Commit b6d63b25 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Check fips method flags for ECDH, ECDSA.

parent e6b88d02

crypto/ecdh/ecdh.h

+2 −0
Original line number Diff line number Diff line
@@ -109,11 +109,13 @@ void ERR_load_ECDH_strings(void); 
/* Error codes for the ECDH functions. */



/* Function codes. */

#define ECDH_F_ECDH_CHECK				 102

#define ECDH_F_ECDH_COMPUTE_KEY				 100

#define ECDH_F_ECDH_DATA_NEW_METHOD			 101



/* Reason codes. */

#define ECDH_R_KDF_FAILED				 102

#define ECDH_R_NON_FIPS_METHOD				 103

#define ECDH_R_NO_PRIVATE_VALUE				 100

#define ECDH_R_POINT_ARITHMETIC_FAILURE			 101

crypto/ecdh/ech_err.c

+3 −1
Original line number Diff line number Diff line 
/* crypto/ecdh/ech_err.c */

/* ====================================================================

 * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.

 * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions
@@ -70,6 +70,7 @@ 


static ERR_STRING_DATA ECDH_str_functs[]=

	{

{ERR_FUNC(ECDH_F_ECDH_CHECK),	"ECDH_CHECK"},

{ERR_FUNC(ECDH_F_ECDH_COMPUTE_KEY),	"ECDH_compute_key"},

{ERR_FUNC(ECDH_F_ECDH_DATA_NEW_METHOD),	"ECDH_DATA_new_method"},

{0,NULL}
@@ -78,6 +79,7 @@ static ERR_STRING_DATA ECDH_str_functs[]= 
static ERR_STRING_DATA ECDH_str_reasons[]=

	{

{ERR_REASON(ECDH_R_KDF_FAILED)           ,"KDF failed"},

{ERR_REASON(ECDH_R_NON_FIPS_METHOD)      ,"non fips method"},

{ERR_REASON(ECDH_R_NO_PRIVATE_VALUE)     ,"no private value"},

{ERR_REASON(ECDH_R_POINT_ARITHMETIC_FAILURE),"point arithmetic failure"},

{0,NULL}

crypto/ecdh/ech_lib.c

+8 −0
Original line number Diff line number Diff line
@@ -225,6 +225,14 @@ ECDH_DATA *ecdh_check(EC_KEY *key) 
	}

	else

		ecdh_data = (ECDH_DATA *)data;

#ifdef OPENSSL_FIPS

	if (FIPS_mode() && !(ecdh_data->flags & ECDH_FLAG_FIPS_METHOD)

			&& !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))

		{

		ECDHerr(ECDH_F_ECDH_CHECK, ECDH_R_NON_FIPS_METHOD);

		return NULL;

		}

#endif

	



	return ecdh_data;

crypto/ecdh/ech_locl.h

+8 −0
Original line number Diff line number Diff line
@@ -75,6 +75,14 @@ struct ecdh_method 
	char *app_data;

	};



/* If this flag is set the ECDH method is FIPS compliant and can be used

 * in FIPS mode. This is set in the validated module method. If an

 * application sets this flag in its own methods it is its responsibility

 * to ensure the result is compliant.

 */



#define ECDH_FLAG_FIPS_METHOD	0x1



typedef struct ecdh_data_st {

	/* EC_KEY_METH_DATA part */

	int (*init)(EC_KEY *);

crypto/ecdsa/ecdsa.h

+2 −0
Original line number Diff line number Diff line
@@ -238,6 +238,7 @@ void ERR_load_ECDSA_strings(void); 
/* Error codes for the ECDSA functions. */



/* Function codes. */

#define ECDSA_F_ECDSA_CHECK				 104

#define ECDSA_F_ECDSA_DATA_NEW_METHOD			 100

#define ECDSA_F_ECDSA_DO_SIGN				 101

#define ECDSA_F_ECDSA_DO_VERIFY				 102
@@ -249,6 +250,7 @@ void ERR_load_ECDSA_strings(void); 
#define ECDSA_R_ERR_EC_LIB				 102

#define ECDSA_R_MISSING_PARAMETERS			 103

#define ECDSA_R_NEED_NEW_SETUP_VALUES			 106

#define ECDSA_R_NON_FIPS_METHOD				 107

#define ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED		 104

#define ECDSA_R_SIGNATURE_MALLOC_FAILED			 105