Re: FIPS 140 service indicator revamp
Werner Koch via Gcrypt-devel <[email protected]>
| Newsgroups | gmane.comp.encryption.gpg.libgcrypt.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 24 Oct 2024 10:34, NIIBE Yutaka said: > For this, firstly, I propose the API of following: > > void _gcry_thread_context_set_fsi (unsigned long fsi); > unsigned long _gcry_thread_context_get_fsi (void); > unsigned long gcry_thread_context_get_fsi (void); I think we need to consider what to do with the older and FIPS approved 1.10 version. Adding a new function call extends the ABI but application need to explicit test for the existance of the new function. They can't just check the version number of Libgcrypt and conclude that the new function exists. We could step this aside by using gcry_control along with a macro to get the FIPS indictor. gcry_control would return an error for an unknown control code and the caller could test for this. Or we use symbol versioning tricks. Shalom-Salam, Werner -- The pioneers of a warless world are the youth that refuse military service. - A. Einstein _______________________________________________ Gcrypt-devel mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gcrypt-devel
openpgp-digital-signature.asc
(application/pgp-signature, 247 B)
-----BEGIN PGP SIGNATURE----- iIMEARYIACsWIQSHd0YfKgdOvEgNNZQZzByeCFsQegUCZxoMIA0cd2tAZ251cGcu b3JnAAoJEBnMHJ4IWxB6WrsA/RpqRdCE+leKvpkwaNHZ6gCnC1DEBabfxrS3ZDe1 MuflAP9FDRQx6tBfF9XY8KzkM1LbDpQ4DJ1nxLfuaNgSRQUFBA== =j//A -----END PGP SIGNATURE-----