generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

More FIPS algorithm blocking.

Browse Source 
Catch attempted use of non FIPS algorithms with HMAC.

Give an assertion error for applications that ignore FIPS digest errors.

Make -non-fips-allow work with dgst and HMAC.
This commit is contained in:
Dr. Stephen Henson
2005-01-27 01:49:42 +00:00
parent 532d936be8
commit 6be00c7e16
4 changed files with 55 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
apps/dgst.c
View File

@@ -78,7 +78,7 @@ static HMAC_CTX hmac_ctx;
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen, const char *title,
const char *file,BIO *bmd,const char *hmac_key);
const char *file,BIO *bmd,const char *hmac_key, int non_fips_allow);
int MAIN(int, char **);
@@ -366,7 +366,7 @@ int MAIN(int argc, char **argv)
{
BIO_set_fp(in,stdin,BIO_NOCLOSE);
err=do_fp(out, buf,inp,separator, out_bin, sigkey, sigbuf,
siglen,"","(stdin)",bmd,hmac_key);
siglen,"","(stdin)",bmd,hmac_key, non_fips_allow);
}
else
{
@@ -392,7 +392,7 @@ int MAIN(int argc, char **argv)
else
tmp="";
r=do_fp(out,buf,inp,separator,out_bin,sigkey,sigbuf,
siglen,tmp,argv[i],bmd,hmac_key);
siglen,tmp,argv[i],bmd,hmac_key,non_fips_allow);
if(r)
err=r;
if(tofree)
@@ -419,7 +419,7 @@ end:
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen, const char *title,
const char *file,BIO *bmd,const char *hmac_key)
const char *file,BIO *bmd,const char *hmac_key, int non_fips_allow)
{
unsigned int len;
int i;
@@ -430,7 +430,11 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
EVP_MD *md;
BIO_get_md(bmd,&md);
HMAC_Init(&hmac_ctx,hmac_key,strlen(hmac_key),md);
HMAC_CTX_init(&hmac_ctx);
if (non_fips_allow)
HMAC_CTX_set_flags(&hmac_ctx,
EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
HMAC_Init_ex(&hmac_ctx,hmac_key,strlen(hmac_key),md, NULL);
BIO_get_md_ctx(bmd,&md_ctx);
BIO_set_md_ctx(bmd,&hmac_ctx.md_ctx);
}