feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #5060 from cconlon/ecFipsReady

Browse Source 
ECDH_compute_key: allow setting of globalRNG with FIPS 140-3 / Ready
This commit is contained in:
John Safranek
2022-04-18 16:15:14 -07:00
committed by GitHub
parent 9172abc969 35cb3c8a79
commit 52b176b6a1
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/ssl.c
View File

@ -33443,8 +33443,8 @@ int wolfSSL_ECDH_compute_key(void *out, size_t outlen,
word32 len; word32 len;
ecc_key* key; ecc_key* key;
int ret; int ret;
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) \ #if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) && \
&& !defined(HAVE_FIPS) (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,0)))
int setGlobalRNG = 0; int setGlobalRNG = 0;
#endif #endif
(void)KDF; (void)KDF;
@ -33471,8 +33471,8 @@ int wolfSSL_ECDH_compute_key(void *out, size_t outlen,
len = (word32)outlen; len = (word32)outlen;
key = (ecc_key*)ecdh->internal; key = (ecc_key*)ecdh->internal;
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) \ #if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) && \
&& !defined(HAVE_FIPS) (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,0)))
if (key->rng == NULL) { if (key->rng == NULL) {
if (initGlobalRNG == 0 && wolfSSL_RAND_Init() != WOLFSSL_SUCCESS) { if (initGlobalRNG == 0 && wolfSSL_RAND_Init() != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("No RNG to use"); WOLFSSL_MSG("No RNG to use");
@ -33486,8 +33486,8 @@ int wolfSSL_ECDH_compute_key(void *out, size_t outlen,
ret = wc_ecc_shared_secret_ssh(key, (ecc_point*)pub_key->internal, ret = wc_ecc_shared_secret_ssh(key, (ecc_point*)pub_key->internal,
(byte *)out, &len); (byte *)out, &len);
PRIVATE_KEY_LOCK(); PRIVATE_KEY_LOCK();
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) \ #if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_SELFTEST) && \
&& !defined(HAVE_FIPS) (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,0)))
if (setGlobalRNG) if (setGlobalRNG)
key->rng = NULL; key->rng = NULL;
#endif #endif