Add OPENSSL_NO_ECDH guards

[oweals/openssl.git] / crypto / ec / ec_key.c

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 7a15e5f159f82457e5655ea20db445028be5ce28..9ce17ae9668be87ddee48d8d0fe27d4ded9f65ea 100644 (file)
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -61,12 +61,11 @@
  * contributed to the OpenSSL project.
  */
 
-#define OPENSSL_FIPSAPI
+
 
 #include <string.h>
 #include "ec_lcl.h"
 #include <openssl/err.h>
-#include <string.h>
 
 EC_KEY *EC_KEY_new(void)
        {
@@ -85,7 +84,6 @@ EC_KEY *EC_KEY_new(void)
        ret->pub_key = NULL;
        ret->priv_key= NULL;
        ret->enc_flag= 0; 
-       ret->nonce_from_hash_flag = 0;
        ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
        ret->references= 1;
        ret->method_data = NULL;
@@ -199,7 +197,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
 
        /* copy the rest */
        dest->enc_flag  = src->enc_flag;
-       dest->nonce_from_hash_flag = src->nonce_from_hash_flag;
        dest->conv_form = src->conv_form;
        dest->version   = src->version;
        dest->flags = src->flags;
@@ -236,71 +233,6 @@ int EC_KEY_up_ref(EC_KEY *r)
        return ((i > 1) ? 1 : 0);
        }
 
-#ifdef OPENSSL_FIPS
-
-#include <openssl/evp.h>
-#include <openssl/fips.h>
-#include <openssl/fips_rand.h>
-
-static int fips_check_ec(EC_KEY *key)
-       {
-       EVP_PKEY pk;
-       unsigned char tbs[] = "ECDSA Pairwise Check Data";
-       pk.type = EVP_PKEY_EC;
-       pk.pkey.ec = key;
-
-       if (!fips_pkey_signature_test(FIPS_TEST_PAIRWISE,
-                                       &pk, tbs, 0, NULL, 0, NULL, 0, NULL))
-               {
-               FIPSerr(FIPS_F_FIPS_CHECK_EC,FIPS_R_PAIRWISE_TEST_FAILED);
-               fips_set_selftest_fail();
-               return 0;
-               }
-       return 1;
-       }
-
-int fips_check_ec_prng(EC_KEY *ec)
-       {
-       int bits, strength;
-       if (!FIPS_module_mode())
-               return 1;
-
-       if (ec->flags & (EC_FLAG_NON_FIPS_ALLOW|EC_FLAG_FIPS_CHECKED))
-               return 1;
-
-       if (!ec->group)
-               return 1;
-
-       bits = BN_num_bits(&ec->group->order);
-
-       if (bits < 160)
-               {
-               FIPSerr(FIPS_F_FIPS_CHECK_EC_PRNG,FIPS_R_KEY_TOO_SHORT);
-               return 0;
-               }
-       /* Comparable algorithm strengths: from SP800-57 table 2 */
-       if (bits >= 512)
-               strength = 256;
-       else if (bits >= 384)
-               strength = 192;
-       else if (bits >= 256)
-               strength = 128;
-       else if (bits >= 224)
-               strength = 112;
-       else
-               strength = 80;
-
-
-       if (FIPS_rand_strength() >= strength)
-               return 1;
-
-       FIPSerr(FIPS_F_FIPS_CHECK_EC_PRNG,FIPS_R_PRNG_STRENGTH_TOO_LOW);
-       return 0;
-
-       }
-
-#endif
-
 int EC_KEY_generate_key(EC_KEY *eckey)
        {       
        int     ok = 0;
@@ -308,14 +240,6 @@ int EC_KEY_generate_key(EC_KEY *eckey)
        BIGNUM  *priv_key = NULL, *order = NULL;
        EC_POINT *pub_key = NULL;
 
-#ifdef OPENSSL_FIPS
-       if(FIPS_selftest_failed())
-               {
-               FIPSerr(FIPS_F_EC_KEY_GENERATE_KEY,FIPS_R_FIPS_SELFTEST_FAILED);
-               return 0;
-               }
-#endif
-
        if (!eckey || !eckey->group)
                {
                ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
@@ -337,11 +261,6 @@ int EC_KEY_generate_key(EC_KEY *eckey)
        if (!EC_GROUP_get_order(eckey->group, order, ctx))
                goto err;
 
-#ifdef OPENSSL_FIPS
-       if (!fips_check_ec_prng(eckey))
-               goto err;
-#endif
-
        do
                if (!BN_rand_range(priv_key, order))
                        goto err;
@@ -362,15 +281,6 @@ int EC_KEY_generate_key(EC_KEY *eckey)
        eckey->priv_key = priv_key;
        eckey->pub_key  = pub_key;
 
-#ifdef OPENSSL_FIPS
-       if(!fips_check_ec(eckey))
-               {
-               eckey->priv_key = NULL;
-               eckey->pub_key  = NULL;
-               goto err;
-               }
-#endif
-
        ok=1;
 
 err:   
@@ -416,7 +326,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
                goto err;
                }
        /* testing whether pub_key * order is the point at infinity */
-       order = &eckey->group->order;
+       order = eckey->group->order;
        if (BN_is_zero(order))
                {
                ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_INVALID_GROUP_ORDER);
@@ -517,8 +427,8 @@ int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y)
         * field order: if not values are out of range.
         */
        if (BN_cmp(x, tx) || BN_cmp(y, ty)
-               || (BN_cmp(x, &key->group->field) >= 0)
-               || (BN_cmp(y, &key->group->field) >= 0))
+               || (BN_cmp(x, key->group->field) >= 0)
+               || (BN_cmp(y, key->group->field) >= 0))
                {
                ECerr(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES,
                        EC_R_COORDINATES_OUT_OF_RANGE);
@@ -591,16 +501,6 @@ void EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags)
        key->enc_flag = flags;
        }
 
-int EC_KEY_get_nonce_from_hash(const EC_KEY *key)
-       {
-       return key->nonce_from_hash_flag;
-       }
-
-void EC_KEY_set_nonce_from_hash(EC_KEY *key, int on)
-       {
-       key->nonce_from_hash_flag = on != 0;
-       }
-
 point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key)
        {
        return key->conv_form;