[openssl/openssl] ee9d1e: FIPS: Make keygen PCT failures recoverable

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: ee9d1e532cb603615174bb2178e856b16255f38e
      https://github.com/openssl/openssl/commit/ee9d1e532cb603615174bb2178e856b16255f38e
  Author: slontis <[email protected]>
  Date:   2026-06-11 (Thu, 11 Jun 2026)

  Changed paths:
    M crypto/dsa/dsa_key.c
    M crypto/ec/ec_key.c
    M crypto/rsa/rsa_gen.c
    M providers/implementations/keymgmt/dh_kmgmt.c
    M providers/implementations/keymgmt/ec_kmgmt.c
    M providers/implementations/keymgmt/ecx_kmgmt.c
    M providers/implementations/keymgmt/ml_dsa_kmgmt.c
    M providers/implementations/keymgmt/ml_kem_kmgmt.c
    M providers/implementations/keymgmt/slh_dsa_kmgmt.c

  Log Message:
  -----------
  FIPS: Make keygen PCT failures recoverable

Key generation pairwise consistency tests (PCT) no longer cause the
FIPS provider to enter a non recoverable error state.

Originally I considered that the pairwise tests should never fail, so a
failure was considered as a fatal error. Unfortunately this is not true,
since the RSA pairwise test was changed to call
rsa_ossl_public_encrypt(). This function can return -1 based on the
values of n and e, resulting in a DOS for bad inputs.
Under NIST FIPS 186-5, the public exponent (e) must be an odd positive
integer greater than (e > 65536) and less than 2^256. The OpenSSL code
however returns an error if e > 2^64 when n > 3072.
(This check was added to prevent a CVE DOS).

While FIPS 140-3 mandates that a module must transition into an error
state upon self-test failures, a PCT is classified as a conditional
self-test, not a pre-operational self-test
(like an integrity test or a Known Answer Test)
The cryptographic module is only required to immediately discard the
faulty key pair and output a local error. The module is allowed to
immediately attempt generating a new key pair using fresh entropy,
without needing a full system reboot or module reset.

Detected by Oracle during Jipher testing.

Reviewed-by: Simo Sorce <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
MergeDate: Thu Jun 11 16:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/31359)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/c86db7-ee9d1e%40github.com.