#1131904 libssl3t64: "LS alert, bad record mac (532)" / "decryption failed or bad record mac" since 3.6.1 on ppc64

Package:
libssl3t64
Source:
libssl3t64
Description:
Secure Sockets Layer toolkit - shared libraries
Submitter:
Philipp Klaus Krause
Date:
2026-08-28 22:13:02 UTC
Severity:
normal
#1131904#5
Date:
2026-03-26 07:33:57 UTC
From:
To:
Dear Maintainer,

about a week ago, I upgraded libssl3t64 on my ppc64 system to 3.6.1-3. This resulted in failures (see below). After downgrading to 3.6.0-2, the failures disappeared. An amd64 system on the same network was not affected (there 3.6.1 works).

Failure example:

philipp@nemesis:/tmp$ curl --verbose https://www.google.com
* Host www.google.com:443 was resolved.
* IPv6: 2001:4860:482d:7700::, 2001:4860:4829:7700::, 2001:4860:4827:7700::, 2001:4860:482c:7700::, 2001:4860:4828:7700::, 2001:4860:482a:7700::, 2001:4860:482b:7700::, 2001:4860:4826:7700::
* IPv4: 142.251.156.119, 142.251.154.119, 142.251.152.119, 142.251.150.119, 142.251.155.119, 142.251.153.119, 142.251.157.119, 142.251.151.119
*   Trying [2001:4860:482d:7700::]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS alert, bad record mac (532):
* TLS connect error: error:0A000119:SSL routines::decryption failed or bad record mac
* closing connection #0
curl: (35) TLS connect error: error:0A000119:SSL routines::decryption failed or bad record mac
#1131904#10
Date:
2026-03-26 18:07:21 UTC
From:
To:
Interesting... 3.6.1-3 looks Ok on ppc64 and ppc64el according to
<https://packages.debian.org/sid/libssl3t64>.

Out of morbid curiosity... Is there any particular reason you need
openssl-provider-legacy?  Is something holding you back from using the
modern version of OpenSSL?  Also see the OSSL_PROVIDER-LEGACY(7SSL)
man page, <https://manpages.debian.org/testing/openssl/OSSL_PROVIDER-legacy.7ssl.en.html>.

Jeff
#1131904#15
Date:
2026-03-26 18:07:21 UTC
From:
To:
Interesting... 3.6.1-3 looks Ok on ppc64 and ppc64el according to
<https://packages.debian.org/sid/libssl3t64>.

Out of morbid curiosity... Is there any particular reason you need
openssl-provider-legacy?  Is something holding you back from using the
modern version of OpenSSL?  Also see the OSSL_PROVIDER-LEGACY(7SSL)
man page, <https://manpages.debian.org/testing/openssl/OSSL_PROVIDER-legacy.7ssl.en.html>.

Jeff
#1131904#20
Date:
2026-03-26 18:15:39 UTC
From:
To:
…

I probably should extend this. What does
	openssl version -a

say for CPUINFO and does it work if you mask 0x10 out of it?

say
	OPENSSL_ppccap=0x2e curl $bla

?

Sebastian
#1131904#25
Date:
2026-03-26 20:47:49 UTC
From:
To:
Am 26.03.26 um 19:15 schrieb Sebastian Andrzej Siewior:

And OPENSSL_ppccap=0x2e curl works fine as a workaround.

Philipp
#1131904#30
Date:
2026-03-26 20:50:39 UTC
From:
To:
Am 26.03.26 um 19:07 schrieb Jeffrey Walton:

I have no idea about this stuff; installed the machine 3 years ago, and
have done an apt-get dist-upgrade once in a while, not really thinking
about openssl until I ran into this bug.
But as far as I can see, lots of stuff depends on libssl3t64, and
libssl3t64 depends on openssl-provider-legacy, so I guess I need it?

Philipp
#1131904#35
Date:
2026-03-26 20:50:39 UTC
From:
To:
Am 26.03.26 um 19:07 schrieb Jeffrey Walton:

I have no idea about this stuff; installed the machine 3 years ago, and
have done an apt-get dist-upgrade once in a while, not really thinking
about openssl until I ran into this bug.
But as far as I can see, lots of stuff depends on libssl3t64, and
libssl3t64 depends on openssl-provider-legacy, so I guess I need it?

Philipp
#1131904#40
Date:
2026-03-26 20:56:02 UTC
From:
To:
What kind of a machine is it? Just to statisfy my curiosity.

How urgent of an update is this would you say? I would wait to 3.6.2
which should be out in a week or two.

Sebastian
#1131904#45
Date:
2026-03-26 21:14:12 UTC
From:
To:
Am 26.03.26 um 21:56 schrieb Sebastian Andrzej Siewior:

processor	: 175
cpu		: POWER9 (raw), altivec supported
clock		: 2600.000000MHz
revision	: 2.2 (pvr 004e 1202)

timebase	: 512000000
platform	: PowerNV
model		: T2P9S01 REV 1.01
machine		: PowerNV T2P9S01 REV 1.01
firmware	: OPAL
MMU		: Radix

For me personally, not urgent. I just downgraded to libssl3t64 3.6.0-2
for now.

Philipp
#1131904#50
Date:
2026-03-28 22:07:06 UTC
From:
To:
Hi Philipp,

Adrian
#1131904#55
Date:
2026-03-29 11:01:05 UTC
From:
To:
You do realise that I have it under control and that there are no
further steps required from Philipp?

Sebastian
#1131904#60
Date:
2026-03-29 11:20:04 UTC
From:
To:
I actually don't as the debian-powerpc mailing list wasn't kept in the loop.

Adrian
#1131904#65
Date:
2026-08-28 22:08:09 UTC
From:
To:
Was fixed as part of the upload, forgot to close the bug.

Sebastian