Commit 65300dcf authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Prohibit use of low level digest APIs in FIPS mode.

parent 9ddc574f

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -4,6 +4,11 @@ 


 Changes between 1.0.0d and 1.0.1  [xx XXX xxxx]



  *) Low level digest APIs are not approved in FIPS mode: any attempt

     to use these will cause a fatal error. Applications that *really* want

     to use them can use the private_* version instead.

     [Steve Henson]



  *) Redirect cipher operations to FIPS module for FIPS builds. 

     [Steve Henson]

crypto/crypto.h

+16 −0
Original line number Diff line number Diff line
@@ -552,6 +552,22 @@ int FIPS_mode_set(int r); 


void OPENSSL_init(void);



#define fips_md_init(alg) fips_md_init_ctx(alg, alg)



#ifdef OPENSSL_FIPS

#define fips_md_init_ctx(alg, cx) \

	int alg##_Init(cx##_CTX *c) \

	{ \

	if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \

		"Low level API call to digest " #alg " forbidden in FIPS mode!"); \

	return private_##alg##_Init(c); \

	} \

	int private_##alg##_Init(cx##_CTX *c)

#else

#define fips_md_init_ctx(alg, cx) \

	int alg##_Init(cx##_CTX *c)

#endif



/* BEGIN ERROR CODES */

/* The following lines are auto generated by the script mkerr.pl. Any changes

 * made after this point may be overwritten when the script is next run.

crypto/evp/evp_locl.h

+15 −0
Original line number Diff line number Diff line
@@ -343,3 +343,18 @@ struct evp_pkey_method_st 
	} /* EVP_PKEY_METHOD */;



void evp_pkey_set_cb_translate(BN_GENCB *cb, EVP_PKEY_CTX *ctx);



#ifdef OPENSSL_FIPS

#define RIPEMD160_Init	private_RIPEMD160_Init

#define WHIRLPOOL_Init	private_WHIRLPOOL_Init

#define MD5_Init	private_MD5_Init

#define MD4_Init	private_MD4_Init

#define MD2_Init	private_MD2_Init

#define MDC2_Init	private_MDC2_Init

#define SHA_Init	private_SHA_Init

#define SHA1_Init	private_SHA1_Init

#define SHA224_Init	private_SHA224_Init

#define SHA256_Init	private_SHA256_Init

#define SHA384_Init	private_SHA384_Init

#define SHA512_Init	private_SHA512_Init

#endif

crypto/evp/m_md4.c

+2 −0
Original line number Diff line number Diff line
@@ -69,6 +69,8 @@ 
#include <openssl/rsa.h>

#endif



#include "evp_locl.h"



static int init(EVP_MD_CTX *ctx)

	{ return MD4_Init(ctx->md_data); }

crypto/evp/m_md5.c

+1 −0
Original line number Diff line number Diff line
@@ -68,6 +68,7 @@ 
#ifndef OPENSSL_NO_RSA

#include <openssl/rsa.h>

#endif

#include "evp_locl.h"



static int init(EVP_MD_CTX *ctx)

	{ return MD5_Init(ctx->md_data); }