[openssl/openssl] 28b27f: Fix FIPS to require a derivation function

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 28b27fe53b975e7a86310c9becffd738482b8ddb
      https://github.com/openssl/openssl/commit/28b27fe53b975e7a86310c9becffd738482b8ddb
  Author: Neil Horman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M providers/implementations/rands/drbg_ctr.c

  Log Message:
  -----------
  Fix FIPS to require a derivation function

FIPS-140-3 requires that if a CTR-DRBG is allocated from the fips
provider that either:

a) The entropy source must be NIST validated and exist within the FIPS
boundary

or

b) The CTR-DRBG must use a derivation function with an entropy source
outside the FIPS boundary

Given that we have no approved noise source inside the FIPS boundary, we
need to enforce the fact that FIPS allocated CTR-DRBGS only allocate
instances in which a derivation function is requested (i.e. the USE_DF
parameter is asserted and set to one)

Follow path b, and ensure that FIPS CTR-DRBG allocations assert the use
of USE_DF or fail if an allocation does not

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Mon Aug 10 14:00:06 2026
(Merged from https://github.com/openssl/openssl/pull/32249)


  Commit: e12d71f09a4cd41ca45920fe589b99df3b85532a
      https://github.com/openssl/openssl/commit/e12d71f09a4cd41ca45920fe589b99df3b85532a
  Author: Pauli <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M test/recipes/30-test_evp_data/evprand.txt

  Log Message:
  -----------
  evp_test: condition CTR-DRBG tests on FIPS version when the df is not used

Newer versions require the use of the derivation function and non-use is
an error. This means a number of tests must be inhibited in such situations.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Mon Aug 10 14:00:08 2026
(Merged from https://github.com/openssl/openssl/pull/32249)


Compare: https://github.com/openssl/openssl/compare/d10f83754393...e12d71f09a4c

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/d10f83-e12d71%40github.com.