meets their needs, but dumping it in here only penalizes the rest of us.
ok beck deraadt
LIB= $(TOP)/libcrypto.a
SHARED_LIB= libcrypto$(SHLIB_EXT)
LIBSRC= cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \
- uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c fips_ers.c
+ uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c
LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o \
- uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o fips_ers.o $(CPUID_OBJ)
+ uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o $(CPUID_OBJ)
SRC= $(LIBSRC)
AES_set_encrypt_key(const unsigned char *userKey, const int bits,
AES_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(AES);
-#endif
return private_AES_set_encrypt_key(userKey, bits, key);
}
AES_set_decrypt_key(const unsigned char *userKey, const int bits,
AES_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(AES);
-#endif
return private_AES_set_decrypt_key(userKey, bits, key);
}
#include "bf_pi.h"
void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(BLOWFISH);
- private_BF_set_key(key, len, data);
- }
-void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data)
-#endif
{
int i;
BF_LONG *p,ri,in[2];
BF_LONG S[4*256];
} BF_KEY;
-#ifdef OPENSSL_FIPS
-void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);
-#endif
void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
void BF_encrypt(BF_LONG *data,const BF_KEY *key);
}
#endif /* !BN_LLONG */
-#if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS)
-#undef bn_div_words
-#endif
-
void bn_mul_normal(BN_ULONG *r,BN_ULONG *a,int na,BN_ULONG *b,int nb);
void bn_mul_comba8(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
void bn_mul_comba4(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
};
typedef struct camellia_key_st CAMELLIA_KEY;
-#ifdef OPENSSL_FIPS
-int private_Camellia_set_key(const unsigned char *userKey, const int bits,
- CAMELLIA_KEY *key);
-#endif
int Camellia_set_key(const unsigned char *userKey, const int bits,
CAMELLIA_KEY *key);
int Camellia_set_key(const unsigned char *userKey, const int bits,
CAMELLIA_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(Camellia);
-#endif
return private_Camellia_set_key(userKey, bits, key);
}
#define S6 CAST_S_table6
#define S7 CAST_S_table7
void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(CAST);
- private_CAST_set_key(key, len, data);
- }
-void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
-#endif
{
CAST_LONG x[16];
CAST_LONG z[16];
int short_key; /* Use reduced rounds for short key */
} CAST_KEY;
-#ifdef OPENSSL_FIPS
-void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
-#endif
void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAST_KEY *key,
int enc);
#include "cryptlib.h"
#include <openssl/cmac.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
struct CMAC_CTX_st
{
/* Cipher context to use */
void CMAC_CTX_cleanup(CMAC_CTX *ctx)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- {
- FIPS_cmac_ctx_cleanup(ctx);
- return;
- }
-#endif
EVP_CIPHER_CTX_cleanup(&ctx->cctx);
OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
const EVP_CIPHER *cipher, ENGINE *impl)
{
static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- /* If we have an ENGINE need to allow non FIPS */
- if ((impl || ctx->cctx.engine)
- && !(ctx->cctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
-
- {
- EVPerr(EVP_F_CMAC_INIT, EVP_R_DISABLED_FOR_FIPS);
- return 0;
- }
- /* Other algorithm blocking will be done in FIPS_cmac_init,
- * via FIPS_cipherinit().
- */
- if (!impl && !ctx->cctx.engine)
- return FIPS_cmac_init(ctx, key, keylen, cipher, NULL);
- }
-#endif
/* All zeros means restart */
if (!key && !cipher && !impl && keylen == 0)
{
{
const unsigned char *data = in;
size_t bl;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- return FIPS_cmac_update(ctx, in, dlen);
-#endif
+
if (ctx->nlast_block == -1)
return 0;
if (dlen == 0)
int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
{
int i, bl, lb;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- return FIPS_cmac_final(ctx, out, poutlen);
-#endif
+
if (ctx->nlast_block == -1)
return 0;
bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
#define fips_md_init(alg) fips_md_init_ctx(alg, alg)
-#ifdef OPENSSL_FIPS
-#define fips_md_init_ctx(alg, cx) \
- int alg##_Init(cx##_CTX *c) \
- { \
- if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
- "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
- return private_##alg##_Init(c); \
- } \
- int private_##alg##_Init(cx##_CTX *c)
-
-#define fips_cipher_abort(alg) \
- if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
- "Low level API call to cipher " #alg " forbidden in FIPS mode!")
-
-#else
#define fips_md_init_ctx(alg, cx) \
int alg##_Init(cx##_CTX *c)
#define fips_cipher_abort(alg) while(0)
-#endif
/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It
* takes an amount of time dependent on |len|, but independent of the contents
-# $OpenBSD: Makefile,v 1.8 2014/04/15 17:46:16 beck Exp $
+# $OpenBSD: Makefile,v 1.9 2014/04/15 20:06:09 tedu Exp $
LIB= crypto
# crypto/
SRCS+= cryptlib.c mem.c mem_dbg.c cversion.c ex_data.c cpt_err.c
-SRCS+= uid.c o_time.c o_str.c o_fips.c o_init.c fips_ers.c
+SRCS+= uid.c o_time.c o_str.c o_fips.c o_init.c
# aes/
SRCS+= aes_misc.c aes_ecb.c aes_cfb.c aes_ofb.c
SRCS+= bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c
SRCS+= c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c
SRCS+= evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
-SRCS+= e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c
+SRCS+= e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c
SRCS+= e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
# hmac/
int DES_key_sched(const_DES_cblock *key,DES_key_schedule *schedule);
int DES_set_key_checked(const_DES_cblock *key,DES_key_schedule *schedule);
void DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
-#ifdef OPENSSL_FIPS
-void private_DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
-#endif
void DES_string_to_key(const char *str,DES_cblock *key);
void DES_string_to_2keys(const char *str,DES_cblock *key1,DES_cblock *key2);
void DES_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,
}
void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(DES);
- private_DES_set_key_unchecked(key, schedule);
- }
-void private_DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
-#endif
{
static const int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
register DES_LONG c,d,t,s,t2;
#include <openssl/bn.h>
#include <openssl/dh.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
if(ret->meth->generate_params)
return ret->meth->generate_params(ret, prime_len, generator, cb);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dh_generate_parameters_ex(ret, prime_len,
- generator, cb);
-#endif
return dh_builtin_genparams(ret, prime_len, generator, cb);
}
int DH_generate_key(DH *dh)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_GENERATE_KEY, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
return dh->meth->generate_key(dh);
}
int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_COMPUTE_KEY, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
return dh->meth->compute_key(key, pub_key, dh);
}
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char DH_version[]="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
static const DH_METHOD *default_DH_method = NULL;
{
if(!default_DH_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dh_openssl();
- else
- return DH_OpenSSL();
-#else
default_DH_method = DH_OpenSSL();
-#endif
}
return default_DH_method;
}
#include <openssl/sha.h>
#include "dsa_locl.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
int DSA_generate_parameters_ex(DSA *ret, int bits,
const unsigned char *seed_in, int seed_len,
int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
if(ret->meth->dsa_paramgen)
return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
counter_ret, h_ret, cb);
-#ifdef OPENSSL_FIPS
- else if (FIPS_mode())
- {
- return FIPS_dsa_generate_parameters_ex(ret, bits,
- seed_in, seed_len,
- counter_ret, h_ret, cb);
- }
-#endif
else
{
const EVP_MD *evpmd;
#include <openssl/dsa.h>
#include <openssl/rand.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
static int dsa_builtin_keygen(DSA *dsa);
int DSA_generate_key(DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
if(dsa->meth->dsa_keygen)
return dsa->meth->dsa_keygen(dsa);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dsa_generate_key(dsa);
-#endif
return dsa_builtin_keygen(dsa);
}
#include <openssl/dh.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char DSA_version[]="DSA" OPENSSL_VERSION_PTEXT;
static const DSA_METHOD *default_DSA_method = NULL;
{
if(!default_DSA_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dsa_openssl();
- else
- return DSA_OpenSSL();
-#else
default_DSA_method = DSA_OpenSSL();
-#endif
}
return default_DSA_method;
}
DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_NON_FIPS_DSA_METHOD);
- return NULL;
- }
-#endif
return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
}
int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_SIGN_SETUP, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
}
int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_NON_FIPS_DSA_METHOD);
- return -1;
- }
-#endif
return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
}
#ifndef OPENSSL_NO_EC2M
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
-
const EC_METHOD *EC_GF2m_simple_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gf2m_simple_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_characteristic_two_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
#include <string.h>
#include "ec_lcl.h"
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
EC_KEY *EC_KEY_new(void)
{
BIGNUM *priv_key = NULL, *order = NULL;
EC_POINT *pub_key = NULL;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ec_key_generate_key(eckey);
-#endif
-
if (!eckey || !eckey->group)
{
ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
#include "ec_lcl.h"
const EC_METHOD *EC_GFp_mont_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_mont_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
ec_GFp_mont_field_set_to_one };
return &ret;
-#endif
}
#include <openssl/obj_mac.h>
#include "ec_lcl.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const EC_METHOD *EC_GFp_nist_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_nist_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src)
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
#include "ec_lcl.h"
const EC_METHOD *EC_GFp_simple_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_simple_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
#include <openssl/engine.h>
#endif
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
const char ECDH_version[]="ECDH" OPENSSL_VERSION_PTEXT;
{
if(!default_ECDH_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ecdh_openssl();
- else
- return ECDH_OpenSSL();
-#else
default_ECDH_method = ECDH_OpenSSL();
-#endif
}
return default_ECDH_method;
}
}
else
ecdh_data = (ECDH_DATA *)data;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ecdh_data->flags & ECDH_FLAG_FIPS_METHOD)
- && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
- {
- ECDHerr(ECDH_F_ECDH_CHECK, ECDH_R_NON_FIPS_METHOD);
- return NULL;
- }
-#endif
-
return ecdh_data;
}
#endif
#include <openssl/err.h>
#include <openssl/bn.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
const char ECDSA_version[]="ECDSA" OPENSSL_VERSION_PTEXT;
{
if(!default_ECDSA_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ecdsa_openssl();
- else
- return ECDSA_OpenSSL();
-#else
default_ECDSA_method = ECDSA_OpenSSL();
-#endif
}
return default_ECDSA_method;
}
}
else
ecdsa_data = (ECDSA_DATA *)data;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ecdsa_data->flags & ECDSA_FLAG_FIPS_METHOD)
- && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
- {
- ECDSAerr(ECDSA_F_ECDSA_CHECK, ECDSA_R_NON_FIPS_METHOD);
- return NULL;
- }
-#endif
return ecdsa_data;
}
#include <openssl/ui.h>
#include <openssl/ocsp.h>
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include <openssl/ts.h>
#ifndef OPENSSL_NO_CMS
#include <openssl/cms.h>
#endif
ERR_load_OCSP_strings();
ERR_load_UI_strings();
-#ifdef OPENSSL_FIPS
- ERR_load_FIPS_strings();
-#endif
#ifndef OPENSSL_NO_CMS
ERR_load_CMS_strings();
#endif
bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
- e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c \
+ e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \
e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \
bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \
c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
- e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o \
+ e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o \
e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o
SRC= $(LIBSRC)
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
{
memset(ctx,'\0',sizeof *ctx);
}
if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
return 1;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- if (FIPS_digestinit(ctx, type))
- return 1;
- OPENSSL_free(ctx->md_data);
- ctx->md_data = NULL;
- return 0;
- }
-#endif
return ctx->digest->init(ctx);
}
int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
{
-#ifdef OPENSSL_FIPS
- return FIPS_digestupdate(ctx, data, count);
-#else
return ctx->update(ctx,data,count);
-#endif
}
/* The caller can assume that this removes any secret data from the context */
/* The caller can assume that this removes any secret data from the context */
int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
{
-#ifdef OPENSSL_FIPS
- return FIPS_digestfinal(ctx, md, size);
-#else
int ret;
OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
}
memset(ctx->md_data,0,ctx->digest->ctx_size);
return ret;
-#endif
}
int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* This call frees resources associated with the context */
int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
{
-#ifndef OPENSSL_FIPS
/* Don't assume ctx->md_data was cleaned in EVP_Digest_Final,
* because sometimes only copies of the context are ever finalised.
*/
OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
OPENSSL_free(ctx->md_data);
}
-#endif
if (ctx->pctx)
EVP_PKEY_CTX_free(ctx->pctx);
#ifndef OPENSSL_NO_ENGINE
/* The EVP_MD we used belongs to an ENGINE, release the
* functional reference we held for this reason. */
ENGINE_finish(ctx->engine);
-#endif
-#ifdef OPENSSL_FIPS
- FIPS_md_ctx_cleanup(ctx);
#endif
memset(ctx,'\0',sizeof *ctx);
#include <openssl/evp.h>
#include <openssl/objects.h>
-#ifndef OPENSSL_FIPS
-
static int null_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
const unsigned char *iv,int enc);
static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
memcpy((char *)out,(const char *)in,inl);
return 1;
}
-#endif
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include "evp_locl.h"
-#ifdef OPENSSL_FIPS
-#define M_do_cipher(ctx, out, in, inl) FIPS_cipher(ctx, out, in, inl)
-#else
#define M_do_cipher(ctx, out, in, inl) ctx->cipher->do_cipher(ctx, out, in, inl)
-#endif
-
const char EVP_version[]="EVP" OPENSSL_VERSION_PTEXT;
ctx->engine = NULL;
#endif
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_cipherinit(ctx, cipher, key, iv, enc);
-#endif
ctx->cipher=cipher;
if (ctx->cipher->ctx_size)
{
}
#ifndef OPENSSL_NO_ENGINE
skip_to_init:
-#endif
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_cipherinit(ctx, cipher, key, iv, enc);
#endif
/* we assume block size is a power of 2 in *cryptUpdate */
OPENSSL_assert(ctx->cipher->block_size == 1
int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
{
-#ifndef OPENSSL_FIPS
if (c->cipher != NULL)
{
if(c->cipher->cleanup && !c->cipher->cleanup(c))
}
if (c->cipher_data)
OPENSSL_free(c->cipher_data);
-#endif
#ifndef OPENSSL_NO_ENGINE
if (c->engine)
/* The EVP_CIPHER we used belongs to an ENGINE, release the
* functional reference we held for this reason. */
ENGINE_finish(c->engine);
-#endif
-#ifdef OPENSSL_FIPS
- FIPS_cipher_ctx_cleanup(c);
#endif
memset(c,0,sizeof(EVP_CIPHER_CTX));
return 1;
+++ /dev/null
-/* crypto/evp/evp_fips.c */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- */
-
-
-#include <openssl/evp.h>
-
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-
-const EVP_CIPHER *EVP_aes_128_cbc(void) { return FIPS_evp_aes_128_cbc(); }
-const EVP_CIPHER *EVP_aes_128_ccm(void) { return FIPS_evp_aes_128_ccm(); }
-const EVP_CIPHER *EVP_aes_128_cfb1(void) { return FIPS_evp_aes_128_cfb1(); }
-const EVP_CIPHER *EVP_aes_128_cfb128(void) { return FIPS_evp_aes_128_cfb128(); }
-const EVP_CIPHER *EVP_aes_128_cfb8(void) { return FIPS_evp_aes_128_cfb8(); }
-const EVP_CIPHER *EVP_aes_128_ctr(void) { return FIPS_evp_aes_128_ctr(); }
-const EVP_CIPHER *EVP_aes_128_ecb(void) { return FIPS_evp_aes_128_ecb(); }
-const EVP_CIPHER *EVP_aes_128_gcm(void) { return FIPS_evp_aes_128_gcm(); }
-const EVP_CIPHER *EVP_aes_128_ofb(void) { return FIPS_evp_aes_128_ofb(); }
-const EVP_CIPHER *EVP_aes_128_xts(void) { return FIPS_evp_aes_128_xts(); }
-const EVP_CIPHER *EVP_aes_192_cbc(void) { return FIPS_evp_aes_192_cbc(); }
-const EVP_CIPHER *EVP_aes_192_ccm(void) { return FIPS_evp_aes_192_ccm(); }
-const EVP_CIPHER *EVP_aes_192_cfb1(void) { return FIPS_evp_aes_192_cfb1(); }
-const EVP_CIPHER *EVP_aes_192_cfb128(void) { return FIPS_evp_aes_192_cfb128(); }
-const EVP_CIPHER *EVP_aes_192_cfb8(void) { return FIPS_evp_aes_192_cfb8(); }
-const EVP_CIPHER *EVP_aes_192_ctr(void) { return FIPS_evp_aes_192_ctr(); }
-const EVP_CIPHER *EVP_aes_192_ecb(void) { return FIPS_evp_aes_192_ecb(); }
-const EVP_CIPHER *EVP_aes_192_gcm(void) { return FIPS_evp_aes_192_gcm(); }
-const EVP_CIPHER *EVP_aes_192_ofb(void) { return FIPS_evp_aes_192_ofb(); }
-const EVP_CIPHER *EVP_aes_256_cbc(void) { return FIPS_evp_aes_256_cbc(); }
-const EVP_CIPHER *EVP_aes_256_ccm(void) { return FIPS_evp_aes_256_ccm(); }
-const EVP_CIPHER *EVP_aes_256_cfb1(void) { return FIPS_evp_aes_256_cfb1(); }
-const EVP_CIPHER *EVP_aes_256_cfb128(void) { return FIPS_evp_aes_256_cfb128(); }
-const EVP_CIPHER *EVP_aes_256_cfb8(void) { return FIPS_evp_aes_256_cfb8(); }
-const EVP_CIPHER *EVP_aes_256_ctr(void) { return FIPS_evp_aes_256_ctr(); }
-const EVP_CIPHER *EVP_aes_256_ecb(void) { return FIPS_evp_aes_256_ecb(); }
-const EVP_CIPHER *EVP_aes_256_gcm(void) { return FIPS_evp_aes_256_gcm(); }
-const EVP_CIPHER *EVP_aes_256_ofb(void) { return FIPS_evp_aes_256_ofb(); }
-const EVP_CIPHER *EVP_aes_256_xts(void) { return FIPS_evp_aes_256_xts(); }
-const EVP_CIPHER *EVP_des_ede(void) { return FIPS_evp_des_ede(); }
-const EVP_CIPHER *EVP_des_ede3(void) { return FIPS_evp_des_ede3(); }
-const EVP_CIPHER *EVP_des_ede3_cbc(void) { return FIPS_evp_des_ede3_cbc(); }
-const EVP_CIPHER *EVP_des_ede3_cfb1(void) { return FIPS_evp_des_ede3_cfb1(); }
-const EVP_CIPHER *EVP_des_ede3_cfb64(void) { return FIPS_evp_des_ede3_cfb64(); }
-const EVP_CIPHER *EVP_des_ede3_cfb8(void) { return FIPS_evp_des_ede3_cfb8(); }
-const EVP_CIPHER *EVP_des_ede3_ecb(void) { return FIPS_evp_des_ede3_ecb(); }
-const EVP_CIPHER *EVP_des_ede3_ofb(void) { return FIPS_evp_des_ede3_ofb(); }
-const EVP_CIPHER *EVP_des_ede_cbc(void) { return FIPS_evp_des_ede_cbc(); }
-const EVP_CIPHER *EVP_des_ede_cfb64(void) { return FIPS_evp_des_ede_cfb64(); }
-const EVP_CIPHER *EVP_des_ede_ecb(void) { return FIPS_evp_des_ede_ecb(); }
-const EVP_CIPHER *EVP_des_ede_ofb(void) { return FIPS_evp_des_ede_ofb(); }
-const EVP_CIPHER *EVP_enc_null(void) { return FIPS_evp_enc_null(); }
-
-const EVP_MD *EVP_sha1(void) { return FIPS_evp_sha1(); }
-const EVP_MD *EVP_sha224(void) { return FIPS_evp_sha224(); }
-const EVP_MD *EVP_sha256(void) { return FIPS_evp_sha256(); }
-const EVP_MD *EVP_sha384(void) { return FIPS_evp_sha384(); }
-const EVP_MD *EVP_sha512(void) { return FIPS_evp_sha512(); }
-
-const EVP_MD *EVP_dss(void) { return FIPS_evp_dss(); }
-const EVP_MD *EVP_dss1(void) { return FIPS_evp_dss1(); }
-const EVP_MD *EVP_ecdsa(void) { return FIPS_evp_ecdsa(); }
-
-#endif
int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
ASN1_TYPE *param,
const EVP_CIPHER *c, const EVP_MD *md, int en_de);
-
-#ifdef OPENSSL_FIPS
-
-#ifdef OPENSSL_DOING_MAKEDEPEND
-#undef SHA1_Init
-#undef SHA1_Update
-#undef SHA224_Init
-#undef SHA256_Init
-#undef SHA384_Init
-#undef SHA512_Init
-#undef DES_set_key_unchecked
-#endif
-
-#define RIPEMD160_Init private_RIPEMD160_Init
-#define WHIRLPOOL_Init private_WHIRLPOOL_Init
-#define MD5_Init private_MD5_Init
-#define MD4_Init private_MD4_Init
-#define MD2_Init private_MD2_Init
-#define MDC2_Init private_MDC2_Init
-#define SHA_Init private_SHA_Init
-#define SHA1_Init private_SHA1_Init
-#define SHA224_Init private_SHA224_Init
-#define SHA256_Init private_SHA256_Init
-#define SHA384_Init private_SHA384_Init
-#define SHA512_Init private_SHA512_Init
-
-#define BF_set_key private_BF_set_key
-#define CAST_set_key private_CAST_set_key
-#define idea_set_encrypt_key private_idea_set_encrypt_key
-#define SEED_set_key private_SEED_set_key
-#define RC2_set_key private_RC2_set_key
-#define RC4_set_key private_RC4_set_key
-#define DES_set_key_unchecked private_DES_set_key_unchecked
-#define Camellia_set_key private_Camellia_set_key
-
-#endif
#endif
#ifndef OPENSSL_NO_SHA
-#ifndef OPENSSL_FIPS
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&dsa_md);
}
#endif
-#endif
#include <openssl/dsa.h>
#endif
-#ifndef OPENSSL_FIPS
-
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&dss1_md);
}
#endif
-#endif
#include <openssl/x509.h>
#ifndef OPENSSL_NO_SHA
-#ifndef OPENSSL_FIPS
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&ecdsa_md);
}
#endif
-#endif
#include <stdio.h>
#include "cryptlib.h"
-#ifndef OPENSSL_FIPS
-
#ifndef OPENSSL_NO_SHA
#include <openssl/evp.h>
const EVP_MD *EVP_sha512(void)
{ return(&sha512_md); }
#endif /* ifndef OPENSSL_NO_SHA512 */
-
-#endif
+++ /dev/null
-#include <openssl/opensslconf.h>
-
-#ifdef OPENSSL_FIPS
-# include "fips_err.h"
-#else
-static void *dummy = &dummy;
-#endif
#include "cryptlib.h"
#include <openssl/hmac.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
const EVP_MD *md, ENGINE *impl)
{
int i,j,reset=0;
unsigned char pad[HMAC_MAX_MD_CBLOCK];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- /* If we have an ENGINE need to allow non FIPS */
- if ((impl || ctx->i_ctx.engine)
- && !(ctx->i_ctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
- {
- EVPerr(EVP_F_HMAC_INIT_EX, EVP_R_DISABLED_FOR_FIPS);
- return 0;
- }
- /* Other algorithm blocking will be done in FIPS_cmac_init,
- * via FIPS_hmac_init_ex().
- */
- if (!impl && !ctx->i_ctx.engine)
- return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
- }
-#endif
-
if (md != NULL)
{
reset=1;
int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- return FIPS_hmac_update(ctx, data, len);
-#endif
return EVP_DigestUpdate(&ctx->md_ctx,data,len);
}
{
unsigned int i;
unsigned char buf[EVP_MAX_MD_SIZE];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- return FIPS_hmac_final(ctx, md, len);
-#endif
if (!EVP_DigestFinal_ex(&ctx->md_ctx,buf,&i))
goto err;
void HMAC_CTX_cleanup(HMAC_CTX *ctx)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- {
- FIPS_hmac_ctx_cleanup(ctx);
- return;
- }
-#endif
EVP_MD_CTX_cleanup(&ctx->i_ctx);
EVP_MD_CTX_cleanup(&ctx->o_ctx);
EVP_MD_CTX_cleanup(&ctx->md_ctx);
static IDEA_INT inverse(unsigned int xin);
void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(IDEA);
- private_idea_set_encrypt_key(key, ks);
- }
-void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
-#endif
{
int i;
register IDEA_INT *kt,*kf,r0,r1,r2;
const char *idea_options(void);
void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,
IDEA_KEY_SCHEDULE *ks);
-#ifdef OPENSSL_FIPS
-void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
-#endif
void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,
} MD2_CTX;
const char *MD2_options(void);
-#ifdef OPENSSL_FIPS
-int private_MD2_Init(MD2_CTX *c);
-#endif
int MD2_Init(MD2_CTX *c);
int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len);
int MD2_Final(unsigned char *md, MD2_CTX *c);
unsigned int num;
} MD4_CTX;
-#ifdef OPENSSL_FIPS
-int private_MD4_Init(MD4_CTX *c);
-#endif
int MD4_Init(MD4_CTX *c);
int MD4_Update(MD4_CTX *c, const void *data, size_t len);
int MD4_Final(unsigned char *md, MD4_CTX *c);
unsigned int num;
} MD5_CTX;
-#ifdef OPENSSL_FIPS
-int private_MD5_Init(MD5_CTX *c);
-#endif
int MD5_Init(MD5_CTX *c);
int MD5_Update(MD5_CTX *c, const void *data, size_t len);
int MD5_Final(unsigned char *md, MD5_CTX *c);
} MDC2_CTX;
-#ifdef OPENSSL_FIPS
-int private_MDC2_Init(MDC2_CTX *c);
-#endif
int MDC2_Init(MDC2_CTX *c);
int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);
int MDC2_Final(unsigned char *md, MDC2_CTX *c);
*/
#include "cryptlib.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#include <openssl/fips_rand.h>
-#include <openssl/rand.h>
-#endif
int
FIPS_mode(void)
{
OPENSSL_init();
-#ifdef OPENSSL_FIPS
- return FIPS_module_mode();
-#else
return 0;
-#endif
}
int
FIPS_mode_set(int r)
{
OPENSSL_init();
-#ifdef OPENSSL_FIPS
-#ifndef FIPS_AUTH_USER_PASS
-#define FIPS_AUTH_USER_PASS "Default FIPS Crypto User Password"
-#endif
- if (!FIPS_module_mode_set(r, FIPS_AUTH_USER_PASS))
- return 0;
- if (r)
- RAND_set_rand_method(FIPS_rand_get_method());
- else
- RAND_set_rand_method(NULL);
- return 1;
-#else
if (r == 0)
return 1;
CRYPTOerr(CRYPTO_F_FIPS_MODE_SET, CRYPTO_R_FIPS_MODE_NOT_SUPPORTED);
return 0;
-#endif
}
#include <e_os.h>
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#include <openssl/rand.h>
-#endif
/* Perform any essential OpenSSL initialization operations.
* Currently only sets FIPS callbacks
if (done)
return;
done = 1;
-#ifdef OPENSSL_FIPS
- FIPS_set_locking_callbacks(CRYPTO_lock, CRYPTO_add_lock);
- FIPS_set_error_callbacks(ERR_put_error, ERR_add_error_vdata);
- FIPS_set_malloc_callbacks(CRYPTO_malloc, CRYPTO_free);
- RAND_init_fips();
-#endif
#if 0
fprintf(stderr, "Called OPENSSL_init\n");
#endif
* major minor fix final patch/beta)
*/
#define OPENSSL_VERSION_NUMBER 0x1000107fL
-#ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g-fips 7 Apr 2014"
-#else
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g 7 Apr 2014"
-#endif
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
#endif
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_RSAPrivateKey(BIO *bp, RSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_RSA(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_RSAPrivateKey,
- PEM_STRING_RSA,bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_RSAPrivateKey(FILE *fp, RSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
-
- EVP_PKEY_set1_RSA(k, x);
-
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_RSAPrivateKey,
- PEM_STRING_RSA,fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb_const(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw_const(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
return pkey_get_dsa(pktmp, dsa); /* will free pktmp */
}
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_DSAPrivateKey(BIO *bp, DSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_DSA(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_DSAPrivateKey,
- PEM_STRING_DSA,bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_DSAPrivateKey(FILE *fp, DSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_DSA(k, x);
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_DSAPrivateKey,
- PEM_STRING_DSA,fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb_const(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
#ifndef OPENSSL_NO_FP_API
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_ECPrivateKey(BIO *bp, EC_KEY *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_EC_KEY(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_ECPrivateKey,
- PEM_STRING_ECPRIVATEKEY,
- bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_ECPrivateKey(FILE *fp, EC_KEY *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_EC_KEY(k, x);
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_ECPrivateKey,
- PEM_STRING_ECPRIVATEKEY,
- fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb(ECPrivateKey, EC_KEY, PEM_STRING_ECPRIVATEKEY, ECPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw(EC_PUBKEY, EC_KEY, PEM_STRING_PUBLIC, EC_PUBKEY)
#ifndef OPENSSL_NO_FP_API
/* Set defaults */
if (!nid_cert)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
- else
-#endif
nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
}
if (!nid_key)
RC2_INT data[64];
} RC2_KEY;
-#ifdef OPENSSL_FIPS
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
-#endif
void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,
int enc);
* the same as specifying 1024 for the 'bits' parameter. Bsafe uses
* a version where the bits parameter is the same as len*8 */
void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(RC2);
- private_RC2_set_key(key, len, data, bits);
- }
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-#endif
{
int i,j;
unsigned char *k;
void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(RC4);
-#endif
private_RC4_set_key(key, len, data);
}
unsigned int num;
} RIPEMD160_CTX;
-#ifdef OPENSSL_FIPS
-int private_RIPEMD160_Init(RIPEMD160_CTX *c);
-#endif
int RIPEMD160_Init(RIPEMD160_CTX *c);
int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);
int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PUBLIC_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding));
}
int RSA_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PRIVATE_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding));
}
int RSA_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PRIVATE_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding));
}
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PUBLIC_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding));
}
#include "cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb);
* now just because key-generation is part of RSA_METHOD. */
int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_GENERATE_KEY_EX, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
if(rsa->meth->rsa_keygen)
return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_rsa_generate_key_ex(rsa, bits, e_value, cb);
-#endif
return rsa_builtin_keygen(rsa, bits, e_value, cb);
}
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char RSA_version[]="RSA" OPENSSL_VERSION_PTEXT;
static const RSA_METHOD *default_RSA_meth=NULL;
{
if (default_RSA_meth == NULL)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_rsa_pkcs1_ssleay();
- else
- return RSA_PKCS1_SSLeay();
-#else
#ifdef RSA_NULL
default_RSA_meth=RSA_null_method();
#else
default_RSA_meth=RSA_PKCS1_SSLeay();
-#endif
#endif
}
#ifndef OPENSSL_NO_CMS
#include <openssl/cms.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include "evp_locl.h"
#include "rsa_locl.h"
OPENSSL_free(rctx);
}
}
-#ifdef OPENSSL_FIPS
-/* FIP checker. Return value indicates status of context parameters:
- * 1 : redirect to FIPS.
- * 0 : don't redirect to FIPS.
- * -1 : illegal operation in FIPS mode.
- */
-
-static int pkey_fips_check_ctx(EVP_PKEY_CTX *ctx)
- {
- RSA_PKEY_CTX *rctx = ctx->data;
- RSA *rsa = ctx->pkey->pkey.rsa;
- int rv = -1;
- if (!FIPS_mode())
- return 0;
- if (rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
- rv = 0;
- if (!(rsa->meth->flags & RSA_FLAG_FIPS_METHOD) && rv)
- return -1;
- if (rctx->md && !(rctx->md->flags & EVP_MD_FLAG_FIPS))
- return rv;
- if (rctx->mgf1md && !(rctx->mgf1md->flags & EVP_MD_FLAG_FIPS))
- return rv;
- return 1;
- }
-#endif
-
static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
const unsigned char *tbs, size_t tbslen)
{
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
-#ifdef OPENSSL_FIPS
- ret = pkey_fips_check_ctx(ctx);
- if (ret < 0)
- {
- RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
- return -1;
- }
-#endif
-
if (rctx->md)
{
if (tbslen != (size_t)EVP_MD_size(rctx->md))
RSA_R_INVALID_DIGEST_LENGTH);
return -1;
}
-#ifdef OPENSSL_FIPS
- if (ret > 0)
- {
- unsigned int slen;
- ret = FIPS_rsa_sign_digest(rsa, tbs, tbslen, rctx->md,
- rctx->pad_mode,
- rctx->saltlen,
- rctx->mgf1md,
- sig, &slen);
- if (ret > 0)
- *siglen = slen;
- else
- *siglen = 0;
- return ret;
- }
-#endif
if (EVP_MD_type(rctx->md) == NID_mdc2)
{
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
size_t rslen;
-#ifdef OPENSSL_FIPS
- int rv;
- rv = pkey_fips_check_ctx(ctx);
- if (rv < 0)
- {
- RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
- return -1;
- }
-#endif
if (rctx->md)
{
-#ifdef OPENSSL_FIPS
- if (rv > 0)
- {
- return FIPS_rsa_verify_digest(rsa,
- tbs, tbslen,
- rctx->md,
- rctx->pad_mode,
- rctx->saltlen,
- rctx->mgf1md,
- sig, siglen);
-
- }
-#endif
if (rctx->pad_mode == RSA_PKCS1_PADDING)
return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
sig, siglen, rsa);
const unsigned char *s = NULL;
X509_ALGOR algor;
ASN1_OCTET_STRING digest;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign)
{
return rsa->meth->rsa_sign(type, m, m_len,
unsigned char *s;
X509_SIG *sig=NULL;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
-
if (siglen != (unsigned int)RSA_size(rsa))
{
RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);
KC8, KC9, KC10, KC11, KC12, KC13, KC14, KC15 };
#endif
void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(SEED);
- private_SEED_set_key(rawkey, ks);
- }
-void private_SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks)
-#endif
{
seed_word x1, x2, x3, x4;
seed_word t0, t1;
#endif
} SEED_KEY_SCHEDULE;
-#ifdef OPENSSL_FIPS
-void private_SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);
-#endif
void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);
void SEED_encrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks);
#error SHA is disabled.
#endif
-#if defined(OPENSSL_FIPS)
-#define FIPS_SHA_SIZE_T size_t
-#endif
-
/*
* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* ! SHA_LONG has to be at least 32 bits wide. If it's wider, then !
} SHA_CTX;
#ifndef OPENSSL_NO_SHA0
-#ifdef OPENSSL_FIPS
-int private_SHA_Init(SHA_CTX *c);
-#endif
int SHA_Init(SHA_CTX *c);
int SHA_Update(SHA_CTX *c, const void *data, size_t len);
int SHA_Final(unsigned char *md, SHA_CTX *c);
void SHA_Transform(SHA_CTX *c, const unsigned char *data);
#endif
#ifndef OPENSSL_NO_SHA1
-#ifdef OPENSSL_FIPS
-int private_SHA1_Init(SHA_CTX *c);
-#endif
int SHA1_Init(SHA_CTX *c);
int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
int SHA1_Final(unsigned char *md, SHA_CTX *c);
} SHA256_CTX;
#ifndef OPENSSL_NO_SHA256
-#ifdef OPENSSL_FIPS
-int private_SHA224_Init(SHA256_CTX *c);
-int private_SHA256_Init(SHA256_CTX *c);
-#endif
int SHA224_Init(SHA256_CTX *c);
int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
int SHA224_Final(unsigned char *md, SHA256_CTX *c);
#endif
#ifndef OPENSSL_NO_SHA512
-#ifdef OPENSSL_FIPS
-int private_SHA384_Init(SHA512_CTX *c);
-int private_SHA512_Init(SHA512_CTX *c);
-#endif
int SHA384_Init(SHA512_CTX *c);
int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);
int SHA384_Final(unsigned char *md, SHA512_CTX *c);
} WHIRLPOOL_CTX;
#ifndef OPENSSL_NO_WHIRLPOOL
-#ifdef OPENSSL_FIPS
-int private_WHIRLPOOL_Init(WHIRLPOOL_CTX *c);
-#endif
int WHIRLPOOL_Init (WHIRLPOOL_CTX *c);
int WHIRLPOOL_Update (WHIRLPOOL_CTX *c,const void *inp,size_t bytes);
void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c,const void *inp,size_t bits);
LIB= $(TOP)/libcrypto.a
SHARED_LIB= libcrypto$(SHLIB_EXT)
LIBSRC= cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \
- uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c fips_ers.c
+ uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c
LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o \
- uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o fips_ers.o $(CPUID_OBJ)
+ uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o $(CPUID_OBJ)
SRC= $(LIBSRC)
AES_set_encrypt_key(const unsigned char *userKey, const int bits,
AES_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(AES);
-#endif
return private_AES_set_encrypt_key(userKey, bits, key);
}
AES_set_decrypt_key(const unsigned char *userKey, const int bits,
AES_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(AES);
-#endif
return private_AES_set_decrypt_key(userKey, bits, key);
}
#include "bf_pi.h"
void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(BLOWFISH);
- private_BF_set_key(key, len, data);
- }
-void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data)
-#endif
{
int i;
BF_LONG *p,ri,in[2];
BF_LONG S[4*256];
} BF_KEY;
-#ifdef OPENSSL_FIPS
-void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);
-#endif
void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
void BF_encrypt(BF_LONG *data,const BF_KEY *key);
}
#endif /* !BN_LLONG */
-#if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS)
-#undef bn_div_words
-#endif
-
void bn_mul_normal(BN_ULONG *r,BN_ULONG *a,int na,BN_ULONG *b,int nb);
void bn_mul_comba8(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
void bn_mul_comba4(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
};
typedef struct camellia_key_st CAMELLIA_KEY;
-#ifdef OPENSSL_FIPS
-int private_Camellia_set_key(const unsigned char *userKey, const int bits,
- CAMELLIA_KEY *key);
-#endif
int Camellia_set_key(const unsigned char *userKey, const int bits,
CAMELLIA_KEY *key);
int Camellia_set_key(const unsigned char *userKey, const int bits,
CAMELLIA_KEY *key)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(Camellia);
-#endif
return private_Camellia_set_key(userKey, bits, key);
}
#define S6 CAST_S_table6
#define S7 CAST_S_table7
void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(CAST);
- private_CAST_set_key(key, len, data);
- }
-void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
-#endif
{
CAST_LONG x[16];
CAST_LONG z[16];
int short_key; /* Use reduced rounds for short key */
} CAST_KEY;
-#ifdef OPENSSL_FIPS
-void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
-#endif
void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAST_KEY *key,
int enc);
#include "cryptlib.h"
#include <openssl/cmac.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
struct CMAC_CTX_st
{
/* Cipher context to use */
void CMAC_CTX_cleanup(CMAC_CTX *ctx)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- {
- FIPS_cmac_ctx_cleanup(ctx);
- return;
- }
-#endif
EVP_CIPHER_CTX_cleanup(&ctx->cctx);
OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
const EVP_CIPHER *cipher, ENGINE *impl)
{
static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- /* If we have an ENGINE need to allow non FIPS */
- if ((impl || ctx->cctx.engine)
- && !(ctx->cctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
-
- {
- EVPerr(EVP_F_CMAC_INIT, EVP_R_DISABLED_FOR_FIPS);
- return 0;
- }
- /* Other algorithm blocking will be done in FIPS_cmac_init,
- * via FIPS_cipherinit().
- */
- if (!impl && !ctx->cctx.engine)
- return FIPS_cmac_init(ctx, key, keylen, cipher, NULL);
- }
-#endif
/* All zeros means restart */
if (!key && !cipher && !impl && keylen == 0)
{
{
const unsigned char *data = in;
size_t bl;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- return FIPS_cmac_update(ctx, in, dlen);
-#endif
+
if (ctx->nlast_block == -1)
return 0;
if (dlen == 0)
int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
{
int i, bl, lb;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->cctx.engine)
- return FIPS_cmac_final(ctx, out, poutlen);
-#endif
+
if (ctx->nlast_block == -1)
return 0;
bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
#define fips_md_init(alg) fips_md_init_ctx(alg, alg)
-#ifdef OPENSSL_FIPS
-#define fips_md_init_ctx(alg, cx) \
- int alg##_Init(cx##_CTX *c) \
- { \
- if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
- "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
- return private_##alg##_Init(c); \
- } \
- int private_##alg##_Init(cx##_CTX *c)
-
-#define fips_cipher_abort(alg) \
- if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
- "Low level API call to cipher " #alg " forbidden in FIPS mode!")
-
-#else
#define fips_md_init_ctx(alg, cx) \
int alg##_Init(cx##_CTX *c)
#define fips_cipher_abort(alg) while(0)
-#endif
/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It
* takes an amount of time dependent on |len|, but independent of the contents
int DES_key_sched(const_DES_cblock *key,DES_key_schedule *schedule);
int DES_set_key_checked(const_DES_cblock *key,DES_key_schedule *schedule);
void DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
-#ifdef OPENSSL_FIPS
-void private_DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
-#endif
void DES_string_to_key(const char *str,DES_cblock *key);
void DES_string_to_2keys(const char *str,DES_cblock *key1,DES_cblock *key2);
void DES_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,
}
void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(DES);
- private_DES_set_key_unchecked(key, schedule);
- }
-void private_DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
-#endif
{
static const int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
register DES_LONG c,d,t,s,t2;
#include <openssl/bn.h>
#include <openssl/dh.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
if(ret->meth->generate_params)
return ret->meth->generate_params(ret, prime_len, generator, cb);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dh_generate_parameters_ex(ret, prime_len,
- generator, cb);
-#endif
return dh_builtin_genparams(ret, prime_len, generator, cb);
}
int DH_generate_key(DH *dh)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_GENERATE_KEY, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
return dh->meth->generate_key(dh);
}
int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
- && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
- {
- DHerr(DH_F_DH_COMPUTE_KEY, DH_R_NON_FIPS_METHOD);
- return 0;
- }
-#endif
return dh->meth->compute_key(key, pub_key, dh);
}
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char DH_version[]="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
static const DH_METHOD *default_DH_method = NULL;
{
if(!default_DH_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dh_openssl();
- else
- return DH_OpenSSL();
-#else
default_DH_method = DH_OpenSSL();
-#endif
}
return default_DH_method;
}
#include <openssl/sha.h>
#include "dsa_locl.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
int DSA_generate_parameters_ex(DSA *ret, int bits,
const unsigned char *seed_in, int seed_len,
int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
if(ret->meth->dsa_paramgen)
return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
counter_ret, h_ret, cb);
-#ifdef OPENSSL_FIPS
- else if (FIPS_mode())
- {
- return FIPS_dsa_generate_parameters_ex(ret, bits,
- seed_in, seed_len,
- counter_ret, h_ret, cb);
- }
-#endif
else
{
const EVP_MD *evpmd;
#include <openssl/dsa.h>
#include <openssl/rand.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
static int dsa_builtin_keygen(DSA *dsa);
int DSA_generate_key(DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
if(dsa->meth->dsa_keygen)
return dsa->meth->dsa_keygen(dsa);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dsa_generate_key(dsa);
-#endif
return dsa_builtin_keygen(dsa);
}
#include <openssl/dh.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char DSA_version[]="DSA" OPENSSL_VERSION_PTEXT;
static const DSA_METHOD *default_DSA_method = NULL;
{
if(!default_DSA_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_dsa_openssl();
- else
- return DSA_OpenSSL();
-#else
default_DSA_method = DSA_OpenSSL();
-#endif
}
return default_DSA_method;
}
DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_NON_FIPS_DSA_METHOD);
- return NULL;
- }
-#endif
return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
}
int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_SIGN_SETUP, DSA_R_NON_FIPS_DSA_METHOD);
- return 0;
- }
-#endif
return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
}
int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
DSA *dsa)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
- && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
- {
- DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_NON_FIPS_DSA_METHOD);
- return -1;
- }
-#endif
return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
}
#ifndef OPENSSL_NO_EC2M
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
-
const EC_METHOD *EC_GF2m_simple_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gf2m_simple_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_characteristic_two_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
#include <string.h>
#include "ec_lcl.h"
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
EC_KEY *EC_KEY_new(void)
{
BIGNUM *priv_key = NULL, *order = NULL;
EC_POINT *pub_key = NULL;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ec_key_generate_key(eckey);
-#endif
-
if (!eckey || !eckey->group)
{
ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
#include "ec_lcl.h"
const EC_METHOD *EC_GFp_mont_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_mont_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
ec_GFp_mont_field_set_to_one };
return &ret;
-#endif
}
#include <openssl/obj_mac.h>
#include "ec_lcl.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const EC_METHOD *EC_GFp_nist_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_nist_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src)
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
#include "ec_lcl.h"
const EC_METHOD *EC_GFp_simple_method(void)
{
-#ifdef OPENSSL_FIPS
- return fips_ec_gfp_simple_method();
-#else
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
0 /* field_set_to_one */ };
return &ret;
-#endif
}
#include <openssl/engine.h>
#endif
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
const char ECDH_version[]="ECDH" OPENSSL_VERSION_PTEXT;
{
if(!default_ECDH_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ecdh_openssl();
- else
- return ECDH_OpenSSL();
-#else
default_ECDH_method = ECDH_OpenSSL();
-#endif
}
return default_ECDH_method;
}
}
else
ecdh_data = (ECDH_DATA *)data;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ecdh_data->flags & ECDH_FLAG_FIPS_METHOD)
- && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
- {
- ECDHerr(ECDH_F_ECDH_CHECK, ECDH_R_NON_FIPS_METHOD);
- return NULL;
- }
-#endif
-
return ecdh_data;
}
#endif
#include <openssl/err.h>
#include <openssl/bn.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
const char ECDSA_version[]="ECDSA" OPENSSL_VERSION_PTEXT;
{
if(!default_ECDSA_method)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ecdsa_openssl();
- else
- return ECDSA_OpenSSL();
-#else
default_ECDSA_method = ECDSA_OpenSSL();
-#endif
}
return default_ECDSA_method;
}
}
else
ecdsa_data = (ECDSA_DATA *)data;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ecdsa_data->flags & ECDSA_FLAG_FIPS_METHOD)
- && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
- {
- ECDSAerr(ECDSA_F_ECDSA_CHECK, ECDSA_R_NON_FIPS_METHOD);
- return NULL;
- }
-#endif
return ecdsa_data;
}
#include <openssl/ui.h>
#include <openssl/ocsp.h>
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include <openssl/ts.h>
#ifndef OPENSSL_NO_CMS
#include <openssl/cms.h>
#endif
ERR_load_OCSP_strings();
ERR_load_UI_strings();
-#ifdef OPENSSL_FIPS
- ERR_load_FIPS_strings();
-#endif
#ifndef OPENSSL_NO_CMS
ERR_load_CMS_strings();
#endif
bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
- e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c \
+ e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \
e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \
bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \
c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
- e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o \
+ e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o \
e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o
SRC= $(LIBSRC)
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
{
memset(ctx,'\0',sizeof *ctx);
}
if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
return 1;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- if (FIPS_digestinit(ctx, type))
- return 1;
- OPENSSL_free(ctx->md_data);
- ctx->md_data = NULL;
- return 0;
- }
-#endif
return ctx->digest->init(ctx);
}
int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
{
-#ifdef OPENSSL_FIPS
- return FIPS_digestupdate(ctx, data, count);
-#else
return ctx->update(ctx,data,count);
-#endif
}
/* The caller can assume that this removes any secret data from the context */
/* The caller can assume that this removes any secret data from the context */
int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
{
-#ifdef OPENSSL_FIPS
- return FIPS_digestfinal(ctx, md, size);
-#else
int ret;
OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
}
memset(ctx->md_data,0,ctx->digest->ctx_size);
return ret;
-#endif
}
int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* This call frees resources associated with the context */
int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
{
-#ifndef OPENSSL_FIPS
/* Don't assume ctx->md_data was cleaned in EVP_Digest_Final,
* because sometimes only copies of the context are ever finalised.
*/
OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
OPENSSL_free(ctx->md_data);
}
-#endif
if (ctx->pctx)
EVP_PKEY_CTX_free(ctx->pctx);
#ifndef OPENSSL_NO_ENGINE
/* The EVP_MD we used belongs to an ENGINE, release the
* functional reference we held for this reason. */
ENGINE_finish(ctx->engine);
-#endif
-#ifdef OPENSSL_FIPS
- FIPS_md_ctx_cleanup(ctx);
#endif
memset(ctx,'\0',sizeof *ctx);
#include <openssl/evp.h>
#include <openssl/objects.h>
-#ifndef OPENSSL_FIPS
-
static int null_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
const unsigned char *iv,int enc);
static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
memcpy((char *)out,(const char *)in,inl);
return 1;
}
-#endif
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include "evp_locl.h"
-#ifdef OPENSSL_FIPS
-#define M_do_cipher(ctx, out, in, inl) FIPS_cipher(ctx, out, in, inl)
-#else
#define M_do_cipher(ctx, out, in, inl) ctx->cipher->do_cipher(ctx, out, in, inl)
-#endif
-
const char EVP_version[]="EVP" OPENSSL_VERSION_PTEXT;
ctx->engine = NULL;
#endif
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_cipherinit(ctx, cipher, key, iv, enc);
-#endif
ctx->cipher=cipher;
if (ctx->cipher->ctx_size)
{
}
#ifndef OPENSSL_NO_ENGINE
skip_to_init:
-#endif
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_cipherinit(ctx, cipher, key, iv, enc);
#endif
/* we assume block size is a power of 2 in *cryptUpdate */
OPENSSL_assert(ctx->cipher->block_size == 1
int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
{
-#ifndef OPENSSL_FIPS
if (c->cipher != NULL)
{
if(c->cipher->cleanup && !c->cipher->cleanup(c))
}
if (c->cipher_data)
OPENSSL_free(c->cipher_data);
-#endif
#ifndef OPENSSL_NO_ENGINE
if (c->engine)
/* The EVP_CIPHER we used belongs to an ENGINE, release the
* functional reference we held for this reason. */
ENGINE_finish(c->engine);
-#endif
-#ifdef OPENSSL_FIPS
- FIPS_cipher_ctx_cleanup(c);
#endif
memset(c,0,sizeof(EVP_CIPHER_CTX));
return 1;
+++ /dev/null
-/* crypto/evp/evp_fips.c */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- */
-
-
-#include <openssl/evp.h>
-
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-
-const EVP_CIPHER *EVP_aes_128_cbc(void) { return FIPS_evp_aes_128_cbc(); }
-const EVP_CIPHER *EVP_aes_128_ccm(void) { return FIPS_evp_aes_128_ccm(); }
-const EVP_CIPHER *EVP_aes_128_cfb1(void) { return FIPS_evp_aes_128_cfb1(); }
-const EVP_CIPHER *EVP_aes_128_cfb128(void) { return FIPS_evp_aes_128_cfb128(); }
-const EVP_CIPHER *EVP_aes_128_cfb8(void) { return FIPS_evp_aes_128_cfb8(); }
-const EVP_CIPHER *EVP_aes_128_ctr(void) { return FIPS_evp_aes_128_ctr(); }
-const EVP_CIPHER *EVP_aes_128_ecb(void) { return FIPS_evp_aes_128_ecb(); }
-const EVP_CIPHER *EVP_aes_128_gcm(void) { return FIPS_evp_aes_128_gcm(); }
-const EVP_CIPHER *EVP_aes_128_ofb(void) { return FIPS_evp_aes_128_ofb(); }
-const EVP_CIPHER *EVP_aes_128_xts(void) { return FIPS_evp_aes_128_xts(); }
-const EVP_CIPHER *EVP_aes_192_cbc(void) { return FIPS_evp_aes_192_cbc(); }
-const EVP_CIPHER *EVP_aes_192_ccm(void) { return FIPS_evp_aes_192_ccm(); }
-const EVP_CIPHER *EVP_aes_192_cfb1(void) { return FIPS_evp_aes_192_cfb1(); }
-const EVP_CIPHER *EVP_aes_192_cfb128(void) { return FIPS_evp_aes_192_cfb128(); }
-const EVP_CIPHER *EVP_aes_192_cfb8(void) { return FIPS_evp_aes_192_cfb8(); }
-const EVP_CIPHER *EVP_aes_192_ctr(void) { return FIPS_evp_aes_192_ctr(); }
-const EVP_CIPHER *EVP_aes_192_ecb(void) { return FIPS_evp_aes_192_ecb(); }
-const EVP_CIPHER *EVP_aes_192_gcm(void) { return FIPS_evp_aes_192_gcm(); }
-const EVP_CIPHER *EVP_aes_192_ofb(void) { return FIPS_evp_aes_192_ofb(); }
-const EVP_CIPHER *EVP_aes_256_cbc(void) { return FIPS_evp_aes_256_cbc(); }
-const EVP_CIPHER *EVP_aes_256_ccm(void) { return FIPS_evp_aes_256_ccm(); }
-const EVP_CIPHER *EVP_aes_256_cfb1(void) { return FIPS_evp_aes_256_cfb1(); }
-const EVP_CIPHER *EVP_aes_256_cfb128(void) { return FIPS_evp_aes_256_cfb128(); }
-const EVP_CIPHER *EVP_aes_256_cfb8(void) { return FIPS_evp_aes_256_cfb8(); }
-const EVP_CIPHER *EVP_aes_256_ctr(void) { return FIPS_evp_aes_256_ctr(); }
-const EVP_CIPHER *EVP_aes_256_ecb(void) { return FIPS_evp_aes_256_ecb(); }
-const EVP_CIPHER *EVP_aes_256_gcm(void) { return FIPS_evp_aes_256_gcm(); }
-const EVP_CIPHER *EVP_aes_256_ofb(void) { return FIPS_evp_aes_256_ofb(); }
-const EVP_CIPHER *EVP_aes_256_xts(void) { return FIPS_evp_aes_256_xts(); }
-const EVP_CIPHER *EVP_des_ede(void) { return FIPS_evp_des_ede(); }
-const EVP_CIPHER *EVP_des_ede3(void) { return FIPS_evp_des_ede3(); }
-const EVP_CIPHER *EVP_des_ede3_cbc(void) { return FIPS_evp_des_ede3_cbc(); }
-const EVP_CIPHER *EVP_des_ede3_cfb1(void) { return FIPS_evp_des_ede3_cfb1(); }
-const EVP_CIPHER *EVP_des_ede3_cfb64(void) { return FIPS_evp_des_ede3_cfb64(); }
-const EVP_CIPHER *EVP_des_ede3_cfb8(void) { return FIPS_evp_des_ede3_cfb8(); }
-const EVP_CIPHER *EVP_des_ede3_ecb(void) { return FIPS_evp_des_ede3_ecb(); }
-const EVP_CIPHER *EVP_des_ede3_ofb(void) { return FIPS_evp_des_ede3_ofb(); }
-const EVP_CIPHER *EVP_des_ede_cbc(void) { return FIPS_evp_des_ede_cbc(); }
-const EVP_CIPHER *EVP_des_ede_cfb64(void) { return FIPS_evp_des_ede_cfb64(); }
-const EVP_CIPHER *EVP_des_ede_ecb(void) { return FIPS_evp_des_ede_ecb(); }
-const EVP_CIPHER *EVP_des_ede_ofb(void) { return FIPS_evp_des_ede_ofb(); }
-const EVP_CIPHER *EVP_enc_null(void) { return FIPS_evp_enc_null(); }
-
-const EVP_MD *EVP_sha1(void) { return FIPS_evp_sha1(); }
-const EVP_MD *EVP_sha224(void) { return FIPS_evp_sha224(); }
-const EVP_MD *EVP_sha256(void) { return FIPS_evp_sha256(); }
-const EVP_MD *EVP_sha384(void) { return FIPS_evp_sha384(); }
-const EVP_MD *EVP_sha512(void) { return FIPS_evp_sha512(); }
-
-const EVP_MD *EVP_dss(void) { return FIPS_evp_dss(); }
-const EVP_MD *EVP_dss1(void) { return FIPS_evp_dss1(); }
-const EVP_MD *EVP_ecdsa(void) { return FIPS_evp_ecdsa(); }
-
-#endif
int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
ASN1_TYPE *param,
const EVP_CIPHER *c, const EVP_MD *md, int en_de);
-
-#ifdef OPENSSL_FIPS
-
-#ifdef OPENSSL_DOING_MAKEDEPEND
-#undef SHA1_Init
-#undef SHA1_Update
-#undef SHA224_Init
-#undef SHA256_Init
-#undef SHA384_Init
-#undef SHA512_Init
-#undef DES_set_key_unchecked
-#endif
-
-#define RIPEMD160_Init private_RIPEMD160_Init
-#define WHIRLPOOL_Init private_WHIRLPOOL_Init
-#define MD5_Init private_MD5_Init
-#define MD4_Init private_MD4_Init
-#define MD2_Init private_MD2_Init
-#define MDC2_Init private_MDC2_Init
-#define SHA_Init private_SHA_Init
-#define SHA1_Init private_SHA1_Init
-#define SHA224_Init private_SHA224_Init
-#define SHA256_Init private_SHA256_Init
-#define SHA384_Init private_SHA384_Init
-#define SHA512_Init private_SHA512_Init
-
-#define BF_set_key private_BF_set_key
-#define CAST_set_key private_CAST_set_key
-#define idea_set_encrypt_key private_idea_set_encrypt_key
-#define SEED_set_key private_SEED_set_key
-#define RC2_set_key private_RC2_set_key
-#define RC4_set_key private_RC4_set_key
-#define DES_set_key_unchecked private_DES_set_key_unchecked
-#define Camellia_set_key private_Camellia_set_key
-
-#endif
#endif
#ifndef OPENSSL_NO_SHA
-#ifndef OPENSSL_FIPS
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&dsa_md);
}
#endif
-#endif
#include <openssl/dsa.h>
#endif
-#ifndef OPENSSL_FIPS
-
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&dss1_md);
}
#endif
-#endif
#include <openssl/x509.h>
#ifndef OPENSSL_NO_SHA
-#ifndef OPENSSL_FIPS
static int init(EVP_MD_CTX *ctx)
{ return SHA1_Init(ctx->md_data); }
return(&ecdsa_md);
}
#endif
-#endif
#include <stdio.h>
#include "cryptlib.h"
-#ifndef OPENSSL_FIPS
-
#ifndef OPENSSL_NO_SHA
#include <openssl/evp.h>
const EVP_MD *EVP_sha512(void)
{ return(&sha512_md); }
#endif /* ifndef OPENSSL_NO_SHA512 */
-
-#endif
+++ /dev/null
-#include <openssl/opensslconf.h>
-
-#ifdef OPENSSL_FIPS
-# include "fips_err.h"
-#else
-static void *dummy = &dummy;
-#endif
#include "cryptlib.h"
#include <openssl/hmac.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
const EVP_MD *md, ENGINE *impl)
{
int i,j,reset=0;
unsigned char pad[HMAC_MAX_MD_CBLOCK];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- {
- /* If we have an ENGINE need to allow non FIPS */
- if ((impl || ctx->i_ctx.engine)
- && !(ctx->i_ctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
- {
- EVPerr(EVP_F_HMAC_INIT_EX, EVP_R_DISABLED_FOR_FIPS);
- return 0;
- }
- /* Other algorithm blocking will be done in FIPS_cmac_init,
- * via FIPS_hmac_init_ex().
- */
- if (!impl && !ctx->i_ctx.engine)
- return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
- }
-#endif
-
if (md != NULL)
{
reset=1;
int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- return FIPS_hmac_update(ctx, data, len);
-#endif
return EVP_DigestUpdate(&ctx->md_ctx,data,len);
}
{
unsigned int i;
unsigned char buf[EVP_MAX_MD_SIZE];
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- return FIPS_hmac_final(ctx, md, len);
-#endif
if (!EVP_DigestFinal_ex(&ctx->md_ctx,buf,&i))
goto err;
void HMAC_CTX_cleanup(HMAC_CTX *ctx)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !ctx->i_ctx.engine)
- {
- FIPS_hmac_ctx_cleanup(ctx);
- return;
- }
-#endif
EVP_MD_CTX_cleanup(&ctx->i_ctx);
EVP_MD_CTX_cleanup(&ctx->o_ctx);
EVP_MD_CTX_cleanup(&ctx->md_ctx);
static IDEA_INT inverse(unsigned int xin);
void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(IDEA);
- private_idea_set_encrypt_key(key, ks);
- }
-void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
-#endif
{
int i;
register IDEA_INT *kt,*kf,r0,r1,r2;
const char *idea_options(void);
void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,
IDEA_KEY_SCHEDULE *ks);
-#ifdef OPENSSL_FIPS
-void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
-#endif
void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,
} MD2_CTX;
const char *MD2_options(void);
-#ifdef OPENSSL_FIPS
-int private_MD2_Init(MD2_CTX *c);
-#endif
int MD2_Init(MD2_CTX *c);
int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len);
int MD2_Final(unsigned char *md, MD2_CTX *c);
unsigned int num;
} MD4_CTX;
-#ifdef OPENSSL_FIPS
-int private_MD4_Init(MD4_CTX *c);
-#endif
int MD4_Init(MD4_CTX *c);
int MD4_Update(MD4_CTX *c, const void *data, size_t len);
int MD4_Final(unsigned char *md, MD4_CTX *c);
unsigned int num;
} MD5_CTX;
-#ifdef OPENSSL_FIPS
-int private_MD5_Init(MD5_CTX *c);
-#endif
int MD5_Init(MD5_CTX *c);
int MD5_Update(MD5_CTX *c, const void *data, size_t len);
int MD5_Final(unsigned char *md, MD5_CTX *c);
} MDC2_CTX;
-#ifdef OPENSSL_FIPS
-int private_MDC2_Init(MDC2_CTX *c);
-#endif
int MDC2_Init(MDC2_CTX *c);
int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);
int MDC2_Final(unsigned char *md, MDC2_CTX *c);
*/
#include "cryptlib.h"
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#include <openssl/fips_rand.h>
-#include <openssl/rand.h>
-#endif
int
FIPS_mode(void)
{
OPENSSL_init();
-#ifdef OPENSSL_FIPS
- return FIPS_module_mode();
-#else
return 0;
-#endif
}
int
FIPS_mode_set(int r)
{
OPENSSL_init();
-#ifdef OPENSSL_FIPS
-#ifndef FIPS_AUTH_USER_PASS
-#define FIPS_AUTH_USER_PASS "Default FIPS Crypto User Password"
-#endif
- if (!FIPS_module_mode_set(r, FIPS_AUTH_USER_PASS))
- return 0;
- if (r)
- RAND_set_rand_method(FIPS_rand_get_method());
- else
- RAND_set_rand_method(NULL);
- return 1;
-#else
if (r == 0)
return 1;
CRYPTOerr(CRYPTO_F_FIPS_MODE_SET, CRYPTO_R_FIPS_MODE_NOT_SUPPORTED);
return 0;
-#endif
}
#include <e_os.h>
#include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#include <openssl/rand.h>
-#endif
/* Perform any essential OpenSSL initialization operations.
* Currently only sets FIPS callbacks
if (done)
return;
done = 1;
-#ifdef OPENSSL_FIPS
- FIPS_set_locking_callbacks(CRYPTO_lock, CRYPTO_add_lock);
- FIPS_set_error_callbacks(ERR_put_error, ERR_add_error_vdata);
- FIPS_set_malloc_callbacks(CRYPTO_malloc, CRYPTO_free);
- RAND_init_fips();
-#endif
#if 0
fprintf(stderr, "Called OPENSSL_init\n");
#endif
* major minor fix final patch/beta)
*/
#define OPENSSL_VERSION_NUMBER 0x1000107fL
-#ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g-fips 7 Apr 2014"
-#else
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g 7 Apr 2014"
-#endif
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
#endif
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_RSAPrivateKey(BIO *bp, RSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_RSA(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_RSAPrivateKey,
- PEM_STRING_RSA,bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_RSAPrivateKey(FILE *fp, RSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
-
- EVP_PKEY_set1_RSA(k, x);
-
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_RSAPrivateKey,
- PEM_STRING_RSA,fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb_const(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw_const(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
return pkey_get_dsa(pktmp, dsa); /* will free pktmp */
}
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_DSAPrivateKey(BIO *bp, DSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_DSA(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_DSAPrivateKey,
- PEM_STRING_DSA,bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_DSAPrivateKey(FILE *fp, DSA *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_DSA(k, x);
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_DSAPrivateKey,
- PEM_STRING_DSA,fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb_const(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
#ifndef OPENSSL_NO_FP_API
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_ECPrivateKey(BIO *bp, EC_KEY *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_EC_KEY(k, x);
-
- ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write_bio((i2d_of_void *)i2d_ECPrivateKey,
- PEM_STRING_ECPRIVATEKEY,
- bp,x,enc,kstr,klen,cb,u);
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_ECPrivateKey(FILE *fp, EC_KEY *x, const EVP_CIPHER *enc,
- unsigned char *kstr, int klen,
- pem_password_cb *cb, void *u)
-{
- if (FIPS_mode())
- {
- EVP_PKEY *k;
- int ret;
- k = EVP_PKEY_new();
- if (!k)
- return 0;
- EVP_PKEY_set1_EC_KEY(k, x);
- ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
- EVP_PKEY_free(k);
- return ret;
- }
- else
- return PEM_ASN1_write((i2d_of_void *)i2d_ECPrivateKey,
- PEM_STRING_ECPRIVATEKEY,
- fp,x,enc,kstr,klen,cb,u);
-}
-#endif
-
-#else
-
IMPLEMENT_PEM_write_cb(ECPrivateKey, EC_KEY, PEM_STRING_ECPRIVATEKEY, ECPrivateKey)
-#endif
-
IMPLEMENT_PEM_rw(EC_PUBKEY, EC_KEY, PEM_STRING_PUBLIC, EC_PUBKEY)
#ifndef OPENSSL_NO_FP_API
/* Set defaults */
if (!nid_cert)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
- else
-#endif
nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
}
if (!nid_key)
RC2_INT data[64];
} RC2_KEY;
-#ifdef OPENSSL_FIPS
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
-#endif
void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,
int enc);
* the same as specifying 1024 for the 'bits' parameter. Bsafe uses
* a version where the bits parameter is the same as len*8 */
void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(RC2);
- private_RC2_set_key(key, len, data, bits);
- }
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-#endif
{
int i,j;
unsigned char *k;
void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
{
-#ifdef OPENSSL_FIPS
- fips_cipher_abort(RC4);
-#endif
private_RC4_set_key(key, len, data);
}
unsigned int num;
} RIPEMD160_CTX;
-#ifdef OPENSSL_FIPS
-int private_RIPEMD160_Init(RIPEMD160_CTX *c);
-#endif
int RIPEMD160_Init(RIPEMD160_CTX *c);
int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);
int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PUBLIC_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding));
}
int RSA_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PRIVATE_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding));
}
int RSA_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PRIVATE_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding));
}
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
RSA *rsa, int padding)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_PUBLIC_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
- return -1;
- }
-#endif
return(rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding));
}
#include "cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb);
* now just because key-generation is part of RSA_METHOD. */
int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_GENERATE_KEY_EX, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
if(rsa->meth->rsa_keygen)
return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_rsa_generate_key_ex(rsa, bits, e_value, cb);
-#endif
return rsa_builtin_keygen(rsa, bits, e_value, cb);
}
#include <openssl/engine.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
const char RSA_version[]="RSA" OPENSSL_VERSION_PTEXT;
static const RSA_METHOD *default_RSA_meth=NULL;
{
if (default_RSA_meth == NULL)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_rsa_pkcs1_ssleay();
- else
- return RSA_PKCS1_SSLeay();
-#else
#ifdef RSA_NULL
default_RSA_meth=RSA_null_method();
#else
default_RSA_meth=RSA_PKCS1_SSLeay();
-#endif
#endif
}
#ifndef OPENSSL_NO_CMS
#include <openssl/cms.h>
#endif
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
#include "evp_locl.h"
#include "rsa_locl.h"
OPENSSL_free(rctx);
}
}
-#ifdef OPENSSL_FIPS
-/* FIP checker. Return value indicates status of context parameters:
- * 1 : redirect to FIPS.
- * 0 : don't redirect to FIPS.
- * -1 : illegal operation in FIPS mode.
- */
-
-static int pkey_fips_check_ctx(EVP_PKEY_CTX *ctx)
- {
- RSA_PKEY_CTX *rctx = ctx->data;
- RSA *rsa = ctx->pkey->pkey.rsa;
- int rv = -1;
- if (!FIPS_mode())
- return 0;
- if (rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
- rv = 0;
- if (!(rsa->meth->flags & RSA_FLAG_FIPS_METHOD) && rv)
- return -1;
- if (rctx->md && !(rctx->md->flags & EVP_MD_FLAG_FIPS))
- return rv;
- if (rctx->mgf1md && !(rctx->mgf1md->flags & EVP_MD_FLAG_FIPS))
- return rv;
- return 1;
- }
-#endif
-
static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
const unsigned char *tbs, size_t tbslen)
{
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
-#ifdef OPENSSL_FIPS
- ret = pkey_fips_check_ctx(ctx);
- if (ret < 0)
- {
- RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
- return -1;
- }
-#endif
-
if (rctx->md)
{
if (tbslen != (size_t)EVP_MD_size(rctx->md))
RSA_R_INVALID_DIGEST_LENGTH);
return -1;
}
-#ifdef OPENSSL_FIPS
- if (ret > 0)
- {
- unsigned int slen;
- ret = FIPS_rsa_sign_digest(rsa, tbs, tbslen, rctx->md,
- rctx->pad_mode,
- rctx->saltlen,
- rctx->mgf1md,
- sig, &slen);
- if (ret > 0)
- *siglen = slen;
- else
- *siglen = 0;
- return ret;
- }
-#endif
if (EVP_MD_type(rctx->md) == NID_mdc2)
{
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
size_t rslen;
-#ifdef OPENSSL_FIPS
- int rv;
- rv = pkey_fips_check_ctx(ctx);
- if (rv < 0)
- {
- RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
- return -1;
- }
-#endif
if (rctx->md)
{
-#ifdef OPENSSL_FIPS
- if (rv > 0)
- {
- return FIPS_rsa_verify_digest(rsa,
- tbs, tbslen,
- rctx->md,
- rctx->pad_mode,
- rctx->saltlen,
- rctx->mgf1md,
- sig, siglen);
-
- }
-#endif
if (rctx->pad_mode == RSA_PKCS1_PADDING)
return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
sig, siglen, rsa);
const unsigned char *s = NULL;
X509_ALGOR algor;
ASN1_OCTET_STRING digest;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign)
{
return rsa->meth->rsa_sign(type, m, m_len,
unsigned char *s;
X509_SIG *sig=NULL;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
- && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
- {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_NON_FIPS_RSA_METHOD);
- return 0;
- }
-#endif
-
if (siglen != (unsigned int)RSA_size(rsa))
{
RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);
KC8, KC9, KC10, KC11, KC12, KC13, KC14, KC15 };
#endif
void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks)
-#ifdef OPENSSL_FIPS
- {
- fips_cipher_abort(SEED);
- private_SEED_set_key(rawkey, ks);
- }
-void private_SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks)
-#endif
{
seed_word x1, x2, x3, x4;
seed_word t0, t1;
#endif
} SEED_KEY_SCHEDULE;
-#ifdef OPENSSL_FIPS
-void private_SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);
-#endif
void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);
void SEED_encrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks);
#error SHA is disabled.
#endif
-#if defined(OPENSSL_FIPS)
-#define FIPS_SHA_SIZE_T size_t
-#endif
-
/*
* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* ! SHA_LONG has to be at least 32 bits wide. If it's wider, then !
} SHA_CTX;
#ifndef OPENSSL_NO_SHA0
-#ifdef OPENSSL_FIPS
-int private_SHA_Init(SHA_CTX *c);
-#endif
int SHA_Init(SHA_CTX *c);
int SHA_Update(SHA_CTX *c, const void *data, size_t len);
int SHA_Final(unsigned char *md, SHA_CTX *c);
void SHA_Transform(SHA_CTX *c, const unsigned char *data);
#endif
#ifndef OPENSSL_NO_SHA1
-#ifdef OPENSSL_FIPS
-int private_SHA1_Init(SHA_CTX *c);
-#endif
int SHA1_Init(SHA_CTX *c);
int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
int SHA1_Final(unsigned char *md, SHA_CTX *c);
} SHA256_CTX;
#ifndef OPENSSL_NO_SHA256
-#ifdef OPENSSL_FIPS
-int private_SHA224_Init(SHA256_CTX *c);
-int private_SHA256_Init(SHA256_CTX *c);
-#endif
int SHA224_Init(SHA256_CTX *c);
int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
int SHA224_Final(unsigned char *md, SHA256_CTX *c);
#endif
#ifndef OPENSSL_NO_SHA512
-#ifdef OPENSSL_FIPS
-int private_SHA384_Init(SHA512_CTX *c);
-int private_SHA512_Init(SHA512_CTX *c);
-#endif
int SHA384_Init(SHA512_CTX *c);
int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);
int SHA384_Final(unsigned char *md, SHA512_CTX *c);
} WHIRLPOOL_CTX;
#ifndef OPENSSL_NO_WHIRLPOOL
-#ifdef OPENSSL_FIPS
-int private_WHIRLPOOL_Init(WHIRLPOOL_CTX *c);
-#endif
int WHIRLPOOL_Init (WHIRLPOOL_CTX *c);
int WHIRLPOOL_Update (WHIRLPOOL_CTX *c,const void *inp,size_t bytes);
void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c,const void *inp,size_t bits);
projects / openbsd / commitdiff