Commit 916bcab2 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Prohibit low level cipher APIs in FIPS mode. 

Not complete: ciphers with assembly language key setup are not
covered yet.
parent c7373c3d

CHANGES

+3 −0
Original line number Diff line number Diff line
@@ -4,6 +4,9 @@ 


 Changes between 1.0.0d and 1.0.1  [xx XXX xxxx]



  *) Add similar low level API blocking to ciphers.

     [Steve Henson]



  *) Low level digest APIs are not approved in FIPS mode: any attempt

     to use these will cause a fatal error. Applications that *really* want

     to use them can use the private_* version instead.

apps/speed.c

+9 −0
Original line number Diff line number Diff line
@@ -184,6 +184,15 @@ 
#include <openssl/ecdh.h>

#endif



#ifdef OPENSSL_FIPS

#define BF_set_key	private_BF_set_key

#define CAST_set_key	private_CAST_set_key

#define idea_set_encrypt_key	private_idea_set_encrypt_key

#define SEED_set_key	private_SEED_set_key

#define RC2_set_key	private_RC2_set_key

#define DES_set_key_unchecked	private_DES_set_key_unchecked

#endif



#ifndef HAVE_FORK

# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_NETWARE)

#  define HAVE_FORK 0

crypto/bf/bf_skey.c

+8 −0
Original line number Diff line number Diff line
@@ -58,11 +58,19 @@ 


#include <stdio.h>

#include <string.h>

#include <openssl/crypto.h>

#include <openssl/blowfish.h>

#include "bf_locl.h"

#include "bf_pi.h"



void BF_set_key(BF_KEY *key, int len, const unsigned char *data)

#ifdef OPENSSL_FIPS

	{

	fips_cipher_abort(BLOWFISH);

	private_BF_set_key(key, len, data);

	}

void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data)

#endif

	{

	int i;

	BF_LONG *p,ri,in[2];

crypto/bf/blowfish.h

+3 −1
Original line number Diff line number Diff line
@@ -104,7 +104,9 @@ typedef struct bf_key_st 
	BF_LONG S[4*256];

	} BF_KEY;



 

#ifdef OPENSSL_FIPS 

void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);

#endif

void BF_set_key(BF_KEY *key, int len, const unsigned char *data);



void BF_encrypt(BF_LONG *data,const BF_KEY *key);

crypto/cast/c_skey.c

+8 −1
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ 
 * [including the GNU Public Licence.]

 */



#include <openssl/crypto.h>

#include <openssl/cast.h>

#include "cast_lcl.h"

#include "cast_s.h"
@@ -71,8 +72,14 @@ 
#define S5 CAST_S_table5

#define S6 CAST_S_table6

#define S7 CAST_S_table7



void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)

#ifdef OPENSSL_FIPS

	{

	fips_cipher_abort(CAST);

	private_CAST_set_key(key, len, data);

	}

void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)

#endif

	{

	CAST_LONG x[16];

	CAST_LONG z[16];