mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fips no-des: compile out TDES KAT

Browse Source 
FIPS provider correctly supports no-des build time option and doesn't
advertise DES related algorithms. However KAT test for DES is still
attempted to be executed and fails.

This prevents configuring FIPS provider without legacy behaviour as
defined in SP 800-131Arev2. Also see #25761 internal docs.

Fix `enable-fips no-des` build option, and add a daily checker for
"legacy-free" (as much as currently feasible) FIPS configuration.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25762)
This commit is contained in:
Dimitri John Ledkov 2024-10-22 11:53:02 +01:00 committed by Tomas Mraz
parent fc0e79461f
commit 9d70bba135
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
providers/fips/self_test_data.inc
View File

@ -250,6 +250,7 @@ static const unsigned char aes_128_ecb_ct[] = {
0x4e, 0xaa, 0x6f, 0xb4, 0xdb, 0xf7, 0x84, 0x65
};
#ifndef OPENSSL_NO_DES
/*
* TDES-ECB test data from
* https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/ACVP-TDES-ECB-1.0
@ -266,6 +267,7 @@ static const unsigned char tdes_ct[] = {
static const unsigned char tdes_pt[] = {
0x4B, 0xAB, 0x3B, 0xE1, 0x50, 0x2E, 0x3B, 0x36
};
#endif
static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
{
@ -291,6 +293,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
CIPHER_MODE_DECRYPT,
ITM(aes_128_ecb_key)
},
#ifndef OPENSSL_NO_DES
{
{
OSSL_SELF_TEST_DESC_CIPHER_TDES,
@ -301,6 +304,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
CIPHER_MODE_DECRYPT,
ITM(tdes_key)
}
#endif
};
static const char hkdf_digest[] = "SHA256";