Crypto: Hide forbidden algorithms when FIPS enabled #10312

kvakvs · 2025-10-21T11:43:06Z

Problem

crypto:supports/0 is currently undocumented but i will add a doc string to it.
Crypto returns some algorithms which are indirectly forbidden under FIPS (i.e. listed as available but not working).

The Expectation

Expected: All algorithms returned by crypto:supports/0 will be available at least in one way.
Bonus points for returning forbidden algorithm names separately so that the users will not complain that something "has disappeared" and will see the reason.

Solution

The call to crypto:supports/0 under FIPS build with fips=enabled in crypto app settings, will filter the algorithms by their availability in a much more strict way (by actually trying to initialize each algorithm and recording the failures as a sign of unavailability) and will return an additional section in the results containing disabled algorithms:

[{hashs,[...
 {ciphers, ...
 {kems,[]},
 {public_keys, ...
 {macs, ...
 {curves, ...
 {rsa_opts, ...
 {fips_forbidden,[{hashs,[blake2s,blake2b,sm3,ripemd160,md5,
                          md4]},
                  {ciphers,[chacha20,sm4_ctr,sm4_ofb,sm4_cfb,sm4_ecb,sm4_cbc,
                            blowfish_ecb,blowfish_ofb64,blowfish_cfb64,blowfish_cbc,
                            des_ede3_cfb,des_ecb,des_cfb,des_cbc,rc4|...]},
                  {kems,[mlkem1024,mlkem768,mlkem512]},
                  {public_keys,[srp,eddh,eddsa,ecdh,ecdsa,ec_gf2m,dss]},
                  {macs,[hmac,poly1305]},
                  {curves,[secp256r1]},
                  {rsa_opts,[]}]}]

Note this will only appear if FIPS is enabled. And this will only appear if SSL API is 3.0 or later.
The behaviour with FIPS disabled or older SSL will remain unchanged.

TO DO

github-actions · 2025-10-21T11:44:05Z

CT Test Results

2 files 14 suites 3m 55s ⏱️
190 tests 152 ✅ 23 💤 15 ❌
478 runs 195 ✅ 241 💤 42 ❌

For more details on these failures, see this check.

Results for commit 01da622.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

fips_forbidden_* impl for digests fips_forbidden_* impl for public keys fips_forbidden_* impl for ciphers fips_forbidden_* impl for MACs fips_forbidden_* impl for KEM fips_forbidden_* impl for curves Use stdint/stdbool types already available FIPS doc page updated

sverker

I did some testing, and it seems like
EVP_MD_fetch(NULL, p->str_v3, "fips=yes") // if supported with FIPS enabled
EVP_MD_fetch(NULL, p->str_v3, "fips=no") // if supported with FIPS disabled
EVP_MD_fetch(NULL, p->str_v3, "") // if supported in current mode set by EVP_default_properties_enable_fips()

sverker · 2025-10-22T11:24:32Z

lib/crypto/c_src/algorithms.c

+static bool IS_PUBKEY_FORBIDDEN_IN_FIPS(const struct pkey_availability_t* p) {
+    return p->flags == FIPS_FORBIDDEN_PKEY_ALL
+            || p->flags == FIPS_PKEY_NOT_AVAIL;
+}


Is there a difference between FIPS_PKEY_NOT_AVAIL and FIPS_FORBIDDEN_PKEY_ALL?

sverker · 2025-10-29T10:59:16Z

lib/crypto/c_src/algorithms.c

+    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, str_v3, "fips=yes");
+    /* failed: algorithm not available, do not add */
+    if (ctx) {
+        if (EVP_PKEY_keygen_init(ctx) <= 0) { /* can't generate keys */
+            unavailable |= FIPS_FORBIDDEN_PKEY_KEYGEN;
+        }
+        EVP_PKEY_CTX_free(ctx);
+
+        ctx = EVP_PKEY_CTX_new_from_name(NULL, str_v3, NULL);


Why "fips=yes" in one place but not the other.

sverker · 2025-10-29T11:53:43Z

lib/crypto/c_src/algorithms.c

+static size_t curves_lazy_init(ErlNifEnv* env, const bool fips_enabled) {
+    size_t result = 0;
+    if (algo_curve.count >= 0) return algo_curve.count;
+
+    enif_mutex_lock(algo_curve.mtx_init_curve_types);
+    if (algo_curve.count < 0) {
+        init_curves(env, fips_enabled); /* also updates algo_curve.count[0] or [1] */


Why pass fips_enabled to init_curves? We only have one array of curves initialized once here. And fips mode can be switched on/off in runtime with crypto:enable_fips_mode/1 (discouraged but used by our tests).

…ocation

sverker · 2025-11-17T18:01:38Z

lib/crypto/c_src/algorithms_collection.cpp

+        enif_make_existing_atom(env, atom_name, &atom, ERL_NIF_UTF8);
+        if (!atom) {
+            atom = enif_make_atom(env, atom_name);
+        }


enif_make_atom already does this optimization.

Confused. In erl_nif.c: enif_make_atom calls enif_make_atom_len, which calls enif_make_new_atom_len, which calls erts_atom_put. That doesn't look like its checking for existence.

... which calls erts_atom_put_index, which takes the atom table read lock and does a lookup.

atom_read_lock(); aix = index_get(&erts_atom_table, (void*) &a); atom_read_unlock(); if (aix >= 0) { /* Already in table no need to verify it */ return aix; }

sverker · 2025-11-17T19:20:41Z

lib/crypto/c_src/algorithms_kem.cpp

+        return; // failed to find the algorithm, do not add
+    }
+#endif // FIPS_SUPPORT && HAS_3_0_API
+    return output.push_back(algo);


Function return type is void ?

I knew this is allowed, but now i dug into the actual C++ standard to prove it. Not allowed in C.

I think it's just confusing.

sverker · 2025-11-17T19:41:13Z

lib/crypto/src/crypto.erl

+Do not use this function in your code, it is designed to only be used by the crypto
+library or by Erlang self-tests. This function is called automatically on first load
+of the crypto NIF with the value `fips_mode :: true | false` from crypto app environment.
+
+This operation is not thread-safe, it should only be called once (by the Erlang crypto
+library) and user code calling it, while there are SSL operations running, might get
+undesired consequences, because the attached OpenSSL library structures will switch
+on the fly. Unintended non-FIPS algorithms might become enabled in your FIPS-only code.


I think you can skip the fact that enable_fips_mode is called once by the crypto app itself. That's an irrelevant implementation detail.

sverker · 2025-11-17T19:48:30Z

lib/crypto/c_src/fips.c

+        bool result = FIPS_mode_set(fips_mode) ? atom_true : atom_false;
+        if (result && previous_setting != fips_mode) {
+            /* Reinitialize the algorithms which may disappear or reappear when FIPS mode changes */
+            algorithms_reset_cache();
+        }
+        return result;


Return type is ERL_NIF_TERM which cannot be treated as a bool.

The testing for FIPS mode is not done yet. I now have tested only under non-FIPS, so those code blocks remain disabled with #ifdef, will find it out soon! Fixed this one, thanks for noticing.

…list and copypaste error in algorithms.c

kvakvs added the team:PS Assigned to OTP team PS label Oct 21, 2025

IngelaAndin requested review from IngelaAndin and sverker October 21, 2025 12:41

IngelaAndin assigned kvakvs Oct 21, 2025

kvakvs force-pushed the 9520-fips-hide-algorithms branch 3 times, most recently from 4fd908c to 65f3f3d Compare October 23, 2025 13:26

kvakvs changed the base branch from master to maint October 23, 2025 13:55

kvakvs force-pushed the 9520-fips-hide-algorithms branch from cd85ef1 to 0c6bd7f Compare October 23, 2025 13:57

kvakvs force-pushed the 9520-fips-hide-algorithms branch from 0c6bd7f to aa72b5e Compare October 23, 2025 13:58

sverker reviewed Oct 29, 2025

View reviewed changes

kvakvs added 9 commits November 5, 2025 02:39

Documentation for enable_fips_mode where we discourage its manual inv…

fa19b83

…ocation

Lazy pubkey algorithms init

44fe090

Cipher and MAC algorithms init edits

69805e9

New store module for algorithms

d5d08e3

Functioning storage for curves and pkeys

06b59d4

Minor changes

d3196a0

Pubkey collections implementation

dc92bac

Digest collection looks good

72a5b56

WIP curve algorithms; auto resource helpers

91b4f05

kvakvs marked this pull request as draft November 9, 2025 15:11

kvakvs added 7 commits November 11, 2025 22:02

Trying with SSL API 3.0 and FIPS

466634f

Syntax and warnings fixes

7b7ffb2

KEM algorithms storage and probes

c1f436e

RSA opts and fix errors/warnings accessing C api for digests

9e88a40

rsa opts and macs added, ciphers placeholder added

4d2feb7

Switch to FIPS 3.5.4 and test with it (WIP)

1733798

Some fixes for 3.5.4 non-fips

7ab9908

kvakvs added 3 commits November 14, 2025 12:53

Fix stopper logic in the probes iteration

00c34b5

Finished probe data for ciphers, probe code still WIP

b5603f6

Cipher collection finished. Tested in 3.5.4 no-fips

01da622

sverker reviewed Nov 17, 2025

View reviewed changes

kvakvs added 9 commits November 18, 2025 04:16

Reverting some formatting. Review notes addressed

493e0b8

Return type is not bool

1f7793c

Formatting; Testing under OpenSSL 1.1.1w

b4a5f8a

Fixes for 1.1.1w non FIPS

f92e679

Correct use of v1 name for Erlang atoms; Typo in exported rsaopts_as_…

c74d1bb

…list and copypaste error in algorithms.c

Fixes for 0.9.8zh and for 3.5.4 FIPS

8354508

Fixes for 3.5.4 FIPS

43063a2

Documentation updated with OpenSSL 0.x and 1.1.0 out of support

3c6b0e4

Testing with 1.0.1u

fe0ccf4

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Are you sure you want to change the base?

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Uh oh!

Conversation

kvakvs commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

The Expectation

Solution

TO DO

Uh oh!

github-actions bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CT Test Results

Artifacts

Uh oh!

sverker left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sverker Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kvakvs Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kvakvs commented Oct 21, 2025 •

edited

Loading

github-actions bot commented Oct 21, 2025 •

edited

Loading

sverker Nov 18, 2025 •

edited

Loading

kvakvs Nov 18, 2025 •

edited

Loading