Skip to content

Crypto: Hide forbidden algorithms when FIPS enabled #10312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 29 commits into
base: maint
Choose a base branch
from
+3,680 −1,959
Draft

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
aa72b5e
Infrastructure for returning additional fields in crypto:supports/0, /1
kvakvs Oct 14, 2025
fa19b83
Documentation for enable_fips_mode where we discourage its manual inv…
kvakvs Nov 5, 2025
44fe090
Lazy pubkey algorithms init
kvakvs Nov 5, 2025
69805e9
Cipher and MAC algorithms init edits
kvakvs Nov 6, 2025
d5d08e3
New store module for algorithms
kvakvs Nov 6, 2025
06b59d4
Functioning storage for curves and pkeys
kvakvs Nov 6, 2025
d3196a0
Minor changes
kvakvs Nov 7, 2025
dc92bac
Pubkey collections implementation
kvakvs Nov 8, 2025
72a5b56
Digest collection looks good
kvakvs Nov 9, 2025
91b4f05
WIP curve algorithms; auto resource helpers
kvakvs Nov 9, 2025
466634f
Trying with SSL API 3.0 and FIPS
kvakvs Nov 11, 2025
7b7ffb2
Syntax and warnings fixes
kvakvs Nov 12, 2025
c1f436e
KEM algorithms storage and probes
kvakvs Nov 12, 2025
9e88a40
RSA opts and fix errors/warnings accessing C api for digests
kvakvs Nov 12, 2025
4d2feb7
rsa opts and macs added, ciphers placeholder added
kvakvs Nov 12, 2025
1733798
Switch to FIPS 3.5.4 and test with it (WIP)
kvakvs Nov 14, 2025
7ab9908
Some fixes for 3.5.4 non-fips
kvakvs Nov 14, 2025
00c34b5
Fix stopper logic in the probes iteration
kvakvs Nov 14, 2025
b5603f6
Finished probe data for ciphers, probe code still WIP
kvakvs Nov 15, 2025
01da622
Cipher collection finished. Tested in 3.5.4 no-fips
kvakvs Nov 15, 2025
493e0b8
Reverting some formatting. Review notes addressed
kvakvs Nov 18, 2025
1f7793c
Return type is not bool
kvakvs Nov 18, 2025
b4a5f8a
Formatting; Testing under OpenSSL 1.1.1w
kvakvs Nov 20, 2025
f92e679
Fixes for 1.1.1w non FIPS
kvakvs Nov 25, 2025
c74d1bb
Correct use of v1 name for Erlang atoms; Typo in exported rsaopts_as_…
kvakvs Nov 25, 2025
8354508
Fixes for 0.9.8zh and for 3.5.4 FIPS
kvakvs Nov 25, 2025
43063a2
Fixes for 3.5.4 FIPS
kvakvs Nov 26, 2025
3c6b0e4
Documentation updated with OpenSSL 0.x and 1.1.0 out of support
kvakvs Nov 26, 2025
fe0ccf4
Testing with 1.0.1u
kvakvs Nov 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib/crypto/c_src/aead.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ ERL_NIF_TERM aead_cipher_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
{ret = EXCP_BADARG_N(env, 0, "Bad cipher"); goto done;}
if (! (ctx_res->cipherp->flags & AEAD_CIPHER) )
{ret = EXCP_BADARG_N(env, 0, "Not aead cipher"); goto done;}
if (CIPHER_FORBIDDEN_IN_FIPS(ctx_res->cipherp))
if (IS_CIPHER_FORBIDDEN_IN_FIPS(ctx_res->cipherp))
{ret = EXCP_NOTSUP_N(env, 0, "Forbidden in FIPS"); goto done;}

#if defined(HAVE_GCM_EVP_DECRYPT_BUG)
Expand Down Expand Up @@ -210,7 +210,7 @@ ERL_NIF_TERM aead_cipher_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
{ret = EXCP_BADARG_N(env, 0, "Bad cipher"); goto done;}
if (! (cipherp->flags & AEAD_CIPHER) )
{ret = EXCP_BADARG_N(env, 0, "Not aead cipher"); goto done;}
if (CIPHER_FORBIDDEN_IN_FIPS(cipherp))
if (IS_CIPHER_FORBIDDEN_IN_FIPS(cipherp))
{ret = EXCP_NOTSUP_N(env, 0, "Forbidden in FIPS"); goto done;}

#if defined(HAVE_GCM_EVP_DECRYPT_BUG)
Expand Down
Loading
Loading