File openssl-1_1-paramgen-default_to_rfc7919.patch of Package openssl-1_1

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-1_1-paramgen-default_to_rfc7919.patch of Package openssl-1_1 (Revision ebc5d3bf3924e9a7c5fffb10618e8f14)

Currently displaying revision ebc5d3bf3924e9a7c5fffb10618e8f14 , Show latest

diff --git a/apps/dhparam.c b/apps/dhparam.c
index 13f7675..0da08a4 100644
--- a/apps/dhparam.c
+++ b/apps/dhparam.c
@@ -198,15 +198,42 @@ int dhparam_main(int argc, char **argv)
         } else
 # endif
         {
-            dh = DH_new();
-            BIO_printf(bio_err,
-                       "Generating DH parameters, %d bit long safe prime, generator %d\n",
-                       num, g);
-            BIO_printf(bio_err, "This is going to take a long time\n");
-            if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
+#ifdef OPENSSL_FIPS
+          if (FIPS_mode()) {
+            /* In FIPS mode, instead of generating DH parameters we use parameters from an approved group,
+             in this case, RFC-7919. */
+            int param_nid;
+            switch (num) {
+            case 8192:
+              param_nid = NID_ffdhe8192;
+              break;
+            case 6144:
+              param_nid = NID_ffdhe6144;
+              break;
+            case 4096:
+              param_nid = NID_ffdhe4096;
+              break;
+            case 3072:
+              param_nid = NID_ffdhe3072;
+              break;
+            default:
+              param_nid = NID_ffdhe2048;
+              break;
+            }
+            dh = DH_new_by_nid(param_nid);
+          } else
+#endif /* OPENSSL_FIPS */
+            {
+              dh = DH_new();
+              BIO_printf(bio_err,
+                         "Generating DH parameters, %d bit long safe prime, generator %d\n",
+                         num, g);
+              BIO_printf(bio_err, "This is going to take a long time\n");
+              if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
                 BN_GENCB_free(cb);
                 ERR_print_errors(bio_err);
                 goto end;
+              }
             }
         }

diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c
index 3b807ef..d4cd3c6 100644
--- a/crypto/dh/dh_pmeth.c
+++ b/crypto/dh/dh_pmeth.c
@@ -330,6 +330,30 @@ static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
     DH_PKEY_CTX *dctx = ctx->data;
     BN_GENCB *pcb;
     int ret;
+
+#ifdef OPENSSL_FIPS
+    /* In FIPS mode we default to an appropriate group. */
+    if (FIPS_mode() && (!(dctx->rfc5114_param)) && (dctx->param_nid == 0)) {
+      switch (dctx->prime_len) {
+      case 8192:
+        dctx->param_nid = NID_ffdhe8192;
+        break;
+      case 6144:
+        dctx->param_nid = NID_ffdhe6144;
+        break;
+      case 4096:
+        dctx->param_nid = NID_ffdhe4096;
+        break;
+      case 3072:
+        dctx->param_nid = NID_ffdhe3072;
+        break;
+      default:
+        dctx->param_nid = NID_ffdhe2048;
+        break;
+      }
+    }
+#endif /* OPENSSL_FIPS */
+
     if (dctx->rfc5114_param) {
         switch (dctx->rfc5114_param) {
         case 1:

Places

File openssl-1_1-paramgen-default_to_rfc7919.patch of Package openssl-1_1 (Revision ebc5d3bf3924e9a7c5fffb10618e8f14)

Places