From ad8a879ef28bbf9f8d4466f1382387fba9848423 Mon Sep 17 00:00:00 2001 From: Lealem Amedie Date: Sun, 26 Jul 2026 09:29:42 -0600 Subject: [PATCH] Limit WC_CMAC_TAG_MIN_SZ bump to FIPS builds --- wolfssl/wolfcrypt/cmac.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/wolfssl/wolfcrypt/cmac.h b/wolfssl/wolfcrypt/cmac.h index 0f71276290..fb55934777 100644 --- a/wolfssl/wolfcrypt/cmac.h +++ b/wolfssl/wolfcrypt/cmac.h @@ -100,12 +100,14 @@ struct Cmac { /* Reasonable defaults */ -/* SP800-38b recommends a minimum tag length of 64-bits */ #ifndef WC_CMAC_TAG_MAX_SZ #define WC_CMAC_TAG_MAX_SZ 16 #endif -#ifndef WC_CMAC_TAG_MIN_SZ +/* SP800-38b recommends a minimum tag length of 64-bits */ +#if FIPS_VERSION3_GE(7,0,0) #define WC_CMAC_TAG_MIN_SZ 8 +#elif !defined(WC_CMAC_TAG_MIN_SZ) + #define WC_CMAC_TAG_MIN_SZ 4 #endif #if FIPS_VERSION3_GE(6,0,0)