diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2011-06-09 15:21:46 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2011-06-09 15:21:46 +0000 |
| commit | ed9b0e5cba9ddc41e7b902d925c5b1b836ada366 (patch) | |
| tree | 6e7a8ad4ac87efff5e0508379091331d8fbd0f9c /crypto/dh | |
| parent | 752c1a0ce952eb21b5c1e90a7529f52b819b8b2b (diff) | |
Redirect DH key and parameter generation.
Diffstat (limited to 'crypto/dh')
| -rw-r--r-- | crypto/dh/dh.h | 1 | ||||
| -rw-r--r-- | crypto/dh/dh_err.c | 1 | ||||
| -rw-r--r-- | crypto/dh/dh_gen.c | 17 |
3 files changed, 19 insertions, 0 deletions
diff --git a/crypto/dh/dh.h b/crypto/dh/dh.h index b6d367bb6a..ea59e610ef 100644 --- a/crypto/dh/dh.h +++ b/crypto/dh/dh.h @@ -247,6 +247,7 @@ void ERR_load_DH_strings(void); #define DH_F_DH_BUILTIN_GENPARAMS 106 #define DH_F_DH_COMPUTE_KEY 114 #define DH_F_DH_GENERATE_KEY 115 +#define DH_F_DH_GENERATE_PARAMETERS_EX 116 #define DH_F_DH_NEW_METHOD 105 #define DH_F_DH_PARAM_DECODE 107 #define DH_F_DH_PRIV_DECODE 110 diff --git a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c index 1da2c12cff..56d3df7356 100644 --- a/crypto/dh/dh_err.c +++ b/crypto/dh/dh_err.c @@ -75,6 +75,7 @@ static ERR_STRING_DATA DH_str_functs[]= {ERR_FUNC(DH_F_DH_BUILTIN_GENPARAMS), "DH_BUILTIN_GENPARAMS"}, {ERR_FUNC(DH_F_DH_COMPUTE_KEY), "DH_compute_key"}, {ERR_FUNC(DH_F_DH_GENERATE_KEY), "DH_generate_key"}, +{ERR_FUNC(DH_F_DH_GENERATE_PARAMETERS_EX), "DH_generate_parameters_ex"}, {ERR_FUNC(DH_F_DH_NEW_METHOD), "DH_new_method"}, {ERR_FUNC(DH_F_DH_PARAM_DECODE), "DH_PARAM_DECODE"}, {ERR_FUNC(DH_F_DH_PRIV_DECODE), "DH_PRIV_DECODE"}, diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c index cfd5b11868..7b1fe9c9cb 100644 --- a/crypto/dh/dh_gen.c +++ b/crypto/dh/dh_gen.c @@ -66,12 +66,29 @@ #include <openssl/bn.h> #include <openssl/dh.h> +#ifdef OPENSSL_FIPS +#include <openssl/fips.h> +#endif + static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb); int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb) { +#ifdef OPENSSL_FIPS + if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD) + && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW)) + { + DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD); + return 0; + } +#endif if(ret->meth->generate_params) return ret->meth->generate_params(ret, prime_len, generator, cb); +#ifdef OPENSSL_FIPS + if (FIPS_mode()) + return FIPS_dh_generate_parameters_ex(ret, prime_len, + generator, cb); +#endif return dh_builtin_genparams(ret, prime_len, generator, cb); } |