From ce1cbe16992a7340edcf8e6576973e3508267640 Mon Sep 17 00:00:00 2001 From: Vitezslav Cizek Date: Thu, 29 Oct 2015 17:13:16 +0100 Subject: Disable non-allowed algorithms in FIPS mode * cipher/cipher.c (_gcry_cipher_init), * cipher/mac.c (_gcry_mac_init), * cipher/md.c (_gcry_md_init), * cipher/pubkey.c (_gcry_pk_init): In the FIPS mode, disable all the non-allowed ciphers. * cipher/md5.c: Mark MD5 as not allowed in FIPS. * src/g10lib.h (_gcry_mac_init): New. * src/global.c (global_init): Call the new _gcry_mac_init. * tests/basic.c (check_ciphers): Fix a typo. -- When running in the FIPS mode, disable all the ciphers that don't have the fips flag set. Skip the non-allowed algos during testing in the FIPS mode. Thanks to Ludwig Nussel. Signed-off-by: Vitezslav Cizek Signed-off-by: Vitezslav Cizek --- cipher/pubkey.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'cipher/pubkey.c') diff --git a/cipher/pubkey.c b/cipher/pubkey.c index b321a899..8ec15fd4 100644 --- a/cipher/pubkey.c +++ b/cipher/pubkey.c @@ -926,6 +926,17 @@ _gcry_pubkey_get_sexp (gcry_sexp_t *r_sexp, int mode, gcry_ctx_t ctx) gcry_err_code_t _gcry_pk_init (void) { + if (fips_mode()) + { + /* disable algorithms that are disallowed in fips */ + int idx; + gcry_pk_spec_t *spec; + + for (idx = 0; (spec = pubkey_list[idx]); idx++) + if (!spec->flags.fips) + spec->flags.disabled = 1; + } + return 0; } -- cgit v1.2.1