OpenSSL with FIPS cross compiling for iOS armv7

Question

I cross compiled the FIPS for armv7 using the instructions from http://opensslfoundation.com/testing/validation-2.0/platforms/ios/

I am having difficulties cross compiling openssl dependency on fips.

I am getting following error in terminal.

/usr/local/ssl/fips-2.0/bin/fipsld: line 185: ./openssl: Bad CPU type in executable
make[2]: *** [link_app.] Error 1
make[1]: *** [openssl] Error 2
make: *** [build_apps] Error 1

This is because the openssl executable under the "/apps" folder is of architecture armv7. Since I am cross compiling openssl, I need only the libssl and libcrypto with architecture armv7, other intermediate executables should build with i386 architecture.

Any help with setting up the environment variables is appreciated.

Fluorosis

Any clue please? I had the same problem compiling OpenSSL with FIPS – Inextricable

@Inextricable did you over come this error? If so, how? – Overwinter

I did, but I do not remember how, very sorry... – Inextricable

Answer 1

The OpenSSL FIPS User Guide 2.0 has a comprehensive example of building the FIPS Object Module and FIPS Capable Library. It also offers a sample iOS program to test your build against. See Appendix E on p. 122.

From the looks of it (due to link_app error), you did not set your environment properly with setenv-ios-11.sh. That caused your build attempt to build the executables (which should not be built in this configuration).

Un

Perhaps the guide and setenv worked at one point, but they most certainly do not now! – Camber

@Peter - Yeah, its hard to say... I know setenv-ios-11.sh is out of date. Its does not pick up the iOS 7 SDKs (see around line 45). I tired to provide an updated script that included error checking, but no one acted on it (I sent it multiple times, and eventually gave up). – Un

I just found what I think is your lib, github.com/noloader/openssl-1.0.1i-ios .That might help others with this question! – Camber

@Peter - yes, that's mine. I don't advertise it very much to avoid the site's self promotion rules. But its not FIPS. I think it has the updated script use. The script can be used for FIPS, too. – Un

Any clue please? I had the same problem compiling OpenSSL with FIPS – Inextricable