Commit 04dc5a9c authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Redirect digests to FIPS module for FIPS builds. 

Use FIPS API when initialising digests.

Sync header file evp.h and error codes with HEAD for necessary FIPS
definitions.
parent ae6cb548

CHANGES

+7 −0
Original line number Diff line number Diff line
@@ -4,6 +4,13 @@ 


 Changes between 1.0.0d and 1.0.1  [xx XXX xxxx]



  *) Redirect digest operations to FIPS module for FIPS builds. 

     [Steve Henson]



  *) Update build system to add "fips" flag which will link in fipscanister.o

     for static and shared library builds embedding a signature if needed.

     [Steve Henson]



  *) Add protection against ECDSA timing attacks as mentioned in the paper

     by Billy Bob Brumley and Nicola Tuveri, see:

crypto/evp/Makefile

+2 −2
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c evp_acnf.c \ 
	bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \

	c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \

	evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \

	e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c

	e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c



LIBOBJ=	encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \

	e_des.o e_bf.o e_idea.o e_des3.o e_camellia.o\
@@ -40,7 +40,7 @@ LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \ 
	bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \

	c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \

	evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \

	e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o

	e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o



SRC= $(LIBSRC)

crypto/evp/digest.c

+14 −0
Original line number Diff line number Diff line
@@ -117,6 +117,10 @@ 
#include <openssl/engine.h>

#endif



#ifdef OPENSSL_FIPS

#include <openssl/fips.h>

#endif



void EVP_MD_CTX_init(EVP_MD_CTX *ctx)

	{

	memset(ctx,'\0',sizeof *ctx);
@@ -225,6 +229,16 @@ skip_to_init: 
		}

	if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)

		return 1;

#ifdef OPENSSL_FIPS

	if (FIPS_mode())

		{

		if (FIPS_digestinit(ctx, type))

			return 1;

		OPENSSL_free(ctx->md_data);

		ctx->md_data = NULL;

		return 0;

		}

#endif

	return ctx->digest->init(ctx);

	}

crypto/evp/e_aes.c

+4 −0
Original line number Diff line number Diff line
@@ -58,6 +58,8 @@ 
#include <openssl/modes.h>

#include "evp_locl.h"



#ifndef OPENSSL_FIPS



static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

					const unsigned char *iv, int enc);
@@ -192,3 +194,5 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 
	}



#endif



#endif

crypto/evp/e_des3.c

+3 −0
Original line number Diff line number Diff line
@@ -65,6 +65,8 @@ 
#include <openssl/des.h>

#include <openssl/rand.h>



#ifndef OPENSSL_FIPS



static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

			    const unsigned char *iv,int enc);
@@ -311,3 +313,4 @@ const EVP_CIPHER *EVP_des_ede3(void) 
	return &des_ede3_ecb;

}

#endif

#endif