From e89997287fe75d1ddfd76bb1c9d3a2c36dc5ba62 Mon Sep 17 00:00:00 2001
From: Daniel Pouzzner <douzzer@wolfssl.com>
Date: Wed, 5 Aug 2026 18:33:25 -0500
Subject: [PATCH] configure.ac, wolfssl/wolfcrypt/settings.h: finish
 implementing opt-in DH for FIPS v7+.

---
 configure.ac                 | 18 +++++++++++++++---
 wolfssl/wolfcrypt/settings.h |  9 +++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/configure.ac b/configure.ac
index 36a60a9b6d..695f3fe419 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1891,14 +1891,17 @@ then
             -dh) lkcapi_dh=no ;;
             esac
         done
-        if test "$lkcapi_dh" = yes; then
+        if test "$lkcapi_dh" = yes
+        then
             enable_dh=conditional
         fi
     fi
 
     # Enable WOLFSSL_DH_EXTRA and DH const table speedups (eliminates `-lm` math lib dependency)
-    # No effect if DH is disabled.
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
+    if test "$enable_dh" != no
+    then
+        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
+    fi
 
     DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT"
@@ -12893,6 +12896,15 @@ then
         fi
     fi
 fi
+
+
+# Provisions for opt-in DH (FIPS v7+):
+if test "$ENABLED_DH" != "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_DH"
+fi
+
+
 ################################################################################
 
 # USER SETTINGS
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index 0fd6d99a69..e234ba0667 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -5950,6 +5950,15 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
     #error WC_C_DYNAMIC_FALLBACK requires WC_HAVE_VECTOR_SPEEDUPS
 #endif
 
+/* setup for opt-in DH in FIPS v7+ */
+#if FIPS_VERSION3_GE(7,0,0) && !defined(HAVE_DH) && !defined(NO_DH)
+    #define NO_DH
+#elif defined(NO_DH)
+    #undef HAVE_DH
+#elif !defined(HAVE_DH)
+    #define HAVE_DH
+#endif
+
 #ifdef __cplusplus
     }   /* extern "C" */
 #endif