The QAT_RSA implementation is uses OpenSSL's internal data structures, breaks with OpenSSL 3.6

[sebastianas]

The QAT provider breaks in OpenSSL 3.6. In openssl/openssl@902568b ("Remove need for BN_BLINDING lock") the layout of an internal data structure has been changed and this data structure has been absorbed by the project. This is not going to work as it relies on the private definition.
You need to either use the anonymous RSA type or use your own and if you intend to use OpenSSL's data structure you need to convert it back and forth EVP_PKEY_todata() and EVP_PKEY_fromdata(). See openssl/openssl#30473 for the report on OpenSSL's side.

Sebastian

[venkatesh6911]

thanks @sebastianas for reporting the issue. Yes, we will fix this issue in future releases. There is ongoing work to remove the private definitions of OpenSSL in qatprovider. We will keep you informed.

[daniel-baumann]

do you have an rough estimate? until this happens, qatengine will unusable in start to drop out of linux distributions' repositories.

[venkatesh6911]

@daniel-baumann Can you share your timeline so that we can plan our validation and release ?

[daniel-baumann]

well, it's now already removed from Debian testing, so currently it woudn't be included in the next Debian stable release and I expect it to drop out of Ubuntu anytime soon too.

the next Debian stable release is likely going to be frozen in January 2027, but until then, all the things need to be ironed out before and on all sides, so I woudn't recommend to play the long game here.. realistically we'd need something stable by October 2026 at latest.

that's my Debian developers point of view; from a Debian users point of view, not being able to use qatengine on a current Debian system until then isn't nice. Users of other distributions that use openssl 3.6 (see https://repology.org/project/openssl/versions) will also not be happy about it.

[venkatesh6911]

@daniel-baumann We will plan to deliver the package with fixes before October. I will keep you posted on the updates.

[daniel-baumann]

Hi,

any news on this? current qatlib now fails to even compile with openssl 4.

Regards,
Daniel

[venkatesh6911]

The release (OpenSSL v4.0 support) is being planned for 2nd/3rd week of July.

[daniel-baumann]

great, thanks!

[venkatesh6911]

@daniel-baumann @sebastianas Our latest release has fixes for OpenSSL v3.6 and v4.0.
https://github.com/intel/QAT_Engine/releases/tag/v2.2.0

[daniel-baumann]

great, thanks; I'll prepare the update for Debian shortly..

[daniel-baumann]

works for me, I've just uploaded 2.2.0-1 to debian. thanks!