
0017FFF7FF7F0000:error:40800066:lib(129)::aad malloc failure:qat_prov_cbc.c:619:**
shutting down SSL

I did a little debugging and i think the error happened in the function
qat_chained_ciphers_do_cipher , near this place:

WARN("%s \n",
PIPELINE_INCOMPLETE_INIT(qctx) ?
"Pipeline not initialised completely" : len % AES_BLOCK_SIZE
? "Buffer Length not multiple of AES block size"
: "out buffer null");

because PIPELINE_INCOMPLETE_INIT is true.

below are details about openssl/engine
"""(qatengine) Reference implementation of QAT crypto engine(qat_hw) v1.1.0bh
ENABLE_EXTERNAL_POLLING, POLL, SET_INSTANCE_FOR_THREAD,
GET_NUM_OP_RETRIES, SET_MAX_RETRY_COUNT, SET_INTERNAL_POLL_INTERVAL,
GET_EXTERNAL_POLLING_FD, ENABLE_EVENT_DRIVEN_POLLING_MODE,
GET_NUM_CRYPTO_INSTANCES, DISABLE_EVENT_DRIVEN_POLLING_MODE,
SET_EPOLL_TIMEOUT, SET_CRYPTO_SMALL_PACKET_OFFLOAD_THRESHOLD,
ENABLE_INLINE_POLLING, ENABLE_HEURISTIC_POLLING,
GET_NUM_REQUESTS_IN_FLIGHT, INIT_ENGINE, SET_CONFIGURATION_SECTION_NAME,
ENABLE_SW_FALLBACK, HEARTBEAT_POLL, DISABLE_QAT_OFFLOAD, HW_ALGO_BITMAP

OpenSSL 3.1.0 14 Mar 2023 (Library: OpenSSL 3.1.0 14 Mar 2023)

"""
P.S.
I tried same test with openssl 3.1.3 and engine 1.4.0.
the driver is QAT1.7.

openssl has been built this way:
./config --prefix=/disk/opt/openssl31/ --openssldir=/disk/opt/openssl31/

Qat has been configureed this way:
./configure --prefix=/disk/opt/openssl31/ --with-openssl_install_dir=/disk/opt/openssl31/ \
--with-openssl_dir=/home/vitalyk/OPS31/openssl-3.1.3 \
--with-qat_hw_dir=$MYCT100/3rd_party/qat3/qat/QAT1.7 --enable-qat-debug \
--with-cc_opt=-DQAT_TESTS_LOG \
--enable-qat_provider

thank you

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.