WolfProvider

https://github.com/wolfssl/wolfprovider
Admin
WolfProvider is a library designed to function as a cryptographic provider within OpenSSL, allowing...
Tokens:8,346
Snippets:111
Trust Score:9.8
License:GPL-3.0
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install wolfProvider

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Install the wolfProvider package after setting up dependencies.

```bash
apt install ../libwolfprov*${CURRENT_ARCH}*.deb
```

--------------------------------

### Build script usage examples

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Common patterns for using the build script with specific versions, existing installations, or clean rebuilds.

```bash
# Debug build with specific versions
./scripts/build-wolfprovider.sh --debug --openssl-ver=openssl-3.5.0 --wolfssl-ver=v5.8.0-stable

# Use existing OpenSSL installation
./scripts/build-wolfprovider.sh --openssl-dir=/path/to/openssl/source

# Clean and rebuild
./scripts/build-wolfprovider.sh --clean
./scripts/build-wolfprovider.sh
```

--------------------------------

### Install build dependencies

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Required system packages for the installation scripts.

```bash
apt install build-essential devscripts dh-exec
```

--------------------------------

### Install custom OpenSSL

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Install the specific OpenSSL packages required for wolfProvider.

```bash
apt install ../openssl*${CURRENT_ARCH}*.deb ../libssl3*${CURRENT_ARCH}*.deb
```

--------------------------------

### List OpenSSL Providers

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Verifies that wolfProvider is correctly installed and available to OpenSSL.

```bash
openssl list -providers
```

--------------------------------

### Build wolfProvider with custom OpenSSL path

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Configuring wolfProvider to link against a specific OpenSSL installation directory.

```bash
./configure --with-openssl=/usr/local/ssl
make
export LD_LIBRARY_PATH=/usr/local/ssl/lib
make check
```

--------------------------------

### Install WolfSSL Debian package

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Scripts to clone and build the WolfSSL repository for Debian packaging.

```bash
./debian/install-wolfssl.sh
```

```bash
./debian/install-wolfssl.sh /path/to/working/directory
```

```bash
./debian/install-wolfssl.sh --tag v5.6.4
./debian/install-wolfssl.sh --tag v5.6.4 /path/to/working/directory
```

```bash
./debian/install-wolfssl.sh --debug
./debian/install-wolfssl.sh --debug --tag v5.6.4
./debian/install-wolfssl.sh --debug --tag v5.6.4 /path/to/working/directory
```

--------------------------------

### Manual wolfProvider Build

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Configures and builds wolfProvider using autotools, linking against the previously built OpenSSL and wolfSSL FIPS installations.

```bash
./autogen.sh
./configure --with-openssl=/usr/local/openssl \
    --with-wolfssl=/usr/local/wolfssl-fips \
    --enable-replace-default
make -j$(nproc)
```

--------------------------------

### RSA-PSS Private Key Definition

Source: https://github.com/wolfssl/wolfprovider/blob/master/scripts/evp_test/evppkey_rsa_common.txt

Example of an RSA-PSS private key structure without parameter restrictions.

```text
PrivateKey = RSA-PSS
-----BEGIN PRIVATE KEY-----
MIIEugIBADALBgkqhkiG9w0BAQoEggSmMIIEogIBAAKCAQEAzQCB6nsq4eoG1Z98
c9n/uUoJYVwuS6fGNs7wjdNTPsMYVSWwFcdpuZp31nJb+cNTKptuX2Yn1fuFFgdo
092py9NZdFEXF9w9MJ0vxH7kH5fjKtt/ndhkocR2emZuzXG8Gqz151F/SzhZT+qb
BeQtWtqZEgCAE+RTFqTZu47QhriNKHWLrK+SLUaoaLSF0jnJuusOK2RZJxD0Ky0e
oKS0gCwL7Ksyj4posAc721Rv7qmAnShJkSs5DBUyvH4px2WPgXX65G80My/4e8qz
5AZJuYV3hp2g6nGDU/ByJ1SIaRNkh2DRIr5nbg/Eg90g/8Mb2pajGWbJqi51rQPe
R+HETwIDAQABAoIBAGApeseZGxZ6BtayR1i4y+IIvrmy2eyXOL2A+QouNQBd184p
LZ4puohb0xb+8fIJE7wKyQ1rCAiyQU2CEERB2GJKM84CM8j3gKSLN1r/AtdnEiKK
cCSE2z+evszPu+4XCduhgoANlJ6eQhbgv/NVg4j4vZDaNzodgnQ+w/vdFCf9FoJa
ZXoxaRLoaVNlEXyi+EXJCUBfysVfiV/BXSA4bCbueMnpkHUCmheKbB5M8MIA6KnP
sn6dFW+G5sKtwisahKHNXKWyeQh115QHyEs1I5XLgcw/7VuwQ7ae3gwHIEVQAlzu
jF9EAXC2Egu0jg90e82PUiEQhQ3wQ8Qo39GHBTECgYEA9vlhtHy8A1067evH3oUK
lWtl7Nuc9gdkBj8VqkhVPFjZcv5mdQVuNd39w3vzufL2Iu4nEzclaEnJvvIXb+j3
w/i7kbo3TdU7rz3sgU0r3sEMH9yIzdFodvJrHt+j8JQZft9NQv8fspcRA7iYyoWc
QnKHCGqEKrQQu2nPLTWva+MCgYEA1H5ySn/0EEiycMJSSkEBh4tzFZu3PT28GHsi
DmNbNTT5biQ6GE2T+GC2v7trccHtmh4fRYWDAjwwHpamksGgi1PQ7JypEBANgEUe
O33GoBusSuzvjfeYhGvCNaCMu6LPTAaATMESGelWCMcU4/FDDUkfrbujKldRoE+X
dFg0yaUCgYAh8kUrubld/QKMkUv3mfHKd+ialdUNPBbThPhFX4vXr56z36PVkdmE
Le8jX3YwqOSMCI/2ZC4QF5RTWpM+HpdvqFCfxyiy2gxKGgjX/PN6uq4f8wAayh3B
u7Bdnf+6oaCff7Hu84I32evMxyK5M4Q23ecRkRJ5jCaAnBqN7EMgYQKBgB91EKpi
wtjeSjxTKCeB9B4C0Oi0Aq54Qy5EnEgRAWGhFAPwLQGICo3Mk4FS15chpHEaYHrE
Rx6/lkgQ+VvkekXmBJnin0yXc8g3c0BPYGY3cowtA1G7A8MmyLtzpyHn+lRA6iFy
u6FGX8ww3LDZ+Jkw6BWqH3+XKahX4A4DON1ZAoGATR8NdW/nfgEJmmUvUKiLe2hd
xb8AmB1dI3b9DG/inNW2OHNEeTBac608FZnTnq47rgNfvW/tB8KN5wWTOHmgbkjm
pgNobtjiVgpfavHywk+vSqlg44IYbxXu3OmiSRrnMGgN1M93i3D6qGgmqzIjR3zJ
E3exmm1aLq6iGXYL7tU=
-----END PRIVATE KEY-----
```

--------------------------------

### Build wolfProvider directly with PQC support

Source: https://github.com/wolfssl/wolfprovider/blob/master/README.md

Configure the build process directly to include PQC algorithms.

```bash
./configure --enable-pqc
```

```bash
./configure --enable-mlkem
```

```bash
./configure --enable-mldsa
```

--------------------------------

### Enumerate PQC algorithms

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

List available KEM and signature algorithms provided by libwolfprov.

```bash
OPENSSL_CONF=provider.conf openssl list -kem-algorithms -provider libwolfprov
OPENSSL_CONF=provider.conf openssl list -signature-algorithms -provider libwolfprov
```

--------------------------------

### Prepare system for custom OpenSSL

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Commands to purge existing packages and set the architecture variable.

```bash
apt purge -y libwolfprov ; apt purge -y openssl-config ; apt purge -y openssl ; apt purge -y libssl3
```

```bash
export CURRENT_ARCH=$(dpkg --print-architecture)
```

--------------------------------

### Build wolfProvider with PQC support using script

Source: https://github.com/wolfssl/wolfprovider/blob/master/README.md

Enable Post-Quantum Cryptography features when building via the provided shell script.

```bash
./scripts/build-wolfprovider.sh --enable-pqc
```

```bash
./scripts/build-wolfprovider.sh --enable-mlkem
```

```bash
./scripts/build-wolfprovider.sh --enable-mldsa
```

--------------------------------

### Manually build wolfProvider

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Standard compilation steps for the wolfProvider module.

```bash
./autogen.sh
./configure
make
```

--------------------------------

### Build WolfProvider locally

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Commands to build Debian packages from the repository root.

```bash
./scripts/build-wolfprovider.sh --debian
```

```bash
./scripts/build-wolfprovider.sh --debian --enable-fips
```

--------------------------------

### Build wolfProvider with Replace Default Mode

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Use these commands to build wolfProvider with the replace-default configuration, optionally including unit testing support.

```bash
# Basic replace-default
./scripts/build-wolfprovider.sh --replace-default

# Replace-default with unit testing support
./scripts/build-wolfprovider.sh --replace-default --enable-replace-default-testing
```

--------------------------------

### Build WolfProvider using Docker

Source: https://github.com/wolfssl/wolfprovider/blob/master/IDE/Android/README.md

Execute the build process within a containerized environment to avoid modifying the host system.

```bash
docker run --rm -it -v $(pwd)/../../:/ws -w /ws/IDE/Android ubuntu:22.04 ./build.sh
```

--------------------------------

### Build wolfProvider for Production

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Configures the build for production environments with FIPS bundle and check enabled.

```bash
./scripts/build-wolfprovider.sh --replace-default --fips-bundle=/path/to/bundle --fips-check=v5
```

--------------------------------

### Switch Build Configurations

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Execute these commands to clean the environment and switch to the FIPS baseline build configuration.

```bash
./scripts/build-wolfprovider.sh --distclean
./scripts/build-wolfprovider.sh --enable-fips-baseline
```

--------------------------------

### Build wolfProvider with the build script

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Executes the automated build script to retrieve and compile dependencies.

```bash
./scripts/build-wolfprovider.sh
```

--------------------------------

### Switch Between Build Modes

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Cleans the build environment before switching between production and testing configurations.

```bash
./scripts/build-wolfprovider.sh --distclean
./scripts/build-wolfprovider.sh --replace-default --fips-bundle=/path/to/bundle --fips-check=v5
```

--------------------------------

### Generate and use ML-DSA-65 keys

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Commands for generating keys and performing sign/verify operations using the OpenSSL CLI with the wolfProvider configuration.

```bash
OPENSSL_CONF=provider.conf openssl genpkey -algorithm ML-DSA-65 -out key.pem

OPENSSL_CONF=provider.conf openssl pkeyutl -sign -inkey key.pem -in msg.bin -out sig.bin
OPENSSL_CONF=provider.conf openssl pkeyutl -verify -pubin -inkey pub.pem -sigfile sig.bin -in msg.bin
```

--------------------------------

### Build wolfProvider for Development and Testing

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Enables replace-default testing mode to allow unit testing alongside OpenSSL's default provider.

```bash
./scripts/build-wolfprovider.sh --replace-default --enable-replace-default-testing \
    --fips-bundle=/path/to/bundle --fips-check=v5
make test
```

--------------------------------

### Manually build OpenSSL

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Commands to clone and compile OpenSSL 3.0.0 from source.

```bash
git clone --depth=1 -b openssl-3.0.0 https://github.com/openssl/openssl.git
cd openssl
./config no-fips shared
make
sudo make install
```

--------------------------------

### Manual OpenSSL Build with Replace-Default Patch

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Builds OpenSSL from source after applying the required provider_predefined.c patch for replace-default mode.

```bash
git clone --depth=1 -b openssl-3.5.0 https://github.com/openssl/openssl.git
cd openssl

# Install the replace-default provider_predefined.c (recommended for FIPS)
cp /path/to/wolfProvider/patches/provider_predefined.c.replace-default \
    crypto/provider_predefined.c

./config shared --prefix=/usr/local/openssl no-external-tests no-tests
make -j$(nproc)
sudo make install
```

--------------------------------

### Manually build wolfSSL

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Commands to configure and compile wolfSSL with required flags for wolfProvider compatibility.

```bash
git clone https://github.com/wolfssl/wolfssl.git
cd wolfssl
./autogen.sh
./configure --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey CPPFLAGS="-DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DRSA_MIN_SIZE=1024" --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 --with-eccminsz=192
make
sudo make install
```

--------------------------------

### Run Unit Tests

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Executes the project unit tests.

```bash
make test
```

--------------------------------

### Automated Build Script Execution

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Executes the convenience build script to clean previous configurations and build wolfProvider with FIPS support.

```bash
./scripts/build-wolfprovider.sh --distclean
./scripts/build-wolfprovider.sh --replace-default --fips-bundle=/path/to/fips-bundle --fips-check=v5
```

--------------------------------

### Enable Debug Logging

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Use this command to enable debug logging during the wolfProvider build process.

```bash
./scripts/build-wolfprovider.sh --enable-fips-baseline --debug
```

--------------------------------

### Build OpenSSL Baseline

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Compile the patched OpenSSL source to create a FIPS-restricted environment.

```bash
cd /path/to/openssl-3.x
./Configure --prefix=/usr/local/openssl-fips-baseline
make -j$(nproc)
make install
```

--------------------------------

### Manual wolfSSL FIPS Bundle Build

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Configures and builds the wolfSSL FIPS bundle with mandatory flags for OpenSSL coexistence and compatibility.

```bash
# Extract the bundle
7z x wolfssl-5.8.4-commercial-fips-ready.7z
cd wolfssl-5.8.4-commercial-fips-ready

./configure --enable-fips=ready \
    --enable-opensslcoexist \
    --prefix=/usr/local/wolfssl-fips \
    CPPFLAGS="-I/usr/local/openssl/include -DWOLFSSL_OLD_OID_SUM -DWOLFSSL_DH_EXTRA"
make -j$(nproc)
sudo make install
```

--------------------------------

### Expected output of run.sh

Source: https://github.com/wolfssl/wolfprovider/blob/master/IDE/Android/README.md

This output confirms that the wolfSSL provider is active and lists the status of various cryptographic tests.

```text
Providers:
  libwolfprov
    name: wolfSSL Provider
    version: 0.0.1
    status: active
    build info: wolfSSL 5.6.4
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)
		evpciph_aes_wrap.txt ... PASS
		evpencod.txt ... PASS
		evpkdf_hkdf.txt ... PASS
		evpkdf_pbkdf2.txt ... PASS
		evpkdf_tls11_prf.txt ... PASS
		evpkdf_tls12_prf.txt ... PASS
		evpkdf_tls13_kdf.txt ... PASS
		evpmd_md.txt ... PASS
		evpmd_sha.txt ... PASS
		evppbe_pbkdf2.txt ... PASS
		evppbe_pkcs12.txt ... PASS
		evppkey_kdf_hkdf.txt ... PASS
		evppkey_kdf_tls1_prf.txt ... PASS
```

--------------------------------

### Patch Options and Restoration

Source: https://github.com/wolfssl/wolfprovider/blob/master/patches/openssl-fips-baseline/README.md

Commands for dry-run execution, skipping backups, and restoring original files from a timestamped backup directory.

```bash
# Preview changes without modifying files
./scripts/patch-openssl-fips.sh -s /path/to/openssl --dry-run --verbose

# Skip backup creation
./scripts/patch-openssl-fips.sh -s /path/to/openssl --no-backup

# Restore original files
cd /path/to/openssl
cp .fips-baseline-backup-<timestamp>/providers/*.c providers/
cp .fips-baseline-backup-<timestamp>/providers/fips/*.c providers/fips/
```

--------------------------------

### Build with Debug Logging to File

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Directs debug output to a specific file path.

```bash
./scripts/build-wolfprovider.sh --debug --debug-log=/path/to/logfile
```

--------------------------------

### Build with Debug Logging

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/INTEGRATION_GUIDE.md

Enables exit, error, and informational messages by building with the debug flag.

```bash
./scripts/build-wolfprovider.sh --debug
```

--------------------------------

### Verify Android device connectivity

Source: https://github.com/wolfssl/wolfprovider/blob/master/IDE/Android/README.md

Use this command to ensure your Android device or emulator is correctly recognized by ADB.

```bash
adb devices
```

--------------------------------

### Patch and Build OpenSSL

Source: https://github.com/wolfssl/wolfprovider/blob/master/patches/openssl-fips-baseline/README.md

Commands to apply the FIPS baseline patches to OpenSSL source code and perform a standard build.

```bash
# Patch your OpenSSL source
./scripts/patch-openssl-fips.sh --openssl-src=/path/to/openssl-3.x

# Build and install OpenSSL
cd /path/to/openssl-3.x
./Configure --prefix=/your/install/path
make -j$(nproc)
make install

# Verify
openssl list -providers
# Expected: OpenSSL Default Provider (FIPS Baseline)
```

--------------------------------

### Run FIPS Compliance Tests

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Execute tests to verify that only FIPS-compliant algorithms and parameters are accepted.

```bash
# Example tests
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048  # Should succeed
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:1024  # Should fail

/path/to/your/application/test-suite # Ensure your application test suite works properly
```

--------------------------------

### Verify provider status

Source: https://github.com/wolfssl/wolfprovider/blob/master/README-packaging.md

Commands to check the status of the provider API.

```bash
$ openssl list -providers
Could not load libwolfprov.so. Is the libwolfprov package installed?
  libwolfprov.so: cannot open shared object file: No such file or directory
```

```bash
$ openssl list -providers
```

```bash
Providers:
  default
    name: wolfSSL Provider
    version: 1.0.2
    status: active
```

--------------------------------

### Illegal RSA Key Derivation

Source: https://github.com/wolfssl/wolfprovider/blob/master/scripts/evp_test/evppkey_rsa_common.txt

Shows an attempt to derive an RSA-2048 key, which is not supported.

```text
Derive = RSA-2048
Result = KEYOP_INIT_ERROR
Reason = operation not supported for this keytype
```

--------------------------------

### Decrypt with OAEP Padding

Source: https://github.com/wolfssl/wolfprovider/blob/master/scripts/evp_test/evppkey_rsa_common.txt

Demonstrates an RSA-2048 decryption attempt using OAEP padding that results in an error due to corrupted ciphertext.

```text
Decrypt = RSA-2048
Ctrl = rsa_padding_mode:oaep
Input = 458708DFBD42A1297CE7A9C86C7087AB80B1754810929B89C5107CA55368587686986FCE94D86CC1595B3FB736223A656EC0F34D18BA1CC5665593610F56C58E26B272D584F3D983A5C91085700755AEBD921FB280BBA3EDA7046EC07B43E7298E52D59EDC92BE4639A8CE08B2F85976ECF6D98CC469EEB9D5D8E2A32EA8A6626EDAFE1038B3DF455668A9F3C77CAD8B92FB872E00058C3D2A7EDE1A1F03FC5622084AE04D9D24F6BF0995C58D35B93B699B9763595E123F2AB0863CC9229EB290E2EDE7715C7A8F39E0B9A3E2E1B56EBB62F1CBFBB5986FB212EBD785B83D01D968B11D1756C7337F70C1F1A63BFF03608E24F3A2FD44E67F832A8701C5D5AC
Output = "Hello World"
Result = KEYOP_ERROR
```

--------------------------------

### Verify FIPS Baseline Provider

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Confirm that the FIPS baseline provider is active within the OpenSSL environment.

```bash
openssl list -providers
# Should show: OpenSSL Default Provider (wolfProvider FIPS Baseline)
```

--------------------------------

### Patch OpenSSL for FIPS Baseline

Source: https://github.com/wolfssl/wolfprovider/blob/master/docs/FIPS_INTEGRATION_GUIDE.md

Apply FIPS baseline restrictions to the OpenSSL source tree to disable non-approved algorithms.

```bash
./scripts/patch-openssl-fips.sh --openssl-src=/path/to/openssl-3.x
```
Tokens:
Raw