Ledger Nano S Plus Detection Isues about hwi

[achow101]

I suspect this is a result of openssl removing ripemd160 so python's hashlib is no longer able to produce ripemd160 hashes. Resolving this has been on my list of things to do, but haven't actually worked on a solution yet, see #305.

To confirm, if you do openssl dgst -list, do you see ripemd160 in the list? If not, then that is the source of this issue. The only way to resolve this is to use an older version of openssl that still has ripemd160 and make sure that your python is compiled against it. If this is the problem, you haven't done anything wrong, it's just broken.

[Exym15]

I have a couple of weeks working on linux, excuse my ignorance. Would it be better to change distribution and try another?
openssl dgst -list Supported digests: -blake2b512 -blake2s256 -md4 -md5 -md5-sha1 -ripemd -ripemd160 -rmd160 -sha1 -sha224 -sha256 -sha3-224 -sha3-256 -sha3-384 -sha3-512 -sha384 -sha512 -sha512-224 -sha512-256 -shake128 -shake256 -sm3 -ssl3-md5 -ssl3-sha1 -whirlpool

[achow101]

It's listed there.. but I think that's because it is a "legacy" function so not actually removed yet?

Can you try openssl speed ripemd160?

According to this StackOverflow answer, it can be enabled with a configuration file.

Would it be better to change distribution and try another?

Probably not. Recent distributions are likely to be upgrading their openssl versions to the recent releases which will have the same issue.

[achow101]

Apparently it was added back, so make sure your openssl version is at least 3.0.7.

[Exym15]

Hello again, thanks for the help. The solution was to modify the openssl and add the following lines.

According to this StackOverflow answer, it can be enabled with a configuration file.

**`openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1`**

Thank You!!

[Sjors]

Ubuntu 22.10 currently ships with OpenSSL 3.0.5 so this issue may be around for a while. The workaround worked for me. Maybe we should check for it directly so the error is less cryptic?

Update: the workaround broke DNS on my system, with commands like dig causing a panic because it couldn't get random data.

[harding]

Just a note that I also seem to have just hit this OpenSSL issue (slightly different circumstances) and the workaround also worked for me (so far no obvious side-effects; dig continues to work).

Circumstance: running hwi displayaddress with a Trezor:

hwi -t trezor -d webusb:003:2 displayaddress --desc sh(wsh(sortedmulti(...)))#...

{"error": "unsupported hash type ripemd160", "code": -7}

For anyone else stumbling on this issue, note that this test returns "0" for everything when ripemd isn't available:

Can you try openssl speed ripemd160?