Set flags in ECDH and ECDSA methods for FIPS.

diff --git a/crypto/ecdh/ech_locl.h b/crypto/ecdh/ech_locl.h
index f658526a7e3a86545da3f28f8cd041016872aa5d..f6cad6a894bc91d2fcaab02b3bc680fcd0c4f137 100644 (file)
--- a/crypto/ecdh/ech_locl.h
+++ b/crypto/ecdh/ech_locl.h
@@ -75,6 +75,14 @@ struct ecdh_method
        char *app_data;
        };
 
        char *app_data;
        };
 

+/* If this flag is set the ECDH method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its responsibility
+ * to ensure the result is compliant.
+ */
+
+#define ECDH_FLAG_FIPS_METHOD  0x1
+

 typedef struct ecdh_data_st {
        /* EC_KEY_METH_DATA part */
        int (*init)(EC_KEY *);
 typedef struct ecdh_data_st {
        /* EC_KEY_METH_DATA part */
        int (*init)(EC_KEY *);

diff --git a/crypto/ecdh/ech_ossl.c b/crypto/ecdh/ech_ossl.c
index ceaa2f06b6389cd81dd4d09404d852407242b4ba..f93dfcb4f73ed7d1749c23112f16794ce08e9c70 100644 (file)
--- a/crypto/ecdh/ech_ossl.c
+++ b/crypto/ecdh/ech_ossl.c
@@ -91,7 +91,7 @@ static ECDH_METHOD openssl_ecdh_meth = {
        NULL, /* init     */
        NULL, /* finish   */
 #endif
        NULL, /* init     */
        NULL, /* finish   */
 #endif

-       0,    /* flags    */
+       ECDH_FLAG_FIPS_METHOD,    /* flags    */

        NULL  /* app_data */
 };
 
        NULL  /* app_data */
 };
 

diff --git a/crypto/ecdsa/ecs_locl.h b/crypto/ecdsa/ecs_locl.h
index 3a69a840e21176529b511a2e4ca302d70267cbda..cb3be13cfc307025266aff78f47099ff0b5c7971 100644 (file)
--- a/crypto/ecdsa/ecs_locl.h
+++ b/crypto/ecdsa/ecs_locl.h
@@ -82,6 +82,14 @@ struct ecdsa_method
        char *app_data;
        };
 
        char *app_data;
        };
 

+/* If this flag is set the ECDSA method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its responsibility
+ * to ensure the result is compliant.
+ */
+
+#define ECDSA_FLAG_FIPS_METHOD 0x1
+

 typedef struct ecdsa_data_st {
        /* EC_KEY_METH_DATA part */
        int (*init)(EC_KEY *);
 typedef struct ecdsa_data_st {
        /* EC_KEY_METH_DATA part */
        int (*init)(EC_KEY *);

diff --git a/crypto/ecdsa/ecs_ossl.c b/crypto/ecdsa/ecs_ossl.c
index 50d02ed0691c8b9d85e8e5072ef3222de25389fd..8b407c5470fd371921eca09dafded7ed0d1b9856 100644 (file)
--- a/crypto/ecdsa/ecs_ossl.c
+++ b/crypto/ecdsa/ecs_ossl.c
@@ -79,7 +79,7 @@ static ECDSA_METHOD openssl_ecdsa_meth = {
        NULL, /* init     */
        NULL, /* finish   */
 #endif
        NULL, /* init     */
        NULL, /* finish   */
 #endif

-       0,    /* flags    */
+       ECDSA_FLAG_FIPS_METHOD,    /* flags    */

        NULL  /* app_data */
 };
 
        NULL  /* app_data */
 };