[openssl/openssl] 1afd0c: Rework how to fetch components in the drbg

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: 1afd0ca49c84d135f030a08c48d075c7a9686e04
      https://github.com/openssl/openssl/commit/1afd0ca49c84d135f030a08c48d075c7a9686e04
  Author: Neil Horman <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    M crypto/rand/rand_lib.c
    M providers/implementations/rands/drbg_ctr.c
    M providers/implementations/rands/drbg_hash.c
    M providers/implementations/rands/drbg_hmac.c

  Log Message:
  -----------
  Rework how to fetch components in the drbg

Commit c9a2ce61118c7f73bc4898eedec64c2bde8bb7a0 introduced some code
into the drbg in an effort to get it to select the same provider as is
specified for the drbg.  Unfortunately this creates a problem when a
user has altered the identity of a predefined provider (in this case
fips).

The DRBG is passed a set of parameters when instantiating, which
includes the name of the provider.  This provider uses the name that the
core knows it as, which may be different than "fips", which the fips
provider always referrs to itself as.

Fix it by skipping the provider name check when operating in the fips
module, as we should only ever get fips approved algs from within that
space

Fixes a customer issue, who noted that since this was introduced, using
identity configurations no longer works.

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:01 2026
(Merged from https://github.com/openssl/openssl/pull/32060)

(cherry picked from commit 71ec72702be26ef9130530624fada6038e59fc01)


  Commit: 3bdaff08d8e1eaaab3a9d8264d6f59ab3dbd6837
      https://github.com/openssl/openssl/commit/3bdaff08d8e1eaaab3a9d8264d6f59ab3dbd6837
  Author: Neil Horman <[email protected]>
  Date:   2026-08-12 (Wed, 12 Aug 2026)

  Changed paths:
    A test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  add a test to exercize the identity config directive on fips

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/32060)

(cherry picked from commit 42f8848ac6cbd727264fd3a9bfa97861e4ab71b5)


Compare: https://github.com/openssl/openssl/compare/e437c849dd86...3bdaff08d8e1

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/e437c8-3bdaff%40github.com.