Question

I have successfully built openssl-fips-2.0 + openssl-1.0.1c for Android using ndk-r8.
I am doing cross-compile on Mac OSX.

However, I cannot pass FIPS_mode_set(1).
I get the following error: “FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match”

I am using the incore script provided from openssl-fips-2.0/util/incore.

My setup is as follows:

# Edit this to wherever you unpacked the NDK
export ANDROID_NDK=/home/android-ndk-r8

# Edit to wherever you put incore script
export FIPS_SIG=$PWD/openssl-fips-2.0/util/incore

PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.4.3/prebuilt/darwin-x86/bin:$PATH; export PATH
export MACHINE=armv7l
export RELEASE=2.6.32.GMU
export SYSTEM=android
export ARCH=arm
export CROSS_COMPILE="arm-linux-androideabi-"
export ANDROID_DEV="$ANDROID_NDK/platforms/android-14/arch-arm/usr"
export HOSTCC=gcc

Any ideas why I cannot pass incore fingerprint validation? Do I need anything special wrt incore on cross-compile?

Answer 1

If doing a static library build, fipsld tool needs to be run to add the correct fingerprint at link time.

If doing a shared library build, this gets done automatically behind the scenes.