Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

I THINK MAN INVENTED THE CAR by instinct. -- Jack Handey, The New Mexican, 1988.


computers / comp.sys.tandem / Re: Here comes OpenSSL 3.0.0 - Very Important

SubjectAuthor
* Here comes OpenSSL 3.0.0 - Very ImportantRandall
+* Re: Here comes OpenSSL 3.0.0 - Very Importantred floyd
|`* Re: Here comes OpenSSL 3.0.0 - Very ImportantRandall
| `* Re: Here comes OpenSSL 3.0.0 - Very Importantred floyd
|  `- Re: Here comes OpenSSL 3.0.0 - Very ImportantRandall
`* Re: Here comes OpenSSL 3.0.0 - Very ImportantRandall
 `- Re: Here comes OpenSSL 3.0.0 - Very ImportantRandall

1
Here comes OpenSSL 3.0.0 - Very Important

<66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=134&group=comp.sys.tandem#134

  copy link   Newsgroups: comp.sys.tandem
X-Received: by 2002:a37:6554:: with SMTP id z81mr6226268qkb.472.1620334013606;
Thu, 06 May 2021 13:46:53 -0700 (PDT)
X-Received: by 2002:a25:b34c:: with SMTP id k12mr8167120ybg.6.1620334013352;
Thu, 06 May 2021 13:46:53 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.sys.tandem
Date: Thu, 6 May 2021 13:46:53 -0700 (PDT)
Injection-Info: google-groups.googlegroups.com; posting-host=2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a;
posting-account=6VebZwoAAAAgrpUtsowyjrKRLNlqxnXo
NNTP-Posting-Host: 2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
Subject: Here comes OpenSSL 3.0.0 - Very Important
From: rsbec...@nexbridge.com (Randall)
Injection-Date: Thu, 06 May 2021 20:46:53 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
 by: Randall - Thu, 6 May 2021 20:46 UTC

OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.

From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1..0.2, 1.1.1, and 3.0.0.

OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:

For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
* 64-bit, unthreaded, with FIPS
* 64-bit, unthreaded, without FIPS
* 64-bit, PUT threaded, with FIPS
* 64-bit, PUT threaded, without FIPS
* 32-bit, SPT threaded, with FIPS
* 32-bit, SPT threaded, without FIPS

For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
* 64-bit, unthreaded, without FIPS
* 64-bit, PUT threaded, without FIPS
* 32-bit, SPT threaded, without FIPS

The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.

Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.

Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.

As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.

Regards,
Randall Becker
On behalf of the ITUGLIB Technical Committee

Re: Here comes OpenSSL 3.0.0 - Very Important

<s71q9m$kra$1@redfloyd.dont-email.me>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=135&group=comp.sys.tandem#135

  copy link   Newsgroups: comp.sys.tandem
Path: i2pn2.org!i2pn.org!eternal-september.org!reader02.eternal-september.org!redfloyd.dont-email.me!.POSTED!not-for-mail
From: no.spam....@its.invalid (red floyd)
Newsgroups: comp.sys.tandem
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
Date: Thu, 6 May 2021 15:23:50 -0700
Organization: A noiseless patient Spider
Lines: 38
Message-ID: <s71q9m$kra$1@redfloyd.dont-email.me>
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Thu, 6 May 2021 22:23:50 -0000 (UTC)
Injection-Info: redfloyd.dont-email.me; posting-host="7c0e624adaa1ae9c3de5820909ecf0a6";
logging-data="21354"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18ducfUguC1E/t4D566lzTHRFqLO5UdDSs="
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
Thunderbird/78.10.1
Cancel-Lock: sha1:8K35xmZdjd+Jx1a9KHtDq36OFlE=
In-Reply-To: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
Content-Language: en-US
 by: red floyd - Thu, 6 May 2021 22:23 UTC

On 5/6/2021 1:46 PM, Randall wrote:
> OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
>
> From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
>
> OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
>
> For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
> * 64-bit, unthreaded, with FIPS
> * 64-bit, unthreaded, without FIPS
> * 64-bit, PUT threaded, with FIPS
> * 64-bit, PUT threaded, without FIPS
> * 32-bit, SPT threaded, with FIPS
> * 32-bit, SPT threaded, without FIPS
>
> For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
> * 64-bit, unthreaded, without FIPS
> * 64-bit, PUT threaded, without FIPS
> * 32-bit, SPT threaded, without FIPS
>
> The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
>
> Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
>
> Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
>
> As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
>
> Regards,
> Randall Becker
> On behalf of the ITUGLIB Technical Committee
>

Cool! Thanks, Randall!!

Just confirming something -- all the Nonstop changes are now integrated
upstream, is that correct? Or would we still want to download it from
ITUGLIB?

Re: Here comes OpenSSL 3.0.0 - Very Important

<94b54065-f4de-48a7-88b1-d487fd239e4en@googlegroups.com>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=136&group=comp.sys.tandem#136

  copy link   Newsgroups: comp.sys.tandem
X-Received: by 2002:ac8:57c5:: with SMTP id w5mr4567707qta.166.1620396162274;
Fri, 07 May 2021 07:02:42 -0700 (PDT)
X-Received: by 2002:a25:9a01:: with SMTP id x1mr13269351ybn.269.1620396162093;
Fri, 07 May 2021 07:02:42 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!news.snarked.org!border2.nntp.dca1.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.sys.tandem
Date: Fri, 7 May 2021 07:02:41 -0700 (PDT)
In-Reply-To: <s71q9m$kra$1@redfloyd.dont-email.me>
Injection-Info: google-groups.googlegroups.com; posting-host=2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a;
posting-account=6VebZwoAAAAgrpUtsowyjrKRLNlqxnXo
NNTP-Posting-Host: 2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com> <s71q9m$kra$1@redfloyd.dont-email.me>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <94b54065-f4de-48a7-88b1-d487fd239e4en@googlegroups.com>
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
From: rsbec...@nexbridge.com (Randall)
Injection-Date: Fri, 07 May 2021 14:02:42 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Lines: 78
 by: Randall - Fri, 7 May 2021 14:02 UTC

On Thursday, May 6, 2021 at 6:23:51 p.m. UTC-4, red floyd wrote:
> On 5/6/2021 1:46 PM, Randall wrote:
> > OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
> >
> > From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
> >
> > OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
> >
> > For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
> > * 64-bit, unthreaded, with FIPS
> > * 64-bit, unthreaded, without FIPS
> > * 64-bit, PUT threaded, with FIPS
> > * 64-bit, PUT threaded, without FIPS
> > * 32-bit, SPT threaded, with FIPS
> > * 32-bit, SPT threaded, without FIPS
> >
> > For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
> > * 64-bit, unthreaded, without FIPS
> > * 64-bit, PUT threaded, without FIPS
> > * 32-bit, SPT threaded, without FIPS
> >
> > The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
> >
> > Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
> >
> > Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
> >
> > As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
> >
> > Regards,
> > Randall Becker
> > On behalf of the ITUGLIB Technical Committee
> >
> Cool! Thanks, Randall!!
>
> Just confirming something -- all the Nonstop changes are now integrated
> upstream, is that correct? Or would we still want to download it from
> ITUGLIB?

The 3.0.0 branches contain all of the known changes for the NonStop port. That is the only one. The 1.1.1 port changes were not accepted because of timing and policy on the OpenSSL end. The ITUGLIB build will be provided for those who cannot build on their own. If people find a source problem, they can communicate it to me and I will try to have it integrated.

Note: The OpenSSL tarball download distribution can be used to build the NonStop port - the OpenSSL team prefers that way anyway, so you really only need a c99 compiler (and FLOSS for SPT). tar. and gunzip - all from HPE.

Re: Here comes OpenSSL 3.0.0 - Very Important

<s7ckq1$mp0$1@redfloyd.dont-email.me>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=140&group=comp.sys.tandem#140

  copy link   Newsgroups: comp.sys.tandem
Path: i2pn2.org!i2pn.org!eternal-september.org!reader02.eternal-september.org!redfloyd.dont-email.me!.POSTED!not-for-mail
From: no.s...@its.invalid (red floyd)
Newsgroups: comp.sys.tandem
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
Date: Mon, 10 May 2021 17:57:36 -0700
Organization: A noiseless patient Spider
Lines: 48
Message-ID: <s7ckq1$mp0$1@redfloyd.dont-email.me>
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
<s71q9m$kra$1@redfloyd.dont-email.me>
<94b54065-f4de-48a7-88b1-d487fd239e4en@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 11 May 2021 00:57:37 -0000 (UTC)
Injection-Info: redfloyd.dont-email.me; posting-host="50bb3455a3061f4de03ea7641015dade";
logging-data="23328"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19nbhChmKsYpGpVcNP6h/V5hhpyXBVYvTo="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.8.1
Cancel-Lock: sha1:xyGCTsNfqtEtf8vmB5UXqAlL4YQ=
In-Reply-To: <94b54065-f4de-48a7-88b1-d487fd239e4en@googlegroups.com>
Content-Language: en-US
 by: red floyd - Tue, 11 May 2021 00:57 UTC

On 5/7/21 7:02 AM, Randall wrote:
> On Thursday, May 6, 2021 at 6:23:51 p.m. UTC-4, red floyd wrote:
>> On 5/6/2021 1:46 PM, Randall wrote:
>>> OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
>>>
>>> From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
>>>
>>> OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
>>>
>>> For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
>>> * 64-bit, unthreaded, with FIPS
>>> * 64-bit, unthreaded, without FIPS
>>> * 64-bit, PUT threaded, with FIPS
>>> * 64-bit, PUT threaded, without FIPS
>>> * 32-bit, SPT threaded, with FIPS
>>> * 32-bit, SPT threaded, without FIPS
>>>
>>> For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
>>> * 64-bit, unthreaded, without FIPS
>>> * 64-bit, PUT threaded, without FIPS
>>> * 32-bit, SPT threaded, without FIPS
>>>
>>> The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
>>>
>>> Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
>>>
>>> Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
>>>
>>> As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
>>>
>>> Regards,
>>> Randall Becker
>>> On behalf of the ITUGLIB Technical Committee
>>>
>> Cool! Thanks, Randall!!
>>
>> Just confirming something -- all the Nonstop changes are now integrated
>> upstream, is that correct? Or would we still want to download it from
>> ITUGLIB?
>
> The 3.0.0 branches contain all of the known changes for the NonStop port. That is the only one. The 1.1.1 port changes were not accepted because of timing and policy on the OpenSSL end. The ITUGLIB build will be provided for those who cannot build on their own. If people find a source problem, they can communicate it to me and I will try to have it integrated.
>
> Note: The OpenSSL tarball download distribution can be used to build the NonStop port - the OpenSSL team prefers that way anyway, so you really only need a c99 compiler (and FLOSS for SPT). tar. and gunzip - all from HPE.
>

Thanks for all your hard work, Randall!!!!

Re: Here comes OpenSSL 3.0.0 - Very Important

<89ccdb5e-9c1d-4cbe-8557-69f0e7699120n@googlegroups.com>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=141&group=comp.sys.tandem#141

  copy link   Newsgroups: comp.sys.tandem
X-Received: by 2002:a37:8246:: with SMTP id e67mr30330821qkd.410.1620767290751;
Tue, 11 May 2021 14:08:10 -0700 (PDT)
X-Received: by 2002:a25:a249:: with SMTP id b67mr43493227ybi.138.1620767290553;
Tue, 11 May 2021 14:08:10 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.sys.tandem
Date: Tue, 11 May 2021 14:08:10 -0700 (PDT)
In-Reply-To: <s7ckq1$mp0$1@redfloyd.dont-email.me>
Injection-Info: google-groups.googlegroups.com; posting-host=2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a;
posting-account=6VebZwoAAAAgrpUtsowyjrKRLNlqxnXo
NNTP-Posting-Host: 2607:fea8:3aa0:2c20:98f9:abe4:8a8a:5d0a
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
<s71q9m$kra$1@redfloyd.dont-email.me> <94b54065-f4de-48a7-88b1-d487fd239e4en@googlegroups.com>
<s7ckq1$mp0$1@redfloyd.dont-email.me>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <89ccdb5e-9c1d-4cbe-8557-69f0e7699120n@googlegroups.com>
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
From: rsbec...@nexbridge.com (Randall)
Injection-Date: Tue, 11 May 2021 21:08:10 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
 by: Randall - Tue, 11 May 2021 21:08 UTC

On Monday, May 10, 2021 at 8:57:38 p.m. UTC-4, red floyd wrote:
> On 5/7/21 7:02 AM, Randall wrote:
> > On Thursday, May 6, 2021 at 6:23:51 p.m. UTC-4, red floyd wrote:
> >> On 5/6/2021 1:46 PM, Randall wrote:
> >>> OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
> >>>
> >>> From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
> >>>
> >>> OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
> >>>
> >>> For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
> >>> * 64-bit, unthreaded, with FIPS
> >>> * 64-bit, unthreaded, without FIPS
> >>> * 64-bit, PUT threaded, with FIPS
> >>> * 64-bit, PUT threaded, without FIPS
> >>> * 32-bit, SPT threaded, with FIPS
> >>> * 32-bit, SPT threaded, without FIPS
> >>>
> >>> For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
> >>> * 64-bit, unthreaded, without FIPS
> >>> * 64-bit, PUT threaded, without FIPS
> >>> * 32-bit, SPT threaded, without FIPS
> >>>
> >>> The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
> >>>
> >>> Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
> >>>
> >>> Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
> >>>
> >>> As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
> >>>
> >>> Regards,
> >>> Randall Becker
> >>> On behalf of the ITUGLIB Technical Committee
> >>>
> >> Cool! Thanks, Randall!!
> >>
> >> Just confirming something -- all the Nonstop changes are now integrated
> >> upstream, is that correct? Or would we still want to download it from
> >> ITUGLIB?
> >
> > The 3.0.0 branches contain all of the known changes for the NonStop port. That is the only one. The 1.1.1 port changes were not accepted because of timing and policy on the OpenSSL end. The ITUGLIB build will be provided for those who cannot build on their own. If people find a source problem, they can communicate it to me and I will try to have it integrated.
> >
> > Note: The OpenSSL tarball download distribution can be used to build the NonStop port - the OpenSSL team prefers that way anyway, so you really only need a c99 compiler (and FLOSS for SPT). tar. and gunzip - all from HPE.
> >
> Thanks for all your hard work, Randall!!!!

Glad to be of service :)

Re: Here comes OpenSSL 3.0.0 - Very Important

<e9ff764d-a219-4a36-ba84-4077790af2bcn@googlegroups.com>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=147&group=comp.sys.tandem#147

  copy link   Newsgroups: comp.sys.tandem
X-Received: by 2002:a05:620a:5fc:: with SMTP id z28mr1274648qkg.378.1621277180742;
Mon, 17 May 2021 11:46:20 -0700 (PDT)
X-Received: by 2002:a25:c9c4:: with SMTP id z187mr1656782ybf.200.1621277180524;
Mon, 17 May 2021 11:46:20 -0700 (PDT)
Path: i2pn2.org!i2pn.org!paganini.bofh.team!usenet.pasdenom.info!usenet-fr.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.sys.tandem
Date: Mon, 17 May 2021 11:46:20 -0700 (PDT)
In-Reply-To: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=173.33.197.34; posting-account=6VebZwoAAAAgrpUtsowyjrKRLNlqxnXo
NNTP-Posting-Host: 173.33.197.34
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <e9ff764d-a219-4a36-ba84-4077790af2bcn@googlegroups.com>
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
From: rsbec...@nexbridge.com (Randall)
Injection-Date: Mon, 17 May 2021 18:46:20 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
 by: Randall - Mon, 17 May 2021 18:46 UTC

On Thursday, May 6, 2021 at 4:46:54 p.m. UTC-4, Randall wrote:
> OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
>
> From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
>
> OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
>
> For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
> * 64-bit, unthreaded, with FIPS
> * 64-bit, unthreaded, without FIPS
> * 64-bit, PUT threaded, with FIPS
> * 64-bit, PUT threaded, without FIPS
> * 32-bit, SPT threaded, with FIPS
> * 32-bit, SPT threaded, without FIPS
>
> For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
> * 64-bit, unthreaded, without FIPS
> * 64-bit, PUT threaded, without FIPS
> * 32-bit, SPT threaded, without FIPS
>
> The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
>
> Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
>
> Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
>
> As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
>
> Regards,
> Randall Becker
> On behalf of the ITUGLIB Technical Committee

Just a timing update. 3.0.0 Beta1 is now officially due 30 June 2021. This date is set because of FIPS lab requirement. I expect to have builds ready for our community testing around that date. The set of builds are expected to be the same set as the current bunch for the 1.1.1 series (mostly because no one has requested a new build, and we have had requests to preserve some existing builds). Just a reminder that you cannot just drop 3.0.0 into your environment to replace 1.1.1. You must recompile your application to use 3.0.0 if you are on 1.1.1 or 1.0.2.

Re: Here comes OpenSSL 3.0.0 - Very Important

<04fa4359-b24d-47da-9bda-1e2815fa31b7n@googlegroups.com>

  copy mid

https://www.novabbs.com/computers/article-flat.php?id=151&group=comp.sys.tandem#151

  copy link   Newsgroups: comp.sys.tandem
X-Received: by 2002:a05:6214:934:: with SMTP id dk20mr6234198qvb.26.1621525081995;
Thu, 20 May 2021 08:38:01 -0700 (PDT)
X-Received: by 2002:a25:bdcf:: with SMTP id g15mr7772826ybk.311.1621525081620;
Thu, 20 May 2021 08:38:01 -0700 (PDT)
Path: i2pn2.org!i2pn.org!aioe.org!news.mixmin.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.sys.tandem
Date: Thu, 20 May 2021 08:38:01 -0700 (PDT)
In-Reply-To: <e9ff764d-a219-4a36-ba84-4077790af2bcn@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=173.33.197.34; posting-account=6VebZwoAAAAgrpUtsowyjrKRLNlqxnXo
NNTP-Posting-Host: 173.33.197.34
References: <66789606-225e-4c37-9082-15c193b7da61n@googlegroups.com> <e9ff764d-a219-4a36-ba84-4077790af2bcn@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <04fa4359-b24d-47da-9bda-1e2815fa31b7n@googlegroups.com>
Subject: Re: Here comes OpenSSL 3.0.0 - Very Important
From: rsbec...@nexbridge.com (Randall)
Injection-Date: Thu, 20 May 2021 15:38:01 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
 by: Randall - Thu, 20 May 2021 15:38 UTC

On Monday, May 17, 2021 at 2:46:21 p.m. UTC-4, Randall wrote:
> On Thursday, May 6, 2021 at 4:46:54 p.m. UTC-4, Randall wrote:
> > OpenSSL 3.0.0-alpha15 just passed all tests on TNS/X, which is the last build before the official Beta starts next month. It's time to start planning what you are going to do in terms of migration. There are some critical things to consider.
> >
> > From a source standpoint, you should be able to move from 1.0.2 directly to 3.0.0 with little or no issues. There is no binary compatibility between 1.0.2, 1.1.1, and 3.0.0.
> >
> > OpenSSL 3.0.0 has a FIPS-compliant module. ITUGLIB needs to know if you are planning to use FIPS (we don't want to know if you're planning on certifying it yourself, that's your call). As with OpenSSL, the ITUGLIB team is not responsible for certification - that's between you and NIST. The critical thing is that if you are going to use ITUGLIB builds, do you want the FIPS module or not. As of this week, the guidance is for packagers (ITUGLIB) to include FIPS or not include it, depending on the build. So what we're looking at is:
> >
> > For TNS/X, the following ITUGLIB builds are possible, but we need to know which ones you will want to use:
> > * 64-bit, unthreaded, with FIPS
> > * 64-bit, unthreaded, without FIPS
> > * 64-bit, PUT threaded, with FIPS
> > * 64-bit, PUT threaded, without FIPS
> > * 32-bit, SPT threaded, with FIPS
> > * 32-bit, SPT threaded, without FIPS
> >
> > For TNS/E, the FIPS cannot be supported because there is no hardware randomization function available, so the possible ITUGLIB builds are:
> > * 64-bit, unthreaded, without FIPS
> > * 64-bit, PUT threaded, without FIPS
> > * 32-bit, SPT threaded, without FIPS
> >
> > The other thing to consider is that you can build any of these or any other configurations you might want, like GUARDIAN builds, all on your own if you have c99 and git. You do need FLOSS for the SPT build, which is why only 32-bit models are currently available - FLOSS only comes in 32-bit.
> >
> > Our ask, as ITUGLIB, is that you let us know what you need from us, so we can prepare the set of builds. Each OpenSSL 3.0.0 build takes a few hours to run through a build/test cycle so we would rather only build what the community needs. Note that we do not test the GUARDIAN builds because the standard test suite does not support TACL. That's why you really should use NonStop SSL, for any GUARDIAN applications. Please let us know here, or reply to me directly, as soon as you can, so we can plan.
> >
> > Unlike the OpenSSL 1.1.1 (except IEEE) and 1.0.2 builds, floating point operations for OpenSSL 3.0.0 will be done using IEEE format by default. The IEEE format is required to pass the OpenSSL test suite as of 3.0.0. It is also the format used by the NonStop HTTP server, so when they move to support 3.0.0, the standard build should be compatible. You can do your own build with Tandem Float if you need to.
> >
> > As always, if you find a bug or problem, let us know and we can try to get a fix looked at - if it is practical to do so, but no guarantees. We are all volunteers.
> >
> > Regards,
> > Randall Becker
> > On behalf of the ITUGLIB Technical Committee
> Just a timing update. 3.0.0 Beta1 is now officially due 30 June 2021. This date is set because of FIPS lab requirement. I expect to have builds ready for our community testing around that date. The set of builds are expected to be the same set as the current bunch for the 1.1.1 series (mostly because no one has requested a new build, and we have had requests to preserve some existing builds). Just a reminder that you cannot just drop 3.0.0 into your environment to replace 1.1.1. You must recompile your application to use 3.0.0 if you are on 1.1.1 or 1.0.2.

Alpha17 has come out today - the last Alpha! Yay! The next release will be Beta1. Note that for our builds, all floats will be IEEE. This is required to certify the code as functional - as in passing all OpenSSL test cases. The 1.1.1 build used float neutral except for the specific IEEE build. When we release the packaged builds, everything will be IEEE. If you have not used floats this should not be an issue. Note that not using IEEE can cause interoperability issues with off-platform clients and servers, so IEEE is highly recommended.

Again, please let me know here or privately whether you would like a Beta version for testing.

Regards,
Randall Becker
On Behalf of the ITUGLIB Technical Committee

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor