2

I was wondering if it's at all possible to compile only the crypto functionality of OpenSSL that I want? In particular, is it possible to compile just SHA1, AES, and DH parts of OpenSSL?

I followed the advice at Build OpenSSL with just RSA and AES but it seems it is outdated for 1.0.1g that I am trying to build.

The way I am trying to build OpenSSL right now is something like:

./config no-idea no-md2 no-mdc2 no-rc5 no-sha0 no-rmd160 no-aes192 no-ec \
    no-err no-fips no-hw no-krb5 no-threads zlib-dynamic no-engines no-bio \
    no-aes no-algorithms no-asm no-bf no-bio no-buffer no-buf-freelists \
    no-camellia no-capieng no-cast no-chain-verify no-cms no-comp no-decc-init \
    no-deprecated no-des no-descbcm no-dgram no-dh no-dsa no-dtls1 \
    no-dynamic-engine no-ec no-ec2m no-ecdh no-ecdsa no-ec-nistp-64-gcc-128 \
    no-engine no-err no-evp no-fp-api no-gmp no-gost no-hash-comp \
    no-heartbeats no-hmac no-hw no-hw-4758-cca no-hw-aep no-hw-atalla \
    no-hw-chil no-hw-cswift no-hw-ibmca no-hw-ncipher no-hw-nuron no-hw-padlock \
    no-hw-sureware no-hw-ubsec no-hw-zencod no-idea no-inline-asm no-jpake \
    no-krb5 no-lhash no-locking no-md2 no-md4 no-mdc2 no-multibyte \
    no-nextprotoneg no-object no-ocsp no-posix-io no-psk no-rc2 no-rc4 \
    no-rc5 no-rdrand no-rfc3779 no-ripemd no-ripemd160 no-rmd16 no-rsa \
    no-rsax no-sctp no-seed no-setvbuf-ionbf no-sock no-speed no-srp no-srtp \
    no-ssl2 no-ssl3 no-ssl-intern no-stack no-static-engine no-stdio no-store \
    no-tls no-tls1 no-tls1-2-client no-tlsext no-whirlpool no-x509 no-x509-verify

Basically, I tried to disable everything that I could except the stuff I need. I then do make depend and then make build_crypto. I get errors like these:

In file included from ../include/openssl/ssl.h:163:0,
                 from ssl_locl.h:165,
                 from t1_reneg.c:113:
../include/openssl/hmac.h:64:2: error: #error HMAC is disabled.
 #error HMAC is disabled.

If I remove no-aes from the set of options, I get other similar errors.

Ideas?

Improve this question
7
  • looks like a try&error - approach and heavy dependencies between all those modules
    – that guy from over there
    Commented Oct 24, 2014 at 6:43
  • Yeah ... I just dug a bit deeper into the code and it seems there's a LOT of places for example where BIO stuff is compiled in even when OPENSSL_NO_BIO is defined. I was just wondering if anyone had tried this before. I think I will just give up now ...
    – mmtauqir
    Commented Oct 24, 2014 at 6:46
  • dropped a note.
    – that guy from over there
    Commented Oct 24, 2014 at 7:30
  • 2
    @mtahmed If you're ok with using something other than OpenSSL, I would suggest PolarSSL. It provides a configuration header file for only building the modules that you need for your application. Overall I find the API to be much more pleasant than OpenSSL.
    – RoraΖ
    Commented Oct 24, 2014 at 19:09
  • 2
    I gave up on this entirely. This is just impossible. OpenSSL is not very well-designed or thought out and the code is quite spaghettified ... everyone should avoid OpenSSL and use something like PolarSSL etc. ...
    – mmtauqir
    Commented Jan 21, 2015 at 6:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .