Fix IV length of DES EDE ECB implementations

[openssl.git] / INSTALL.md

diff --git a/INSTALL.md b/INSTALL.md
index db893492a1ba5149fb62870162caf7a3473ca722..09ea2d678f936652c0844a34762cdcc011eae429 100644 (file)
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -41,6 +41,7 @@ Table of Contents
    - [Notes on multi-threading](#notes-on-multi-threading)
    - [Notes on shared libraries](#notes-on-shared-libraries)
    - [Notes on random number generation](#notes-on-random-number-generation)
    - [Notes on multi-threading](#notes-on-multi-threading)
    - [Notes on shared libraries](#notes-on-shared-libraries)
    - [Notes on random number generation](#notes-on-random-number-generation)

+   - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)

 
 Prerequisites
 =============
 
 Prerequisites
 =============


@@ -48,8 +49,8 @@ Prerequisites
 To install OpenSSL, you will need:
 
  * A "make" implementation
 To install OpenSSL, you will need:
 
  * A "make" implementation

- * Perl 5 with core modules (please read [NOTES-Perl.md](NOTES-Perl.md))
- * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-Perl.md))
+ * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
+ * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))

  * an ANSI C compiler
  * a development environment in the form of development libraries and C
    header files
  * an ANSI C compiler
  * a development environment in the form of development libraries and C
    header files


@@ -58,13 +59,13 @@ To install OpenSSL, you will need:
 For additional platform specific requirements, solutions to specific
 issues and other details, please read one of these:
 
 For additional platform specific requirements, solutions to specific
 issues and other details, please read one of these:
 

- * [NOTES-Unix.md](NOTES-Unix.md) - notes for Unix like systems
- * [NOTES-VMS.md](NOTES-VMS.md) - notes related to OpenVMS
- * [NOTES-Windows.txt](NOTES-Windows.txt) - notes related to the Windows platform
- * [NOTES-DJGPP.md](NOTES-DJGPP.md) - building for DOS with DJGPP
- * [NOTES-Android.md](NOTES-Android.md) - building for Android platforms (using NDK)
- * [NOTES-Valgrind.md](NOTES-Valgrind.md) - testing with Valgrind
- * [NOTES-Perl.m](NOTES-Perl.md) - some notes on Perl
+ * [Notes for UNIX-like platforms](NOTES-UNIX.md)
+ * [Notes for Android platforms](NOTES-ANDROID.md)
+ * [Notes for Windows platforms](NOTES-WINDOWS.md)
+ * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
+ * [Notes for the OpenVMS platform](NOTES-VMS.md)
+ * [Notes on Perl](NOTES-PERL.md)
+ * [Notes on Valgrind](NOTES-VALGRIND.md)

 
 Notational conventions
 ======================
 
 Notational conventions
 ======================


@@ -119,21 +120,11 @@ represents one of the four commands
 Arguments
 ---------
 
 Arguments
 ---------
 

-**Mandatory arguments** are enclosed in double curly braces.
-A simple example would be
+**Optional Arguments** are enclosed in square brackets.

 
 

-    $ type {{ filename }}
+    [option...]

 
 

-which is to be understood to use the command `type` on some file name
-determined by the user.
-
-**Optional Arguments** are enclosed in double square brackets.
-
-    [[ options ]]
-
-Note that the notation assumes spaces around `{`, `}`, `[`, `]`, `{{`, `}}` and
-`[[`, `]]`.  This is to differentiate from OpenVMS directory
-specifications, which also use [ and ], but without spaces.
+A trailing ellipsis means that more than one could be specified.

 
 Quick Installation Guide
 ========================
 
 Quick Installation Guide
 ========================


@@ -234,10 +225,7 @@ Use the following command to install OpenSSL.
 
 By default, OpenSSL will be installed to
 
 
 By default, OpenSSL will be installed to
 

-    SYS$COMMON:[OPENSSL-'version'...]
-
-where 'version' is the OpenSSL version number with underscores instead
-of periods.
+    SYS$COMMON:[OPENSSL]

 
 ### Windows
 
 
 ### Windows
 


@@ -266,6 +254,9 @@ To install OpenSSL to a different location (for example into your home
 directory for testing purposes) run `Configure` as shown in the following
 examples.
 
 directory for testing purposes) run `Configure` as shown in the following
 examples.
 

+The options `--prefix` and `--openssldir` are explained in further detail in
+[Directories](#directories) below, and the values used here are mere examples.
+

 On Unix:
 
     $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
 On Unix:
 
     $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl


@@ -285,7 +276,7 @@ Configuration Options
 There are several options to `./Configure` to customize the build (note that
 for Windows, the defaults for `--prefix` and `--openssldir` depend on what
 configuration is used and what Windows implementation OpenSSL is built on.
 There are several options to `./Configure` to customize the build (note that
 for Windows, the defaults for `--prefix` and `--openssldir` depend on what
 configuration is used and what Windows implementation OpenSSL is built on.

-More notes on this in [NOTES-Windows.txt](NOTES-Windows.txt):
+For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).

 
 API Level
 ---------
 
 API Level
 ---------


@@ -295,7 +286,7 @@ API Level
 Build the OpenSSL libraries to support the API for the specified version.
 If [no-deprecated](#no-deprecated) is also given, don't build with support
 for deprecated APIs in or below the specified version number.  For example,
 Build the OpenSSL libraries to support the API for the specified version.
 If [no-deprecated](#no-deprecated) is also given, don't build with support
 for deprecated APIs in or below the specified version number.  For example,

-addding
+adding

 
     --api=1.1.0 no-deprecated
 
 
     --api=1.1.0 no-deprecated
 


@@ -349,9 +340,13 @@ Directories
 
 The name of the directory under the top of the installation directory tree
 (see the `--prefix` option) where libraries will be installed.  By default
 
 The name of the directory under the top of the installation directory tree
 (see the `--prefix` option) where libraries will be installed.  By default

-this is `lib/`. Note that on Windows only static libraries (`*.lib`) will
+this is `lib`. Note that on Windows only static libraries (`*.lib`) will

 be stored in this location. Shared libraries (`*.dll`) will always be
 be stored in this location. Shared libraries (`*.dll`) will always be

-installed to the `bin/` directory.
+installed to the `bin` directory.
+
+Some build targets have a multilib postfix set in the build configuration.
+For these targets the default libdir is `lib<multilib-postfix>`. Please use
+`--libdir=lib` to override the libdir if adding the postfix is undesirable.

 
 ### openssldir
 
 
 ### openssldir
 


@@ -375,7 +370,7 @@ The top of the installation directory tree.  Defaults are:
 
     Unix:           /usr/local
     Windows:        C:\Program Files\OpenSSL
 
     Unix:           /usr/local
     Windows:        C:\Program Files\OpenSSL

-    OpenVMS:        SYS$COMMON:[OPENSSL-'version']
+    OpenVMS:        SYS$COMMON:[OPENSSL]

 
 Compiler Warnings
 -----------------
 
 Compiler Warnings
 -----------------


@@ -451,7 +446,8 @@ This source is ignored by the FIPS provider.
 
 ### rdcpu
 
 
 ### rdcpu
 

-Use the `RDSEED` or `RDRAND` command if provided by the CPU.
+Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64
+if provided by the CPU.

 
 ### librandom
 
 
 ### librandom
 


@@ -520,9 +516,9 @@ never be used in production environments.  It will only work when used with
 gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
 option.
 
 gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
 option.
 

-### no-acvp_tests
+### enable-acvp-tests

 
 

-Do not build support for Automated Cryptographic Validation Protocol (ACVP)
+Build support for Automated Cryptographic Validation Protocol (ACVP)

 tests.
 
 This is required for FIPS validation purposes. Certain ACVP tests require
 tests.
 
 This is required for FIPS validation purposes. Certain ACVP tests require


@@ -577,6 +573,31 @@ as configuration option, you must ensure that it's valid for both the C and
 the C++ compiler.  If not, the C++ build test will most likely break.  As an
 alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
 
 the C++ compiler.  If not, the C++ build test will most likely break.  As an
 alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
 

+### --banner=text
+
+Use the specified text instead of the default banner at the end of
+configuration.
+
+### --w
+
+On platforms where the choice of 32-bit or 64-bit architecture
+is not explicitly specified, `Configure` will print a warning
+message and wait for a few seconds to let you interrupt the
+configuration. Using this flag skips the wait.
+
+### no-bulk
+
+Build only some minimal set of features.
+This is a developer option used internally for CI build tests of the project.
+
+### no-cached-fetch
+
+Never cache algorithms when they are fetched from a provider.  Normally, a
+provider indicates if the algorithms it supplies can be cached or not.  Using
+this option will reduce run-time memory usage but it also introduces a
+significant performance penalty.  This option is primarily designed to help
+with detecting incorrect reference counting.
+

 ### no-capieng
 
 Don't build the CAPI engine.
 ### no-capieng
 
 Don't build the CAPI engine.


@@ -679,7 +700,7 @@ Enable building of integration with external test suites.
 This is a developer option and may not work on all platforms.  The following
 external test suites are currently supported:
 
 This is a developer option and may not work on all platforms.  The following
 external test suites are currently supported:
 

- - BoringSSL test suite
+ - GOST engine test suite

  - Python PYCA/Cryptography test suite
  - krb5 test suite
 
  - Python PYCA/Cryptography test suite
  - krb5 test suite
 


@@ -691,9 +712,9 @@ for further details.
 Don't compile in filename and line number information (e.g.  for errors and
 memory allocation).
 
 Don't compile in filename and line number information (e.g.  for errors and
 memory allocation).
 

-### no-fips
+### enable-fips

 
 

-Don't compile the FIPS provider
+Build (and install) the FIPS provider

 
 ### no-fips-securitychecks
 
 
 ### no-fips-securitychecks
 


@@ -831,11 +852,14 @@ disengage SSE2 code paths upon application start-up, but if you aim for wider
 "audience" running such kernel, consider `no-sse2`.  Both the `386` and `no-asm`
 options imply `no-sse2`.
 
 "audience" running such kernel, consider `no-sse2`.  Both the `386` and `no-asm`
 options imply `no-sse2`.
 

-### enable-ssl-trace
+### no-ssl-trace

 
 

-Build with the SSL Trace capabilities.
+Don't build with SSL Trace capabilities.

 
 

-This adds the `-trace` option to `s_client` and `s_server`.
+This removes the `-trace` option from `s_client` and `s_server`, and omits the
+`SSL_trace()` function from libssl.
+
+Disabling `ssl-trace` may provide a small reduction in libssl binary size.

 
 ### no-static-engine
 
 
 ### no-static-engine
 


@@ -1116,23 +1140,21 @@ Configure OpenSSL
 
 ### Automatic Configuration
 
 
 ### Automatic Configuration
 

-On some platform a `config` script is available which attempts to guess
-your operating system (and compiler, if necessary) and calls the `Configure`
-Perl script with appropriate target based on its guess.  Further options can
-be supplied to the `config` script, which will be passed on to the `Configure`
-script.
+In previous version, the `config` script determined the platform type and
+compiler and then called `Configure`. Starting with this release, they are
+the same.

 
 #### Unix / Linux / macOS
 
 
 #### Unix / Linux / macOS
 

-    $ ./Configure [[ options ]]
+    $ ./Configure [options...]

 
 #### OpenVMS
 
 
 #### OpenVMS
 

-    $ perl Configure [[ options ]]
+    $ perl Configure [options...]

 
 #### Windows
 
 
 #### Windows
 

-    $ perl Configure [[ options ]]
+    $ perl Configure [options...]

 
 ### Manual Configuration
 
 
 ### Manual Configuration
 


@@ -1154,12 +1176,13 @@ When you have identified your system (and if necessary compiler) use this
 name as the argument to `Configure`.  For example, a `linux-elf` user would
 run:
 
 name as the argument to `Configure`.  For example, a `linux-elf` user would
 run:
 

-    $ ./Configure linux-elf [[ options ]]
+    $ ./Configure linux-elf [options...]

 
 ### Creating your own Configuration
 
 If your system isn't listed, you will have to create a configuration
 
 ### Creating your own Configuration
 
 If your system isn't listed, you will have to create a configuration

-file named `Configurations/{{ something }}.conf` and add the correct
+file named `Configurations/YOURFILENAME.conf` (replace `YOURFILENAME`
+with a filename of your choosing) and add the correct

 configuration for your system.  See the available configs as examples
 and read [Configurations/README.md](Configurations/README.md) and
 [Configurations/README-design.md](Configurations/README-design.md)
 configuration for your system.  See the available configs as examples
 and read [Configurations/README.md](Configurations/README.md) and
 [Configurations/README-design.md](Configurations/README-design.md)


@@ -1183,21 +1206,21 @@ directory and invoking the configuration commands from there.
 
     $ mkdir /var/tmp/openssl-build
     $ cd /var/tmp/openssl-build
 
     $ mkdir /var/tmp/openssl-build
     $ cd /var/tmp/openssl-build

-    $ /PATH/TO/OPENSSL/SOURCE/Configure [[ options ]]
+    $ /PATH/TO/OPENSSL/SOURCE/Configure [options...]

 
 #### OpenVMS example
 
     $ set default sys$login:
     $ create/dir [.tmp.openssl-build]
     $ set default [.tmp.openssl-build]
 
 #### OpenVMS example
 
     $ set default sys$login:
     $ create/dir [.tmp.openssl-build]
     $ set default [.tmp.openssl-build]

-    $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [[ options ]]
+    $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [options...]

 
 #### Windows example
 
     $ C:
     $ mkdir \temp-openssl
     $ cd \temp-openssl
 
 #### Windows example
 
     $ C:
     $ mkdir \temp-openssl
     $ cd \temp-openssl

-    $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [[ options ]]
+    $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [options...]

 
 Paths can be relative just as well as absolute.  `Configure` will do its best
 to translate them to relative paths whenever possible.
 
 Paths can be relative just as well as absolute.  `Configure` will do its best
 to translate them to relative paths whenever possible.


@@ -1276,7 +1299,7 @@ its default):
 
 ### OpenVMS
 
 
 ### OpenVMS
 

-'arch' is replaced with the architecture name, `Alpha` or `ia64`,
+'arch' is replaced with the architecture name, `ALPHA` or `IA64`,

 'sover' is replaced with the shared library version (`0101` for 1.1), and
 'pz' is replaced with the pointer size OpenSSL was built with:
 
 'sover' is replaced with the shared library version (`0101` for 1.1), and
 'pz' is replaced with the pointer size OpenSSL was built with:
 


@@ -1385,6 +1408,18 @@ over the build process.  Typically these should be defined prior to running
                    "--cross-compile-prefix" Configure flag described above. If both
                    are set then the Configure flag takes precedence.
 
                    "--cross-compile-prefix" Configure flag described above. If both
                    are set then the Configure flag takes precedence.
 

+    HASHBANGPERL
+                   The command string for the Perl executable to insert in the
+                   #! line of perl scripts that will be publicly installed.
+                   Default: /usr/bin/env perl
+                   Note: the value of this variable is added to the same scripts
+                   on all platforms, but it's only relevant on Unix-like platforms.
+
+    KERNEL_BITS
+                   This can be the value `32` or `64` to specify the architecture
+                   when it is not "obvious" to the configuration. It should generally
+                   not be necessary to specify this environment variable.
+

     NM
                    The name of the nm executable to use.
 
     NM
                    The name of the nm executable to use.
 


@@ -1409,12 +1444,8 @@ over the build process.  Typically these should be defined prior to running
                    Only needed if builing should use a different Perl executable
                    than what is used to run the Configure script.
 
                    Only needed if builing should use a different Perl executable
                    than what is used to run the Configure script.
 

-    HASHBANGPERL
-                   The command string for the Perl executable to insert in the
-                   #! line of perl scripts that will be publicly installed.
-                   Default: /usr/bin/env perl
-                   Note: the value of this variable is added to the same scripts
-                   on all platforms, but it's only relevant on Unix-like platforms.
+    RANLIB
+                   The name of the ranlib executable to use.

 
     RC
                    The name of the rc executable to use. The default will be as
 
     RC
                    The name of the rc executable to use. The default will be as


@@ -1423,9 +1454,6 @@ over the build process.  Typically these should be defined prior to running
                    variable is synonymous to this. If both are defined then RC
                    takes precedence.
 
                    variable is synonymous to this. If both are defined then RC
                    takes precedence.
 

-    RANLIB
-                   The name of the ranlib executable to use.
-

     WINDRES
                    See RC.
 
     WINDRES
                    See RC.
 


@@ -1569,7 +1597,7 @@ working incorrectly. If you think you encountered a bug, please
 Along with a short description of the bug, please provide the complete
 configure command line and the relevant output including the error message.
 
 Along with a short description of the bug, please provide the complete
 configure command line and the relevant output including the error message.
 

-Note: To make the output readable, pleace add a 'code fence' (three backquotes
+Note: To make the output readable, please add a 'code fence' (three backquotes

 ` ``` ` on a separate line) before and after your output:
 
      ```
 ` ``` ` on a separate line) before and after your output:
 
      ```


@@ -1597,8 +1625,8 @@ build.  Use this command:
     $ mms clean                                      ! (or mmk) OpenVMS
     $ nmake clean                                    # Windows
 
     $ mms clean                                      ! (or mmk) OpenVMS
     $ nmake clean                                    # Windows
 

-Assembler error messages can sometimes be sidestepped by using the
-`no-asm` configuration option.
+Assembler error messages can sometimes be sidestepped by using the `no-asm`
+configuration option. See also [notes](#notes-on-assembler-modules-compilation).

 
 Compiling parts of OpenSSL with gcc and others with the system compiler will
 result in unresolved symbols on some systems.
 
 Compiling parts of OpenSSL with gcc and others with the system compiler will
 result in unresolved symbols on some systems.


@@ -1653,6 +1681,13 @@ most UNIX/Linux systems), and Windows threads.  No other threading models are
 supported.  If your platform does not provide pthreads or Windows threads then
 you should use `Configure` with the `no-threads` option.
 
 supported.  If your platform does not provide pthreads or Windows threads then
 you should use `Configure` with the `no-threads` option.
 

+For pthreads, all locks are non-recursive. In addition, in a debug build,
+the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
+available on your platform, you might have to add
+`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
+(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
+ifdef test cannot be used.)
+

 Notes on shared libraries
 -------------------------
 
 Notes on shared libraries
 -------------------------
 


@@ -1714,6 +1749,41 @@ to install additional support software to obtain a random seed and reseed
 the CSPRNG manually.  Please check out the manual pages for `RAND_add()`,
 `RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
 
 the CSPRNG manually.  Please check out the manual pages for `RAND_add()`,
 `RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
 

+Notes on assembler modules compilation
+--------------------------------------
+
+Compilation of some code paths in assembler modules might depend on whether the
+current assembler version supports certain ISA extensions or not. Code paths
+that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
+Apart from that, the minimum requirements for the assembler versions are shown
+in the table below:
+
+| ISA extension | GNU as | nasm   | llvm    |
+|---------------|--------|--------|---------|
+| AVX           | 2.19   | 2.09   | 3.0     |
+| AVX2          | 2.22   | 2.10   | 3.1     |
+| ADCX/ADOX     | 2.23   | 2.10   | 3.3     |
+| AVX512        | 2.25   | 2.11.8 | 3.6 (*) |
+| AVX512IFMA    | 2.26   | 2.11.8 | 6.0 (*) |
+| VAES          | 2.30   | 2.13.3 | 6.0 (*) |
+
+---
+
+(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
+an explicit -march flag was apparently required to compile assembly modules. But
+then the compiler generates processor-specific code, which in turn contradicts
+the idea of performing dispatch at run-time, which is facilitated by the special
+variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
+around the problem by forcing the build procedure to use the following script:
+
+    #!/bin/sh
+    exec clang -no-integrated-as "$@"
+
+instead of the real clang. In which case it doesn't matter what clang version
+is used, as it is the version of the GNU assembler that will be checked.
+
+---
+

 <!-- Links  -->
 
 [openssl-users]:
 <!-- Links  -->
 
 [openssl-users]: