Fips provider and non-Fips context

[Afshin Pir]

Thanks for quick reply.

As a side question, I just don’t understand how the FIPS 140-2 key entry requirements are handled in OpenSSL v3.0 provider. I thought when you want to import a key into a FIPS 140-2 compliant module, you need to use a secure channel. But when we call EVP_EncryptInit, we pass key as plain. How does this not conflict FIPS 140-2?

Best Regards

From: openssl-users <openssl-users-bounces at openssl.org> On Behalf Of Dr Paul Dale
Sent: Monday, 17 April 2023 12:16 pm
To: openssl-users at openssl.org
Subject: Re: Fips provider and non-Fips context

The FIPS provider looks up any required algorithms internally, so it won't find provider A's implementation.

This was a deliberate decision to guarantee FIPS compliance and to avoid the intricacies of the mandated secure channel when data crosses FIPS boundaries.


Pauli
On 17/4/23 10:06, Afshin Pir wrote:
Hi,

Is it allowed to use a non-fips provider algorithm as fips algorithm provider internal algorithm? For example, let’s say that I want to use Fips version of CMAC like this:
EVP_MAC *mac = EVP_MAC_fetch(libctx, "CMAC", "fips=yes");
and libctx has already loaded provider fips and provider A. Now if I want to init it, I use a code like this:

char ciphername[] = "HW-AES-128-CBC";
char propname[] ="?provider=A";
OSSL_PARAM params[3];
params[0] = OSSL_PARAM_construct_utf8_string("cipher", ciphername, 0);
params[1] = OSSL_PARAM_construct_utf8_string("properties", propname, 0);
params[2] = OSSL_PARAM_construct_end();

EVP_MAC_CTX *ctx = EVP_MAC_CTX_new(mac);
Int res = EVP_MAC_init(ctx, (const unsigned char *)key, strlen(key), params);

Now should EVP_MAC_init() succeed here or not for fips provider algorithm? Because it seems that I cannot use provider A with fips provider while I can with default provider.

Best Regards,
Afshin
________________________________
This email is confidential and may contain information subject to legal privilege. If you are not the intended recipient please advise us of our error by return e-mail then delete this email and any attached files. You may not copy, disclose or use the contents in any way. The views expressed in this email may not be those of Gallagher Group Ltd or subsidiary companies thereof.
________________________________

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20230419/9e61cf55/attachment-0001.htm>