Move more comments that confuse indent

[openssl.git] / crypto / dsa / dsa.h

diff --git a/crypto/dsa/dsa.h b/crypto/dsa/dsa.h
index 3d401830a97290d66ae91714a661e0f644f1393a..ac5f9c9c6506d62f900947b3f6432f10c0aa894b 100644 (file)
--- a/crypto/dsa/dsa.h
+++ b/crypto/dsa/dsa.h
@@ -77,7 +77,7 @@
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
 
-#ifndef OPENSSL_NO_DEPRECATED
+#ifdef OPENSSL_USE_DEPRECATED
 #include <openssl/bn.h>
 #ifndef OPENSSL_NO_DH
 # include <openssl/dh.h>
@@ -88,14 +88,39 @@
 # define OPENSSL_DSA_MAX_MODULUS_BITS  10000
 #endif
 
+#define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024
+
 #define DSA_FLAG_CACHE_MONT_P  0x01
-#define DSA_FLAG_NO_EXP_CONSTTIME       0x02 /* new with 0.9.7h; the built-in DSA
-                                              * implementation now uses constant time
-                                              * modular exponentiation for secret exponents
-                                              * by default. This flag causes the
-                                              * faster variable sliding window method to
-                                              * be used for all exponents.
-                                              */
+/* new with 0.9.7h; the
+ * built-in DSA
+ * implementation now
+ * uses constant time
+ * modular exponentiation
+ * for secret exponents
+ * by default. This flag
+ * causes the faster
+ * variable sliding
+ * window method to be
+ * used for all
+ * exponents.
+ */
+#define DSA_FLAG_NO_EXP_CONSTTIME       0x02
+
+/* If this flag is set the DSA method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its reposibility
+ * to ensure the result is compliant.
+ */
+
+#define DSA_FLAG_FIPS_METHOD                   0x0400
+
+/* If this flag is set the operations normally disabled in FIPS mode are
+ * permitted it is then the applications responsibility to ensure that the
+ * usage is compliant.
+ */
+
+#define DSA_FLAG_NON_FIPS_ALLOW                        0x0400
+#define DSA_FLAG_FIPS_CHECKED                  0x0800
 
 #ifdef  __cplusplus
 extern "C" {
@@ -122,9 +147,10 @@ struct dsa_method
        int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
                        BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
                        BN_MONT_CTX *in_mont);
+       /* Can be null */
        int (*bn_mod_exp)(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
                                const BIGNUM *m, BN_CTX *ctx,
-                               BN_MONT_CTX *m_ctx); /* Can be null */
+                               BN_MONT_CTX *m_ctx);
        int (*init)(DSA *dsa);
        int (*finish)(DSA *dsa);
        int flags;
@@ -195,6 +221,7 @@ void        DSA_free (DSA *r);
 /* "up" the DSA object's reference count */
 int    DSA_up_ref(DSA *r);
 int    DSA_size(const DSA *);
+int    DSA_security_bits(const DSA *d);
        /* next 4 return -1 on error */
 int    DSA_sign_setup( DSA *dsa,BN_CTX *ctx_in,BIGNUM **kinvp,BIGNUM **rp);
 int    DSA_sign(int type,const unsigned char *dgst,int dlen,
@@ -211,12 +238,12 @@ DSA *     d2i_DSAPrivateKey(DSA **a, const unsigned char **pp, long length);
 DSA *  d2i_DSAparams(DSA **a, const unsigned char **pp, long length);
 
 /* Deprecated version */
-#ifndef OPENSSL_NO_DEPRECATED
-DSA *  DSA_generate_parameters(int bits,
+#ifdef OPENSSL_USE_DEPRECATED
+DECLARE_DEPRECATED(DSA *       DSA_generate_parameters(int bits,
                unsigned char *seed,int seed_len,
                int *counter_ret, unsigned long *h_ret,void
-               (*callback)(int, int, void *),void *cb_arg);
-#endif /* !defined(OPENSSL_NO_DEPRECATED) */
+               (*callback)(int, int, void *),void *cb_arg));
+#endif /* defined(OPENSSL_USE_DEPRECATED) */
 
 /* New version */
 int    DSA_generate_parameters_ex(DSA *dsa, int bits,
@@ -232,7 +259,7 @@ int i2d_DSAparams(const DSA *a,unsigned char **pp);
 int    DSAparams_print(BIO *bp, const DSA *x);
 int    DSA_print(BIO *bp, const DSA *x, int off);
 #endif
-#ifndef OPENSSL_NO_FP_API
+#ifndef OPENSSL_NO_STDIO
 int    DSAparams_print_fp(FILE *fp, const DSA *x);
 int    DSA_print_fp(FILE *bp, const DSA *x, int off);
 #endif
@@ -270,6 +297,9 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_DO_DSA_PRINT                              104
 #define DSA_F_DSAPARAMS_PRINT                           100
 #define DSA_F_DSAPARAMS_PRINT_FP                        101
+#define DSA_F_DSA_BUILTIN_KEYGEN                        124
+#define DSA_F_DSA_BUILTIN_PARAMGEN                      125
+#define DSA_F_DSA_BUILTIN_PARAMGEN2                     126
 #define DSA_F_DSA_DO_SIGN                               112
 #define DSA_F_DSA_DO_VERIFY                             113
 #define DSA_F_DSA_NEW_METHOD                            103
@@ -297,11 +327,14 @@ void ERR_load_DSA_strings(void);
 #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE               100
 #define DSA_R_DECODE_ERROR                              104
 #define DSA_R_INVALID_DIGEST_TYPE                       106
+#define DSA_R_INVALID_PARAMETERS                        112
+#define DSA_R_KEY_SIZE_TOO_SMALL                        111
 #define DSA_R_MISSING_PARAMETERS                        101
 #define DSA_R_MODULUS_TOO_LARGE                                 103
 #define DSA_R_NEED_NEW_SETUP_VALUES                     110
 #define DSA_R_NO_PARAMETERS_SET                                 107
 #define DSA_R_PARAMETER_ENCODING_ERROR                  105
+#define DSA_R_Q_NOT_PRIME                               113
 
 #ifdef  __cplusplus
 }