[openssl/openssl] 79373c: FIPS: EC keygen - remove unnecessary self tests.

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 79373ca3bd4c26e9a4896e4c198828909cc6deec
      https://github.com/openssl/openssl/commit/79373ca3bd4c26e9a4896e4c198828909cc6deec
  Author: slontis <[email protected]>
  Date:   2026-07-13 (Mon, 13 Jul 2026)

  Changed paths:
    M crypto/ec/ec_key.c
    M providers/implementations/keymgmt/ec_kmgmt.c
    M test/pairwise_fail_test.c
    M test/recipes/30-test_pairwise_fail.t

  Log Message:
  -----------
  FIPS: EC keygen - remove unnecessary self tests.

In FIPS mode EC keygen was doing 3 self tests.
ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and
ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and
comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4.
These tests covered both Keygen PCT for Key Agreement and Signatures.
ossl_ec_key_pairwise_check() was also being called from within ec_gen().
The advice from Atsec (lab) is that the sign/verify test within
ecdsa_keygen_pairwise_test() is sufficient according to the updated
rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of
the generated key is unknown at the time of key generation.

Detected during testing of Jipher by Roshith Alankandy (Oracle).

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jul 13 14:47:00 2026
(Merged from https://github.com/openssl/openssl/pull/31761)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/6d9a69-79373c%40github.com.