BN_lebin2bn used, but not available in AWS-LC-FIPS #1871

Activity

1. dagood commented on Sep 15, 2025

   

   Davis Goodin (dagood)

   on Sep 15, 2025

   Last edited by dagood

   Member

   More actions

   Cannot get required symbol "BN_lebin2bn" from libcrypto version 1.1

   I'm a little puzzled by this string. The "from libcrypto version" bit is present in 1.24, but not 1.25. (Or at least I can't find a place where it might come from in 1.25.) The 1.1 seems to indicate that it found OpenSSL 1.1 and is trying to load it, not a 1.0. Maybe the system has a weird symlink from 1.1 -> 1.0? Could try GO_OPENSSL_VERSION_OVERRIDE to work around that if that's the case.

   As you suspect, 1.0 is no longer supported in 1.25.

   • Remove OpenSSL 1.0.2 support golang-fips/openssl#248
   • Remove OpenSSL 1.0.2 support golang-fips/openssl#244

   ---

   About support: https://github.com/golang-fips/openssl?tab=readme-ov-file#multiple-openssl-versions-supported is up to date, but IMO we're missing updates to:

   • https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#go-125-aug-2025
   • https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#multiple-openssl-versions-allowed

   • go/patches/0003-Implement-crypto-internal-backend.patch

     Line 2000 in 27cc46e

     +var knownVersions = [...]string{"3", "1.1", "11", "111", "1.0.2", "1.0.0", "10"}

     • I think that updating this will change this to be a clearer error case, although maybe there's more we can do for 1.0 to make it specifically super clear.
   • https://devblogs.microsoft.com/go/microsoft-go-defaults-to-system-crypto/
   • https://github.com/microsoft/go/releases/tag/v1.25.0-1

   We also don't have a ms-go1.25-support branch in https://github.com/golang-fips/openssl yet to make it clearer if v2 has advanced past what's in 1.25. (Not yet.)

   Quim Muntal (@qmuntal) George Adams (@gdams)

   ❤️React with ❤️1Reacted by Dimitri John Ledkov
2. xnox commented on Sep 15, 2025

   

   Dimitri John Ledkov (xnox)

   on Sep 15, 2025

   ContributorAuthor

   More actions

   Davis Goodin (@dagood) thank you; yeah, i would have expected that knownVersions is updated.

   let me figure out what I can do here.

   👍React with 👍1Reacted by Davis Goodin
3. xnox commented on Sep 25, 2025

   

   Dimitri John Ledkov (xnox)

   on Sep 25, 2025

   ContributorAuthor

   More actions

   oooh, pondering if it actually is aws-lc-fips masquarading as openssl. As that is the only sane explanation of how come it reports 11 abi without the openssl 11 symbols.
4. Dimitri John Ledkov (xnox)

   changed the title [-]BN_lebin2bn used, but not available in openssl 1.0[/-] [+]BN_lebin2bn used, but not available in AWS-LC-FIPS[/+] on Oct 23, 2025