[openssl/openssl] 75b27b: Rework how to fetch components in the drbg

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 75b27b995fc4306bbd8b61ec7dd276aba1650b8e
      https://github.com/openssl/openssl/commit/75b27b995fc4306bbd8b61ec7dd276aba1650b8e
  Author: Neil Horman <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M crypto/rand/rand_lib.c
    M providers/implementations/rands/drbg_ctr.c
    M providers/implementations/rands/drbg_hash.c
    M providers/implementations/rands/drbg_hmac.c

  Log Message:
  -----------
  Rework how to fetch components in the drbg

Commit c9a2ce61118c7f73bc4898eedec64c2bde8bb7a0 introduced some code
into the drbg in an effort to get it to select the same provider as is
specified for the drbg.  Unfortunately this creates a problem when a
user has altered the identity of a predefined provider (in this case
fips).

The DRBG is passed a set of parameters when instantiating, which
includes the name of the provider.  This provider uses the name that the
core knows it as, which may be different than "fips", which the fips
provider always referrs to itself as.

Fix it by skipping the provider name check when operating in the fips
module, as we should only ever get fips approved algs from within that
space

Fixes a customer issue, who noted that since this was introduced, using
identity configurations no longer works.

(cherry picked from commit 71ec72702be26ef9130530624fada6038e59fc01)
Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merge-date: Fri Aug 21 11:51:12 2026
Merged-from: https://github.com/openssl/openssl/pull/32357


  Commit: f544f4970f2719ddaeb3fa1e78572b95c99dd69f
      https://github.com/openssl/openssl/commit/f544f4970f2719ddaeb3fa1e78572b95c99dd69f
  Author: Neil Horman <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    A test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  add a test to exercize the identity config directive on fips

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Wed Aug 12 19:26:04 2026

(cherry picked from commit 42f8848ac6cbd727264fd3a9bfa97861e4ab71b5)
Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merged-from: https://github.com/openssl/openssl/pull/32357


  Commit: 39a7a0f54975988a8452f9b83dbeb7224e72d914
      https://github.com/openssl/openssl/commit/39a7a0f54975988a8452f9b83dbeb7224e72d914
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M test/fipsidentity.cnf
    M test/recipes/20-test_cli_fips.t

  Log Message:
  -----------
  test: fix FIPS identity DRBG regression coverage

Use the configuration filename that was actually added. Set the random
configuration property to fips=yes so the existing RSA checks use a DRBG
from the renamed FIPS provider, rather than one from the default
provider.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merge-date: Fri Aug 21 11:51:15 2026
Merged-from: https://github.com/openssl/openssl/pull/32357


Compare: https://github.com/openssl/openssl/compare/c8ba7c892890...39a7a0f54975

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/c8ba7c-39a7a0%40github.com.