Openssl 1.02

This page discusses the API changes for OpenSSL version 1.1. The overall goal of the API changes is to make many data structures opaque to applications. Data hiding provides a number of benefits:

Is a Perl script that scans all files in a directory and adds symbolic links to their hash values. Is a command-line tool for using the various cryptography functions of OpenSSL 's crypto library from the shell. When I run $ openssl version I get OpenSSL 0.9.8zh 14 Jan 2016 but when I run $ brew install openssl I get Warning: openssl 1.0.2l is already installed. Does this mean I have two versions installed? – user285372 Sep 18 '17 at 8:04. OpenSSL 1.0.2 supported the use of the OpenSSL FIPS Object Module (FOM), which was built to deliver FIPS approved algorithms in a FIPS 140-2 validated environment. 22 23 OpenSSL controversially decided to categorize the 1.0.2 architecture as 'End of Life' or 'EOL', effective December 31, 2019, despite objections that it was the only version.

  • Fields can be changed without breaking binary compatibility
  • Applications are more robust and can be more assured about correctness
  • It helps determine which (new) accessors and settors, for example, are needed

Applications which support both OpenSSL 1.0.2 (and below) and OpenSSL 1.1.0 (and above) should visit the section Compatibility Layer below. The Compatibility Layer provides OpenSSL 1.1.0 functions, like RSA_get0_key, to OpenSSL 1.0.2 clients. The source code is available for download below

If you find your library or program used to work with OpenSSL 1.0.2 but no longer works with OpenSSL 1.1.0, then please add details to discussion below at Things that no longer work.

  • 5No longer works

Major Changes so far[edit]

  • All structures in libssl public header files have been removed so that they are 'opaque' to library users. You should use the provided accessor functions instead
  • The old DES API has been removed
  • bn, a sub library in libcrypto, has been made opaque
  • Access to deprecated functions/macros has been removed by default. To enable access you must do two things. 1) Build OpenSSL with deprecation support (pass 'enable-deprecated' as an argument to config) 2) Applications must define 'OPENSSL_USE_DEPRECATED' before including OpenSSL header files
  • HMAC_Init and HMAC_cleanup were previously stated in the docs and header files as being deprecated - but were not flagged in previous versions with OPENSSL_NO_DEPRECATED. This has been corrected in 1.1.0. Access to these functions/macros will be off by default in 1.1.0 as per the note above about deprecation.
Openssl

OPENSSL_API_COMPAT[edit]

Various functions get deprecated as other interfaces get added, but are still available in a default build.The include files support setting the OPENSSL_API_COMPAT define that will hide functions that are deprecated in the selected version.To select the 1.1.0 version use -DOPENSSL_API_COMPAT=0x10100000L.

Backward compatibility[edit]

Since some structures have become opaque you can't directly access the member any more. You might need to create backward compatible macros or functions if you still want to support older versions of OpenSSL. A suggested way of doing that is:

Compatibility Layer[edit]

Application code now has to use pointers, and cannot allocate objects directly on the stack. For instance if the old code did:

You now have to do:

If you want to access rsa->n you now have to do something like:

Openssl 1.0.1f

There are new functions available for to get and set such variables that are not available in older versions. The suggested way to solve this is add your own copy of the new functions based on the one in OpenSSL 1.1.0. Here is an overview of most of them and how they could look like:

No longer works[edit]

This section details some of the programs nd libraries that used to work with OpenSSL 1.0.2 (and below), but no longer work with OpenSSL 1.1.0 (and above).

Qt[edit]

Here's what's broken in the dev branch of Qt when building openssl master as of 6 Feb 2015.

  • DH - we were directly accessing p and q to set the DH params to primes embedded in Qt. We can probably replace this with SSL_CTX_set_dh_auto(ctx, 1). Another option suggested by Steve Henson is to save the DHparams we're using at the moment then use d2i_DHparams to load them in. This is compatible with openssl versions that don't have the dh_auto option.
  • ctx->cert_store - we were directly accessing the cert_store field of SSL_CTX. We can probably replace this with X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *ctx) [Fixed in dev]
  • session->tlsext_tick_lifetime_hint - we were directly accessing the lifetime hint of the session. [A new API to access this field has been added]
  • cipher->valid - we were directly accessing the valid field of SSL_CIPHER. No replacement found. [This turned out not to be needed and so will be removed].
Openssl 1.02

cURL[edit]

  • SSL_SESSION->ssl_version. Replaced with SSL_version(SSL *)

wget[edit]

  • SSL->state. Replaced with SSL_state(SSL *)

Apache Traffic Manager[edit]

  • Setting SSL->rbio without setting SSL->wbio. New function introduction in 1.1.0 to handle this: SSL_set_rbio()

OpenConnect[edit]

In order to simulate 'resume' of a DTLS session which never really existed but which was actually negotiated over the VPN control connection, this code in the OpenConnect VPN client needs to set the following fields in a new SSL_SESSION:

  • ->ssl_version
  • ->cipher{,_id}
  • ->master_key{,_length}
  • ->session_id{,_length}

Openssl 1.02 Download

This was fixed with this OpenConnect commit which makes it create the ASN.1 representation of the session and import it with d2i_SSL_SESSION(). This is done conditionally in the above patch because it depends on the fix in openssl HEAD for d2i_SSL_SESSION() to make it cope with DTLS1_BAD_VER(RT#3704).

Other simpler things which broke:

  • SSL_CIPHER->id. Replaced with SSL_CIPHER_get_id()
  • SSL_CTX->extra_certs. Replaced with SSL_CTX_get_extra_chain_certs_only()

TianoCore/EDKII[edit]

EDKII is the reference implementation of UEFI firmware.

  • Various implicit inclusions of <openssl/bn.h> and <openssl/rsa.h> needed to be made explicit. (commit)
  • X509_NAME->bytes->{data,length}. Replaced with i2d_X509_NAME()(commit)
  • X509_ATTRIBUTE->{object,value}. Replaced with X509_ATTRIBUTE_get0_object() and X509_ATTRIBUTE_get0_type()(commit)
  • ASN1_OBJECT->{length,data}. Replaced with OBJ_get0_data() and OBJ_length(). With backward-compatibility #define of same. (commit)

OpenSSH[edit]

OpenSSH does not compile against OpenSSL 1.1.0. A patch was provided at Pull Request #48, Make it build using OpenSSL 1.1.0 in September 2016, but it was not acted upon.

Openssl 1.02 Tls 1.2

Downloads[edit]

openssl-compat.tar.gz - openssl-compat.tar.gz includes sources files openssl-compat.h and openssl-compat.c. The files provide the OpenSSL 1.1.0 compatibility layer for OpenSSL 1.0.2 and below users. OpenSSL 1.0.2 users should add openssl-compat.h and openssl-compat.c to their project, and then access data members through the functions.

Install Openssl Ubuntu

Retrieved from 'https://wiki.openssl.org/index.php?title=OpenSSL_1.1.0_Changes&oldid=2544'