Commit 3a5b97b7 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Don't set default public key methods in FIPS mode so applications 

can switch between modes.
parent 45bf8250

CHANGES

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ 


 Changes between 1.0.0e and 1.0.1  [xx XXX xxxx]



  *) For FIPS capable OpenSSL interpret a NULL default public key method

     as unset and return the appopriate default but do *not* set the default.

     This means we can return the appopriate method in applications that

     swicth between FIPS and non-FIPS modes.

     [Steve Henson]



  *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an

     ENGINE is used then we cannot handle that in the FIPS module so we

     keep original code iff non-FIPS operations are allowed.

crypto/dh/dh_lib.c

+4 −2
Original line number Diff line number Diff line
@@ -83,10 +83,12 @@ const DH_METHOD *DH_get_default_method(void) 
		{

#ifdef OPENSSL_FIPS

		if (FIPS_mode())

			default_DH_method = FIPS_dh_openssl();

			return FIPS_dh_openssl();

		else

#endif

			return DH_OpenSSL();

#else

		default_DH_method = DH_OpenSSL();

#endif

		}

	return default_DH_method;

	}

crypto/dsa/dsa_lib.c

+4 −2
Original line number Diff line number Diff line
@@ -89,10 +89,12 @@ const DSA_METHOD *DSA_get_default_method(void) 
		{

#ifdef OPENSSL_FIPS

		if (FIPS_mode())

			default_DSA_method = FIPS_dsa_openssl();

			return FIPS_dsa_openssl();

		else

#endif

			return DSA_OpenSSL();

#else

		default_DSA_method = DSA_OpenSSL();

#endif

		}

	return default_DSA_method;

	}

crypto/ecdh/ech_lib.c

+4 −2
Original line number Diff line number Diff line
@@ -96,10 +96,12 @@ const ECDH_METHOD *ECDH_get_default_method(void) 
		{

#ifdef OPENSSL_FIPS

		if (FIPS_mode())

			default_ECDH_method = FIPS_ecdh_openssl();

			return FIPS_ecdh_openssl();

		else

#endif

			return ECDH_OpenSSL();

#else

		default_ECDH_method = ECDH_OpenSSL();

#endif

		}

	return default_ECDH_method;

	}

crypto/ecdsa/ecs_lib.c

+4 −2
Original line number Diff line number Diff line
@@ -83,10 +83,12 @@ const ECDSA_METHOD *ECDSA_get_default_method(void) 
		{

#ifdef OPENSSL_FIPS

		if (FIPS_mode())

			default_ECDSA_method = FIPS_ecdsa_openssl();

			return FIPS_ecdsa_openssl();

		else

#endif

			return ECDSA_OpenSSL();

#else

		default_ECDSA_method = ECDSA_OpenSSL();

#endif

		}

	return default_ECDSA_method;

}