[openssl/openssl] c116a3: Rework how to fetch components in the drbg

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: c116a39920be6d40e80f613fa1735ca77786a0a8
      https://github.com/openssl/openssl/commit/c116a39920be6d40e80f613fa1735ca77786a0a8
  Author: Neil Horman <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M crypto/rand/rand_lib.c
    M providers/implementations/rands/drbg_ctr.c.in
    M providers/implementations/rands/drbg_hash.c.in
    M providers/implementations/rands/drbg_hmac.c.in

  Log Message:
  -----------
  Rework how to fetch components in the drbg

Commit c9a2ce61118c7f73bc4898eedec64c2bde8bb7a0 introduced some code
into the drbg in an effort to get it to select the same provider as is
specified for the drbg.  Unfortunately this creates a problem when a
user has altered the identity of a predefined provider (in this case
fips).

The DRBG is passed a set of parameters when instantiating, which
includes the name of the provider.  This provider uses the name that the
core knows it as, which may be different than "fips", which the fips
provider always referrs to itself as.

Fix it by skipping the provider name check when operating in the fips
module, as we should only ever get fips approved algs from within that
space

Fixes a customer issue, who noted that since this was introduced, using
identity configurations no longer works.

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:01 2026

(cherry picked from commit 71ec72702be26ef9130530624fada6038e59fc01)

Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/32355)


  Commit: 03b0a46a0a49c2ed32877df34d8e58402a037f0d
      https://github.com/openssl/openssl/commit/03b0a46a0a49c2ed32877df34d8e58402a037f0d
  Author: Neil Horman <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    A test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  add a test to exercize the identity config directive on fips

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:04 2026

(cherry picked from commit 42f8848ac6cbd727264fd3a9bfa97861e4ab71b5)

Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/32355)


  Commit: 431a34b15ef81a0d32a69d87e4b7a7065b517c60
      https://github.com/openssl/openssl/commit/431a34b15ef81a0d32a69d87e4b7a7065b517c60
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  test: fix FIPS identity DRBG regression coverage

Use the configuration filename that was actually added. Set the random
configuration property to fips=yes so the existing RSA checks use a DRBG
from the renamed FIPS provider, rather than one from the default
provider.

Assisted-by: Codex:gpt-5.6-sol

Reviewed-by: Simo Sorce <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 16:22:41 2026
(Merged from https://github.com/openssl/openssl/pull/32355)


Compare: https://github.com/openssl/openssl/compare/1b7d032698fd...431a34b15ef8

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/1b7d03-431a34%40github.com.