From 69a80f7d5e1363276a9588546df28782a18a8c36 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sat, 23 Apr 2011 21:59:12 +0000 Subject: More fixes for DSA FIPS overrides. --- crypto/dsa/dsa_ossl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'crypto/dsa/dsa_ossl.c') diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c index acf7af95c4..38f667f4e7 100644 --- a/crypto/dsa/dsa_ossl.c +++ b/crypto/dsa/dsa_ossl.c @@ -353,7 +353,8 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig, return -1; } - if (FIPS_mode() && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) + if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) + && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) { DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL); return -1; -- cgit v1.2.3