[openssl/openssl] 3d8b51: Fix FIPS to require a derivation function

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 3d8b51d27714921c74bdebc0b39e4b387c442a63
      https://github.com/openssl/openssl/commit/3d8b51d27714921c74bdebc0b39e4b387c442a63
  Author: Neil Horman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M providers/implementations/rands/drbg_ctr.c

  Log Message:
  -----------
  Fix FIPS to require a derivation function

FIPS-140-3 requires that if a CTR-DRBG is allocated from the fips
provider that either:

a) The entropy source must be NIST validated and exist within the FIPS
boundary

or

b) The CTR-DRBG must use a derivation function with an entropy source
outside the FIPS boundary

Given that we have no approved noise source inside the FIPS boundary, we
need to enforce the fact that FIPS allocated CTR-DRBGS only allocate
instances in which a derivation function is requested (i.e. the USE_DF
parameter is asserted and set to one)

Follow path b, and ensure that FIPS CTR-DRBG allocations assert the use
of USE_DF or fail if an allocation does not

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Mon Aug 10 12:01:38 2026
(Merged from https://github.com/openssl/openssl/pull/32235)


  Commit: 9ef31bc73697701219ff439b47f57de5cf61c1bf
      https://github.com/openssl/openssl/commit/9ef31bc73697701219ff439b47f57de5cf61c1bf
  Author: Pauli <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M providers/implementations/rands/drbg_ctr.inc.in

  Log Message:
  -----------
  Fix FIPS to require a derivation function with CTR-DRBG

FIPS-140-3 requires that if a CTR-DRBG is allocated from the fips
provider that either:

a) The entropy source must be NIST validated and exist within the FIPS
boundary

or

b) The CTR-DRBG must use a derivation function with an entropy source
outside the FIPS boundary

Given that we have no approved noise source inside the FIPS boundary, we
need to enforce the fact that FIPS allocated CTR-DRBGS only allocate
instances in which a derivation function is requested (i.e. the USE_DF
parameter is asserted and set to one)

Follow path b, and ensure that FIPS CTR-DRBG allocations assert the use
of USE_DF or fail if an allocation does not

Also fix up the evp tests to skip the 144 tests which allocate a DRBG
without a derivation function when testing the fips provider

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Mon Aug 10 12:01:41 2026
(Merged from https://github.com/openssl/openssl/pull/32235)


  Commit: 5b4df6eac1a7d228ad2a8f08d45c7d0a13992026
      https://github.com/openssl/openssl/commit/5b4df6eac1a7d228ad2a8f08d45c7d0a13992026
  Author: Pauli <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M test/recipes/30-test_evp_data/evprand.txt

  Log Message:
  -----------
  evp_test: condition CTR-DRBG tests on FIPS version when the df is not used

Newer versions require the use of the derivation function and non-use is
an error. This means a number of tests must be inhibited in such situations.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Mon Aug 10 12:01:44 2026
(Merged from https://github.com/openssl/openssl/pull/32235)


Compare: https://github.com/openssl/openssl/compare/e5d2eaee1332...5b4df6eac1a7

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/e5d2ea-5b4df6%40github.com.