[openssl] master update
shane.lontis at oracle.com
shane.lontis at oracle.com
Mon Nov 16 07:23:58 UTC 2020
The branch master has been updated
via 4605c5ab4796e99a207ab54d31bb8d2b5e42f1ca (commit)
from e557d463331861c740867f069e1cb8029b46c94a (commit)
- Log -----------------------------------------------------------------
commit 4605c5ab4796e99a207ab54d31bb8d2b5e42f1ca
Author: Shane Lontis <shane.lontis at oracle.com>
Date: Thu Nov 12 17:57:12 2020 +1000
Fix dsa securitycheck for fips.
Fixes #12627
Changed security check for DSA verification to match SP800-131Ar2 when
the security strength is < 112.
Fixed compilation error when using config opt 'no-fips-securitychecks'
Removed TODO's from 20-test_cli_fips.t - there is no longer an TODO error.
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13387)
-----------------------------------------------------------------------
Summary of changes:
.travis.yml | 2 +-
providers/common/securitycheck.c | 11 ++++++-----
test/evp_test.c | 2 ++
test/recipes/20-test_cli_fips.t | 14 +++++---------
4 files changed, 14 insertions(+), 15 deletions(-)
diff --git a/.travis.yml b/.travis.yml
index 174e9b182f..a6d3488028 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -137,7 +137,7 @@ jobs:
script: true
- os: linux
compiler: gcc
- env: CONFIGURE_TARGET="linux-generic32" MARKDOWNLINT="yes" CONFIG_OPTS="--strict-warnings no-shared no-dso no-pic no-aria no-async no-autoload-config no-blake2 no-bf no-camellia no-cast no-chacha no-cmac no-cms no-cmp no-comp no-ct no-des no-dgram no-dh no-dsa no-dtls no-ec2m no-engine no-filenames no-gost no-idea no-ktls no-mdc2 no-md4 no-multiblock no-nextprotoneg no-ocsp no-ocb no-poly1305 no-psk no-rc2 no-rc4 no-rmd160 no-seed no-siphash no-siv no-sm2 no-sm3 no-sm4 no-srp no-srtp no-ssl3 no-ssl3-method no-ts no-ui-console no-whirlpool no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT"
+ env: CONFIGURE_TARGET="linux-generic32" MARKDOWNLINT="yes" CONFIG_OPTS="--strict-warnings no-shared no-dso no-pic no-aria no-async no-autoload-config no-blake2 no-bf no-camellia no-cast no-chacha no-cmac no-cms no-cmp no-comp no-ct no-des no-dgram no-dh no-dsa no-dtls no-ec2m no-engine no-filenames no-gost no-idea no-ktls no-mdc2 no-md4 no-multiblock no-nextprotoneg no-ocsp no-ocb no-poly1305 no-psk no-rc2 no-rc4 no-rmd160 no-seed no-siphash no-siv no-sm2 no-sm3 no-sm4 no-srp no-srtp no-ssl3 no-ssl3-method no-ts no-ui-console no-whirlpool no-fips-securitychecks no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT"
before_script:
diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c
index a95fa9dda9..9d02536c38 100644
--- a/providers/common/securitycheck.c
+++ b/providers/common/securitycheck.c
@@ -129,12 +129,13 @@ int dsa_check_key(const DSA *dsa, int sign)
N = BN_num_bits(q);
/*
- * Valid sizes or verification - Note this could be a fips186-2 type
- * key - so we allow 512 also. When this is no longer suppported the
- * lower bound should be increased to 1024.
+ * For Digital signature verification DSA keys with < 112 bits of
+ * security strength (i.e L < 2048 bits), are still allowed for legacy
+ * use. The bounds given in SP800 131Ar2 - Table 2 are
+ * (512 <= L < 2048 and 160 <= N < 224)
*/
- if (!sign)
- return (L >= 512 && N >= 160);
+ if (!sign && L < 2048)
+ return (L >= 512 && N >= 160 && N < 224);
/* Valid sizes for both sign and verify */
if (L == 2048 && (N == 224 || N == 256))
diff --git a/test/evp_test.c b/test/evp_test.c
index fc9121edac..9361845450 100644
--- a/test/evp_test.c
+++ b/test/evp_test.c
@@ -3284,6 +3284,7 @@ static char *take_value(PAIR *pp)
return p;
}
+#if !defined(OPENSSL_NO_FIPS_SECURITYCHECKS)
static int securitycheck_enabled(void)
{
static int enabled = -1;
@@ -3310,6 +3311,7 @@ static int securitycheck_enabled(void)
}
return enabled;
}
+#endif
/*
* Return 1 if one of the providers named in the string is available.
diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t
index 2bd19722de..364c9d2bde 100644
--- a/test/recipes/20-test_cli_fips.t
+++ b/test/recipes/20-test_cli_fips.t
@@ -23,7 +23,9 @@ use lib srctop_dir('Configurations');
use lib bldtop_dir('.');
use platform;
-plan skip_all => "Test only supported in a fips build" if disabled("fips");
+my $no_check = disabled('fips-securitychecks');
+plan skip_all => "Test only supported in a fips build with security checks"
+ if disabled("fips") || disabled("fips-securitychecks");
plan tests => 13;
my $fipsmodule = bldtop_file('providers', platform->dso('fips'));
@@ -235,10 +237,7 @@ SKIP: {
'-out', $testtext_prefix.'.fail.priv.pem'])),
$testtext);
- TODO : {
- local $TODO = "see issue #12629";
- tsignverify($testtext_prefix, $fips_key, $nonfips_key);
- }
+ tsignverify($testtext_prefix, $fips_key, $nonfips_key);
};
}
@@ -315,9 +314,6 @@ SKIP : {
'-out', $testtext_prefix.'.fail.priv.pem'])),
$testtext);
- TODO : {
- local $TODO = "see issues #12626, #12627";
- tsignverify($testtext_prefix, $fips_key, $nonfips_key);
- }
+ tsignverify($testtext_prefix, $fips_key, $nonfips_key);
};
}
More information about the openssl-commits
mailing list