[openssl/openssl] 71ec72: Rework how to fetch components in the drbg

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 71ec72702be26ef9130530624fada6038e59fc01
      https://github.com/openssl/openssl/commit/71ec72702be26ef9130530624fada6038e59fc01
  Author: Neil Horman <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M crypto/rand/rand_lib.c
    M providers/implementations/rands/drbg_ctr.c
    M providers/implementations/rands/drbg_hash.c
    M providers/implementations/rands/drbg_hmac.c

  Log Message:
  -----------
  Rework how to fetch components in the drbg

Commit c9a2ce61118c7f73bc4898eedec64c2bde8bb7a0 introduced some code
into the drbg in an effort to get it to select the same provider as is
specified for the drbg.  Unfortunately this creates a problem when a
user has altered the identity of a predefined provider (in this case
fips).

The DRBG is passed a set of parameters when instantiating, which
includes the name of the provider.  This provider uses the name that the
core knows it as, which may be different than "fips", which the fips
provider always referrs to itself as.

Fix it by skipping the provider name check when operating in the fips
module, as we should only ever get fips approved algs from within that
space

Fixes a customer issue, who noted that since this was introduced, using
identity configurations no longer works.

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:01 2026
(Merged from https://github.com/openssl/openssl/pull/32060)


  Commit: 42f8848ac6cbd727264fd3a9bfa97861e4ab71b5
      https://github.com/openssl/openssl/commit/42f8848ac6cbd727264fd3a9bfa97861e4ab71b5
  Author: Neil Horman <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    A test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  add a test to exercize the identity config directive on fips

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/32060)


Compare: https://github.com/openssl/openssl/compare/0461a5636dec...42f8848ac6cb

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/0461a5-42f884%40github.com.