Redirect DH key and parameter generation.
authorDr. Stephen Henson <steve@openssl.org>
Thu, 9 Jun 2011 15:21:46 +0000 (15:21 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Thu, 9 Jun 2011 15:21:46 +0000 (15:21 +0000)
crypto/dh/dh.h
crypto/dh/dh_err.c
crypto/dh/dh_gen.c
crypto/dsa/dsa.h
crypto/dsa/dsa_err.c
crypto/dsa/dsa_gen.c
crypto/dsa/dsa_key.c

index b6d367b..ea59e61 100644 (file)
@@ -247,6 +247,7 @@ void ERR_load_DH_strings(void);
 #define DH_F_DH_BUILTIN_GENPARAMS                       106
 #define DH_F_DH_COMPUTE_KEY                             114
 #define DH_F_DH_GENERATE_KEY                            115
+#define DH_F_DH_GENERATE_PARAMETERS_EX                  116
 #define DH_F_DH_NEW_METHOD                              105
 #define DH_F_DH_PARAM_DECODE                            107
 #define DH_F_DH_PRIV_DECODE                             110
index 1da2c12..56d3df7 100644 (file)
@@ -75,6 +75,7 @@ static ERR_STRING_DATA DH_str_functs[]=
 {ERR_FUNC(DH_F_DH_BUILTIN_GENPARAMS),  "DH_BUILTIN_GENPARAMS"},
 {ERR_FUNC(DH_F_DH_COMPUTE_KEY),        "DH_compute_key"},
 {ERR_FUNC(DH_F_DH_GENERATE_KEY),       "DH_generate_key"},
+{ERR_FUNC(DH_F_DH_GENERATE_PARAMETERS_EX),     "DH_generate_parameters_ex"},
 {ERR_FUNC(DH_F_DH_NEW_METHOD), "DH_new_method"},
 {ERR_FUNC(DH_F_DH_PARAM_DECODE),       "DH_PARAM_DECODE"},
 {ERR_FUNC(DH_F_DH_PRIV_DECODE),        "DH_PRIV_DECODE"},
index cfd5b11..7b1fe9c 100644 (file)
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
 
 int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
        {
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
+                       && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW))
+               {
+               DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
+               return 0;
+               }
+#endif
        if(ret->meth->generate_params)
                return ret->meth->generate_params(ret, prime_len, generator, cb);
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode())
+               return FIPS_dh_generate_parameters_ex(ret, prime_len,
+                                                       generator, cb);
+#endif
        return dh_builtin_genparams(ret, prime_len, generator, cb);
        }
 
index 6a21b2c..295470e 100644 (file)
@@ -287,6 +287,7 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_DSAPARAMS_PRINT_FP                        101
 #define DSA_F_DSA_DO_SIGN                               112
 #define DSA_F_DSA_DO_VERIFY                             113
+#define DSA_F_DSA_GENERATE_KEY                          124
 #define DSA_F_DSA_GENERATE_PARAMETERS_EX                123
 #define DSA_F_DSA_NEW_METHOD                            103
 #define DSA_F_DSA_PARAM_DECODE                          119
index bada41f..6c49523 100644 (file)
@@ -76,6 +76,7 @@ static ERR_STRING_DATA DSA_str_functs[]=
 {ERR_FUNC(DSA_F_DSAPARAMS_PRINT_FP),   "DSAparams_print_fp"},
 {ERR_FUNC(DSA_F_DSA_DO_SIGN),  "DSA_do_sign"},
 {ERR_FUNC(DSA_F_DSA_DO_VERIFY),        "DSA_do_verify"},
+{ERR_FUNC(DSA_F_DSA_GENERATE_KEY),     "DSA_generate_key"},
 {ERR_FUNC(DSA_F_DSA_GENERATE_PARAMETERS_EX),   "DSA_generate_parameters_ex"},
 {ERR_FUNC(DSA_F_DSA_NEW_METHOD),       "DSA_new_method"},
 {ERR_FUNC(DSA_F_DSA_PARAM_DECODE),     "DSA_PARAM_DECODE"},
index cc73a23..c398761 100644 (file)
@@ -89,13 +89,14 @@ int DSA_generate_parameters_ex(DSA *ret, int bits,
                const unsigned char *seed_in, int seed_len,
                int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
        {
+#ifdef OPENSSL_FIPS
        if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
                        && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW))
                {
                DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
                return 0;
                }
-
+#endif
        if(ret->meth->dsa_paramgen)
                return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
                                counter_ret, h_ret, cb);
index c4aa86b..9cf669b 100644 (file)
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int dsa_builtin_keygen(DSA *dsa);
 
 int DSA_generate_key(DSA *dsa)
        {
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                       && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
+               {
+               DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);
+               return 0;
+               }
+#endif
        if(dsa->meth->dsa_keygen)
                return dsa->meth->dsa_keygen(dsa);
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode())
+               return FIPS_dsa_generate_key(dsa);
+#endif
        return dsa_builtin_keygen(dsa);
        }