Commit 7f1288da authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Enforce minimum key sizes in FIPS mode.

parent 0a6e92a8

crypto/dh/dh.h

+3 −0
Original line number Diff line number Diff line
@@ -77,6 +77,8 @@ 
# define OPENSSL_DH_MAX_MODULUS_BITS	10000

#endif



#define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024



#define DH_FLAG_CACHE_MONT_P     0x01

#define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH

                                       * implementation now uses constant time
@@ -233,6 +235,7 @@ void ERR_load_DH_strings(void); 
/* Reason codes. */

#define DH_R_BAD_GENERATOR				 101

#define DH_R_INVALID_PUBKEY				 102

#define DH_R_KEY_SIZE_TOO_SMALL				 104

#define DH_R_MODULUS_TOO_LARGE				 103

#define DH_R_NO_PRIVATE_VALUE				 100

crypto/dh/dh_err.c

+2 −1
Original line number Diff line number Diff line 
/* crypto/dh/dh_err.c */

/* ====================================================================

 * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.

 * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions
@@ -87,6 +87,7 @@ static ERR_STRING_DATA DH_str_reasons[]= 
	{

{ERR_REASON(DH_R_BAD_GENERATOR)          ,"bad generator"},

{ERR_REASON(DH_R_INVALID_PUBKEY)         ,"invalid public key"},

{ERR_REASON(DH_R_KEY_SIZE_TOO_SMALL)     ,"key size too small"},

{ERR_REASON(DH_R_MODULUS_TOO_LARGE)      ,"modulus too large"},

{ERR_REASON(DH_R_NO_PRIVATE_VALUE)       ,"no private value"},

{0,NULL}

crypto/dsa/dsa.h

+4 −0
Original line number Diff line number Diff line
@@ -88,6 +88,8 @@ 
# define OPENSSL_DSA_MAX_MODULUS_BITS	10000

#endif



#define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024



#define DSA_FLAG_CACHE_MONT_P	0x01

#define DSA_FLAG_NO_EXP_CONSTTIME       0x02 /* new with 0.9.7h; the built-in DSA

                                              * implementation now uses constant time
@@ -292,6 +294,7 @@ void ERR_load_DSA_strings(void); 
#define DSA_F_DSAPARAMS_PRINT_FP			 101

#define DSA_F_DSA_DO_SIGN				 112

#define DSA_F_DSA_DO_VERIFY				 113

#define DSA_F_DSA_GENERATE_PARAMETERS			 117

#define DSA_F_DSA_NEW_METHOD				 103

#define DSA_F_DSA_PRINT					 104

#define DSA_F_DSA_PRINT_FP				 105
@@ -307,6 +310,7 @@ void ERR_load_DSA_strings(void); 
/* Reason codes. */

#define DSA_R_BAD_Q_VALUE				 102

#define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 100

#define DSA_R_KEY_SIZE_TOO_SMALL			 106

#define DSA_R_MISSING_PARAMETERS			 101

#define DSA_R_MODULUS_TOO_LARGE				 103

#define DSA_R_NON_FIPS_METHOD				 104

crypto/dsa/dsa_err.c

+2 −0
Original line number Diff line number Diff line
@@ -75,6 +75,7 @@ static ERR_STRING_DATA DSA_str_functs[]= 
{ERR_FUNC(DSA_F_DSAPARAMS_PRINT_FP),	"DSAparams_print_fp"},

{ERR_FUNC(DSA_F_DSA_DO_SIGN),	"DSA_do_sign"},

{ERR_FUNC(DSA_F_DSA_DO_VERIFY),	"DSA_do_verify"},

{ERR_FUNC(DSA_F_DSA_GENERATE_PARAMETERS),	"DSA_generate_parameters"},

{ERR_FUNC(DSA_F_DSA_NEW_METHOD),	"DSA_new_method"},

{ERR_FUNC(DSA_F_DSA_PRINT),	"DSA_print"},

{ERR_FUNC(DSA_F_DSA_PRINT_FP),	"DSA_print_fp"},
@@ -93,6 +94,7 @@ static ERR_STRING_DATA DSA_str_reasons[]= 
	{

{ERR_REASON(DSA_R_BAD_Q_VALUE)           ,"bad q value"},

{ERR_REASON(DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE),"data too large for key size"},

{ERR_REASON(DSA_R_KEY_SIZE_TOO_SMALL)    ,"key size too small"},

{ERR_REASON(DSA_R_MISSING_PARAMETERS)    ,"missing parameters"},

{ERR_REASON(DSA_R_MODULUS_TOO_LARGE)     ,"modulus too large"},

{ERR_REASON(DSA_R_NON_FIPS_METHOD)       ,"non fips method"},

crypto/rsa/rsa.h

+2 −0
Original line number Diff line number Diff line
@@ -182,6 +182,8 @@ struct rsa_st 
# define OPENSSL_RSA_MAX_MODULUS_BITS	16384

#endif



#define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS 1024



#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS

# define OPENSSL_RSA_SMALL_MODULUS_BITS	3072

#endif