feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #3170 from kaleb-himes/FIPS_USER_SETTINGS

Browse Source 
Remove fixed len constraint in FIPS mode
This commit is contained in:
toddouska
2020-08-03 16:35:26 -07:00
committed by GitHub
parent bfb4b2079b 80678d96b6
commit 87f5dac3c4
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
IDE/GCC-ARM/Header/user_settings.h
View File

@@ -171,16 +171,15 @@ extern "C" {
#undef ECC_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
/* Enable cofactor support */
#ifdef HAVE_FIPS
#undef HAVE_ECC_CDH
#define HAVE_ECC_CDH
#endif
#define HAVE_ECC_CDH /* Enable cofactor support */
#undef NO_STRICT_ECDSA_LEN
#define NO_STRICT_ECDSA_LEN /* Do not force fixed len w/ FIPS */
/* Validate import */
#ifdef HAVE_FIPS
#undef WOLFSSL_VALIDATE_ECC_IMPORT
#define WOLFSSL_VALIDATE_ECC_IMPORT
#define WOLFSSL_VALIDATE_ECC_IMPORT /* Validate import */
#endif
/* Compressed Key Support */

9
wolfssl/wolfcrypt/settings.h
View File

@@ -2269,6 +2269,15 @@ extern void uITRON4_free(void *p) ;
#undef WOLFSSL_TLS13
#endif
/* For FIPSv2 make sure the ECDSA encoding allows extra bytes
* but make sure users consider enabling it */
#if !defined(NO_STRICT_ECDSA_LEN) && defined(HAVE_FIPS) && \
defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
/* ECDSA length checks off by default for CAVP testing
* consider enabling strict checks in production */
#define NO_STRICT_ECDSA_LEN
#endif
#ifdef __cplusplus
} /* extern "C" */