Merge FIPS low level algorithm blocking code. Give hard errors if non-FIPS

algorithms are use in FIPS mode using low level API. No effect in non-FIPS
mode.

diff --git a/crypto/aes/aes.h b/crypto/aes/aes.h
index baf0222d49d309612e9e0f64db200fa29bda190a..450f2b4051b22b33fdbc9feaa5628535852628f4 100644 (file)
--- a/crypto/aes/aes.h
+++ b/crypto/aes/aes.h
@@ -66,6 +66,10 @@
 #define AES_MAXNR 14
 #define AES_BLOCK_SIZE 16
 
+#ifdef OPENSSL_FIPS
+#define FIPS_AES_SIZE_T        int
+#endif
+
 #ifdef  __cplusplus
 extern "C" {
 #endif

diff --git a/crypto/aes/aes_cbc.c b/crypto/aes/aes_cbc.c
index d2ba6bcdb4659d1ed9c6a01a898b08e167e0f2ef..373864cd4bdb9cdf387d5d620e22361aed76b61e 100644 (file)
--- a/crypto/aes/aes_cbc.c
+++ b/crypto/aes/aes_cbc.c
@@ -59,6 +59,7 @@
 #include <openssl/aes.h>
 #include "aes_locl.h"
 
+#if !defined(OPENSSL_FIPS_AES_ASM)
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                     const unsigned long length, const AES_KEY *key,
                     unsigned char *ivec, const int enc) {
@@ -129,3 +130,4 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                }
        }
 }
+#endif

diff --git a/crypto/aes/aes_core.c b/crypto/aes/aes_core.c
index 3a80e18b0a4856103a2da23f88d945bb0a925107..cffdd4daec4daa5e474d68cb13b320c549006e64 100644 (file)
--- a/crypto/aes/aes_core.c
+++ b/crypto/aes/aes_core.c
@@ -37,6 +37,10 @@
 
 #include <stdlib.h>
 #include <openssl/aes.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "aes_locl.h"
 
 /*
@@ -631,6 +635,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
        int i = 0;
        u32 temp;
 
+#ifdef OPENSSL_FIPS
+       FIPS_selftest_check();
+#endif
+
        if (!userKey || !key)
                return -1;
        if (bits != 128 && bits != 192 && bits != 256)

diff --git a/crypto/bf/bf_skey.c b/crypto/bf/bf_skey.c
index 3673cdee6e26172c78a3de35da48eb62b4e26dee..6ac2aeb2795944bee324f6ac4344237384ecbcca 100644 (file)
--- a/crypto/bf/bf_skey.c
+++ b/crypto/bf/bf_skey.c
@@ -59,10 +59,15 @@
 #include <stdio.h>
 #include <string.h>
 #include <openssl/blowfish.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "bf_locl.h"
 #include "bf_pi.h"
 
-void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
+FIPS_NON_FIPS_VCIPHER_Init(BF)
        {
        int i;
        BF_LONG *p,ri,in[2];

diff --git a/crypto/bf/blowfish.h b/crypto/bf/blowfish.h
index cd49e85ab29a53c1ee48459fd193061f548ae936..d24ffccb65f6856b99b8fdd68ba11c4eb9706e11 100644 (file)
--- a/crypto/bf/blowfish.h
+++ b/crypto/bf/blowfish.h
@@ -104,7 +104,9 @@ typedef struct bf_key_st
        BF_LONG S[4*256];
        } BF_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);
+#endif
 void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
 
 void BF_encrypt(BF_LONG *data,const BF_KEY *key);

diff --git a/crypto/cast/c_skey.c b/crypto/cast/c_skey.c
index 76e40005c998373141a3f2728786adbcd714b4a4..68e690a60c2b29f11588962475d684fa7d4ef6d5 100644 (file)
--- a/crypto/cast/c_skey.c
+++ b/crypto/cast/c_skey.c
@@ -57,6 +57,11 @@
  */
 
 #include <openssl/cast.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "cast_lcl.h"
 #include "cast_s.h"
 
@@ -72,7 +77,7 @@
 #define S6 CAST_S_table6
 #define S7 CAST_S_table7
 
-void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
+FIPS_NON_FIPS_VCIPHER_Init(CAST)
        {
        CAST_LONG x[16];
        CAST_LONG z[16];

diff --git a/crypto/cast/cast.h b/crypto/cast/cast.h
index 90b45b950aa8dcbc2b2156c3523c8a337281b3d3..1faf5806aacbc1b01bbbb018f41b436877e44678 100644 (file)
--- a/crypto/cast/cast.h
+++ b/crypto/cast/cast.h
@@ -83,7 +83,9 @@ typedef struct cast_key_st
        int short_key;  /* Use reduced rounds for short key */
        } CAST_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
+#endif
 void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
 void CAST_ecb_encrypt(const unsigned char *in,unsigned char *out,CAST_KEY *key,
                      int enc);

diff --git a/crypto/crypto.h b/crypto/crypto.h
index fe2c1d6403422b0720f3abaa59cb31083a95c545..1b6c5df3291e590dfe4dbcfb5f94b15809cf3c0e 100644 (file)
--- a/crypto/crypto.h
+++ b/crypto/crypto.h
@@ -523,6 +523,60 @@ unsigned long *OPENSSL_ia32cap_loc(void);
 #define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
 int OPENSSL_isservice(void);
 
+#ifdef OPENSSL_FIPS
+#define FIPS_ERROR_IGNORED(alg) OpenSSLDie(__FILE__, __LINE__, \
+               alg " previous FIPS forbidden algorithm error ignored");
+
+#define FIPS_BAD_ABORT(alg) OpenSSLDie(__FILE__, __LINE__, \
+               #alg " Algorithm forbidden in FIPS mode");
+
+#ifdef OPENSSL_FIPS_STRICT
+#define FIPS_BAD_ALGORITHM(alg) FIPS_BAD_ABORT(alg)
+#else
+#define FIPS_BAD_ALGORITHM(alg) \
+       { \
+       FIPSerr(FIPS_F_HASH_FINAL,FIPS_R_NON_FIPS_METHOD); \
+       ERR_add_error_data(2, "Algorithm=", #alg); \
+       return 0; \
+       }
+#endif
+
+/* Low level digest API blocking macro */
+
+#define FIPS_NON_FIPS_MD_Init(alg) \
+       int alg##_Init(alg##_CTX *c) \
+               { \
+               if (FIPS_mode()) \
+                       FIPS_BAD_ALGORITHM(alg) \
+               return private_##alg##_Init(c); \
+               } \
+       int private_##alg##_Init(alg##_CTX *c)
+
+/* For ciphers the API often varies from cipher to cipher and each needs to
+ * be treated as a special case. Variable key length ciphers (Blowfish, RC4,
+ * CAST) however are very similar and can use a blocking macro.
+ */
+
+#define FIPS_NON_FIPS_VCIPHER_Init(alg) \
+       void alg##_set_key(alg##_KEY *key, int len, const unsigned char *data) \
+               { \
+               if (FIPS_mode()) \
+                       FIPS_BAD_ABORT(alg) \
+               private_##alg##_set_key(key, len, data); \
+               } \
+       void private_##alg##_set_key(alg##_KEY *key, int len, \
+                                       const unsigned char *data)
+
+#else
+
+#define FIPS_NON_FIPS_VCIPHER_Init(alg) \
+       void alg##_set_key(alg##_KEY *key, int len, const unsigned char *data)
+
+#define FIPS_NON_FIPS_MD_Init(alg) \
+       int alg##_Init(alg##_CTX *c) 
+
+#endif /* def OPENSSL_FIPS */
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.

diff --git a/crypto/idea/i_skey.c b/crypto/idea/i_skey.c
index 3b1bbd8a45d868c76a444967e78bd9e5af6cf9cc..fa75b144661396d3055508fac0060c60770c543e 100644 (file)
--- a/crypto/idea/i_skey.c
+++ b/crypto/idea/i_skey.c
@@ -57,10 +57,27 @@
  */
 
 #include <openssl/idea.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "idea_lcl.h"
 
 static IDEA_INT inverse(unsigned int xin);
+
+#ifdef OPENSSL_FIPS
+void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
+       {
+       if (FIPS_mode())
+               FIPS_BAD_ABORT(IDEA)
+       private_idea_set_encrypt_key(key, ks);
+       }
+void private_idea_set_encrypt_key(const unsigned char *key,
+                                               IDEA_KEY_SCHEDULE *ks)
+#else
 void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks)
+#endif
        {
        int i;
        register IDEA_INT *kt,*kf,r0,r1,r2;

diff --git a/crypto/idea/idea.h b/crypto/idea/idea.h
index bf97a37e39ba9dbf8789c103a05b058ce83fe6bf..a137d4cbce200d9550ee2c3205f1c8270778f82e 100644 (file)
--- a/crypto/idea/idea.h
+++ b/crypto/idea/idea.h
@@ -83,6 +83,9 @@ typedef struct idea_key_st
 const char *idea_options(void);
 void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,
        IDEA_KEY_SCHEDULE *ks);
+#ifdef OPENSSL_FIPS
+void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
+#endif
 void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
 void idea_set_decrypt_key(const IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
 void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,

diff --git a/crypto/md2/md2.h b/crypto/md2/md2.h
index a46120e7d418b2184a7e29827862e78a59600829..d59c9f25931f37193ce961ca943acb193f12ceca 100644 (file)
--- a/crypto/md2/md2.h
+++ b/crypto/md2/md2.h
@@ -81,6 +81,9 @@ typedef struct MD2state_st
        } MD2_CTX;
 
 const char *MD2_options(void);
+#ifdef OPENSSL_FIPS
+int private_MD2_Init(MD2_CTX *c);
+#endif
 int MD2_Init(MD2_CTX *c);
 int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len);
 int MD2_Final(unsigned char *md, MD2_CTX *c);

diff --git a/crypto/md2/md2_dgst.c b/crypto/md2/md2_dgst.c
index 6f68b25c6a8f0520a5e8c0ceeffc5543b21d917f..cc4eeaf7a7ad5c759fcec3a6c516c6ee65b5cc91 100644 (file)
--- a/crypto/md2/md2_dgst.c
+++ b/crypto/md2/md2_dgst.c
@@ -62,6 +62,11 @@
 #include <openssl/md2.h>
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
+#include <openssl/err.h>
 
 const char MD2_version[]="MD2" OPENSSL_VERSION_PTEXT;
 
@@ -116,7 +121,7 @@ const char *MD2_options(void)
                return("md2(int)");
        }
 
-int MD2_Init(MD2_CTX *c)
+FIPS_NON_FIPS_MD_Init(MD2)
        {
        c->num=0;
        memset(c->state,0,sizeof c->state);

diff --git a/crypto/md4/md4.h b/crypto/md4/md4.h
index 5598c93a4fea9a7c612efbe2fa611313950fe340..ba1fe4a6ee82234117311e3f12acb975878e2b73 100644 (file)
--- a/crypto/md4/md4.h
+++ b/crypto/md4/md4.h
@@ -105,6 +105,9 @@ typedef struct MD4state_st
        unsigned int num;
        } MD4_CTX;
 
+#ifdef OPENSSL_FIPS
+int private_MD4_Init(MD4_CTX *c);
+#endif
 int MD4_Init(MD4_CTX *c);
 int MD4_Update(MD4_CTX *c, const void *data, size_t len);
 int MD4_Final(unsigned char *md, MD4_CTX *c);

diff --git a/crypto/md4/md4_dgst.c b/crypto/md4/md4_dgst.c
index cfef94af39a0b098519bcfd052f05d231c7432cf..0f5448601d8c92c203cf82293e81001126e1a1ab 100644 (file)
--- a/crypto/md4/md4_dgst.c
+++ b/crypto/md4/md4_dgst.c
@@ -59,6 +59,11 @@
 #include <stdio.h>
 #include "md4_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/err.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const char MD4_version[]="MD4" OPENSSL_VERSION_PTEXT;
 
@@ -70,7 +75,7 @@ const char MD4_version[]="MD4" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-int MD4_Init(MD4_CTX *c)
+FIPS_NON_FIPS_MD_Init(MD4)
        {
        c->A=INIT_DATA_A;
        c->B=INIT_DATA_B;

diff --git a/crypto/md5/md5.h b/crypto/md5/md5.h
index dbdc0e1abc7edab6be01189398c5d5a1db3ddb7d..0761f84a27bd05e99e56c196927e29d6ec8bd28a 100644 (file)
--- a/crypto/md5/md5.h
+++ b/crypto/md5/md5.h
@@ -105,6 +105,9 @@ typedef struct MD5state_st
        unsigned int num;
        } MD5_CTX;
 
+#ifdef OPENSSL_FIPS
+int private_MD5_Init(MD5_CTX *c);
+#endif
 int MD5_Init(MD5_CTX *c);
 int MD5_Update(MD5_CTX *c, const void *data, size_t len);
 int MD5_Final(unsigned char *md, MD5_CTX *c);

diff --git a/crypto/md5/md5_dgst.c b/crypto/md5/md5_dgst.c
index b96e332ba41786af1d0e5273a96ba08cd55aaa1e..47bb9020ee1df45b770095a10c8aac4980ff14bd 100644 (file)
--- a/crypto/md5/md5_dgst.c
+++ b/crypto/md5/md5_dgst.c
@@ -59,6 +59,11 @@
 #include <stdio.h>
 #include "md5_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/err.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const char MD5_version[]="MD5" OPENSSL_VERSION_PTEXT;
 
@@ -70,7 +75,7 @@ const char MD5_version[]="MD5" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-int MD5_Init(MD5_CTX *c)
+FIPS_NON_FIPS_MD_Init(MD5)
        {
        c->A=INIT_DATA_A;
        c->B=INIT_DATA_B;

diff --git a/crypto/mdc2/mdc2.h b/crypto/mdc2/mdc2.h
index 72778a521236aed7dcb4b0f7bbe7dcd68ff3e1a2..7e1354116ad8622cfe311533ca2b18f754eefb95 100644 (file)
--- a/crypto/mdc2/mdc2.h
+++ b/crypto/mdc2/mdc2.h
@@ -80,7 +80,9 @@ typedef struct mdc2_ctx_st
        int pad_type; /* either 1 or 2, default 1 */
        } MDC2_CTX;
 
-
+#ifdef OPENSSL_FIPS
+int private_MDC2_Init(MDC2_CTX *c);
+#endif
 int MDC2_Init(MDC2_CTX *c);
 int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);
 int MDC2_Final(unsigned char *md, MDC2_CTX *c);

diff --git a/crypto/mdc2/mdc2dgst.c b/crypto/mdc2/mdc2dgst.c
index 4aa406edc3bab41e2dc9d46db2879b392a6c0b20..a36b3f578ed1d756e0570df4f25f05a3a18bbb01 100644 (file)
--- a/crypto/mdc2/mdc2dgst.c
+++ b/crypto/mdc2/mdc2dgst.c
@@ -61,6 +61,11 @@
 #include <string.h>
 #include <openssl/des.h>
 #include <openssl/mdc2.h>
+#include <openssl/err.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 #undef c2l
 #define c2l(c,l)       (l =((DES_LONG)(*((c)++)))    , \
@@ -75,7 +80,7 @@
                        *((c)++)=(unsigned char)(((l)>>24L)&0xff))
 
 static void mdc2_body(MDC2_CTX *c, const unsigned char *in, size_t len);
-int MDC2_Init(MDC2_CTX *c)
+FIPS_NON_FIPS_MD_Init(MDC2)
        {
        c->num=0;
        c->pad_type=1;

diff --git a/crypto/rc2/rc2.h b/crypto/rc2/rc2.h
index 34c83623172f0d34d5752f185fff3fbfe288af05..e542ec94ffb69642d6fc74d5fb6c3fcbbe746375 100644 (file)
--- a/crypto/rc2/rc2.h
+++ b/crypto/rc2/rc2.h
@@ -79,7 +79,9 @@ typedef struct rc2_key_st
        RC2_INT data[64];
        } RC2_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
+#endif
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
 void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,
                     int enc);

diff --git a/crypto/rc2/rc2_skey.c b/crypto/rc2/rc2_skey.c
index 49536420566b9021ed9061d960c9107c16293537..4e000e5b992a1428f381bdb1765846d482b005da 100644 (file)
--- a/crypto/rc2/rc2_skey.c
+++ b/crypto/rc2/rc2_skey.c
@@ -57,6 +57,11 @@
  */
 
 #include <openssl/rc2.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "rc2_locl.h"
 
 static unsigned char key_table[256]={
@@ -94,7 +99,19 @@ static unsigned char key_table[256]={
  * BSAFE uses the 'retarded' version.  What I previously shipped is
  * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
  * a version where the bits parameter is the same as len*8 */
+
+#ifdef OPENSSL_FIPS
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
+       {
+       if (FIPS_mode())
+               FIPS_BAD_ABORT(RC2)
+       private_RC2_set_key(key, len, data, bits);
+       }
+void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,
+                                                               int bits)
+#else
+void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
+#endif
        {
        int i,j;
        unsigned char *k;

diff --git a/crypto/rc4/asm/rc4-x86_64.pl b/crypto/rc4/asm/rc4-x86_64.pl
index 2d473204854c235c9ff6c2086485956f60fb9e9d..00c6fa28aaf9ed5f64f3b6afc0b36138a449b5da 100755 (executable)
--- a/crypto/rc4/asm/rc4-x86_64.pl
+++ b/crypto/rc4/asm/rc4-x86_64.pl
@@ -359,6 +359,8 @@ ___
 
 $code =~ s/#([bwd])/$1/gm;
 
+$code =~ s/RC4_set_key/private_RC4_set_key/g if ($ENV{FIPSCANLIB} ne "");
+
 print $code;
 
 close STDOUT;

diff --git a/crypto/rc4/rc4.h b/crypto/rc4/rc4.h
index 7aec04fe93a254c84bdd7bd32621c7cd86d9f7d0..2d8620d33b913c4040849d1090f88f37a64557ec 100644 (file)
--- a/crypto/rc4/rc4.h
+++ b/crypto/rc4/rc4.h
@@ -76,6 +76,9 @@ typedef struct rc4_key_st
 
  
 const char *RC4_options(void);
+#ifdef OPENSSL_FIPS
+void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
+#endif
 void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
 void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                unsigned char *outdata);

diff --git a/crypto/rc4/rc4_skey.c b/crypto/rc4/rc4_skey.c
index 46b77ec32169e5ded4fdc3ce9b25f222f9617643..4478d1a4b3b3c29c5feab44c744386cfabd1adbc 100644 (file)
--- a/crypto/rc4/rc4_skey.c
+++ b/crypto/rc4/rc4_skey.c
@@ -59,6 +59,11 @@
 #include <openssl/rc4.h>
 #include "rc4_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const char RC4_version[]="RC4" OPENSSL_VERSION_PTEXT;
 
@@ -85,7 +90,11 @@ const char *RC4_options(void)
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
+#ifdef OPENSSL_FIPS
+void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
+#else
 void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
+#endif
        {
         register RC4_INT tmp;
         register int id1,id2;
@@ -127,7 +136,12 @@ void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
                 *
                 *                              <appro@fy.chalmers.se>
                 */
-               if (OPENSSL_ia32cap_P & (1<<20)) {
+#ifdef OPENSSL_FIPS
+               unsigned long *ia32cap_ptr = OPENSSL_ia32cap_loc();
+               if (ia32cap_ptr && (*ia32cap_ptr & (1<<28))) {
+#else
+               if (OPENSSL_ia32cap_P & (1<<28)) {
+#endif
                        unsigned char *cp=(unsigned char *)d;
 
                        for (i=0;i<256;i++) cp[i]=i;

diff --git a/crypto/rc5/rc5.h b/crypto/rc5/rc5.h
index 4b3c153b5038dee73c77fa09a787e5446df08525..f73a2a02a451a8cecac7e2da1850e6175464ac6e 100644 (file)
--- a/crypto/rc5/rc5.h
+++ b/crypto/rc5/rc5.h
@@ -94,7 +94,10 @@ typedef struct rc5_key_st
        RC5_32_INT data[2*(RC5_16_ROUNDS+1)];
        } RC5_32_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
+       int rounds);
+#endif
 void RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
        int rounds);
 void RC5_32_ecb_encrypt(const unsigned char *in,unsigned char *out,RC5_32_KEY *key,

diff --git a/crypto/rc5/rc5_skey.c b/crypto/rc5/rc5_skey.c
index a2e00a41c5501d52fab1f6e6aa9ac229bf814912..247fa6500ce8bcb7a723309d6014d99c72525834 100644 (file)
--- a/crypto/rc5/rc5_skey.c
+++ b/crypto/rc5/rc5_skey.c
@@ -56,11 +56,28 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/crypto.h>
 #include <openssl/rc5.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "rc5_locl.h"
 
+#ifdef OPENSSL_FIPS
+void RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
+                   int rounds)
+       {
+       if (FIPS_mode())
+               FIPS_BAD_ABORT(RC5)
+       private_RC5_32_set_key(key, len, data, rounds);
+       }
+void private_RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
+                   int rounds)
+#else
 void RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
                    int rounds)
+#endif
        {
        RC5_32_INT L[64],l,ll,A,B,*S,k;
        int i,j,m,c,t,ii,jj;

diff --git a/crypto/ripemd/ripemd.h b/crypto/ripemd/ripemd.h
index 033a5965b58db1ad71c1fb4ddeac275ec80e204e..3b6d04386d4e3a5e3a5a919920f2c35b3b6a9e5f 100644 (file)
--- a/crypto/ripemd/ripemd.h
+++ b/crypto/ripemd/ripemd.h
@@ -90,7 +90,9 @@ typedef struct RIPEMD160state_st
        RIPEMD160_LONG data[RIPEMD160_LBLOCK];
        unsigned int   num;
        } RIPEMD160_CTX;
-
+#ifdef OPENSSL_FIPS
+int private_RIPEMD160_Init(RIPEMD160_CTX *c);
+#endif
 int RIPEMD160_Init(RIPEMD160_CTX *c);
 int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);
 int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);

diff --git a/crypto/ripemd/rmd_dgst.c b/crypto/ripemd/rmd_dgst.c
index 61626284b8fad1c12e7c3215ddb2c1c8d1ab834d..ead11d075ac9f91bbb56edb1ee94cd4026d4d715 100644 (file)
--- a/crypto/ripemd/rmd_dgst.c
+++ b/crypto/ripemd/rmd_dgst.c
@@ -59,6 +59,11 @@
 #include <stdio.h>
 #include "rmd_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/err.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const char RMD160_version[]="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 
@@ -69,7 +74,7 @@ const char RMD160_version[]="RIPE-MD160" OPENSSL_VERSION_PTEXT;
      void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,size_t num);
 #  endif
 
-int RIPEMD160_Init(RIPEMD160_CTX *c)
+FIPS_NON_FIPS_MD_Init(RIPEMD160)
        {
        c->A=RIPEMD160_A;
        c->B=RIPEMD160_B;

diff --git a/crypto/ripemd/rmd_locl.h b/crypto/ripemd/rmd_locl.h
index f14b346e662296865442577432678c92afb377f2..ce12a8000ea0bb48afcfe1321e799b654ba7ab15 100644 (file)
--- a/crypto/ripemd/rmd_locl.h
+++ b/crypto/ripemd/rmd_locl.h
@@ -72,7 +72,7 @@
  */
 #ifdef RMD160_ASM
 # if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-#  define ripemd160_block_data_order ripemd160_block_asm_data_order
+#  define ripemd160_block_host_order ripemd160_block_asm_data_order
 # endif
 #endif
 

diff --git a/crypto/sha/sha.h b/crypto/sha/sha.h
index eed44d7f9465ef7e674eefe496a5b9d95e3a3119..47a2c29f6627085113e8cc9396bc00a1a99511c2 100644 (file)
--- a/crypto/sha/sha.h
+++ b/crypto/sha/sha.h
@@ -106,6 +106,9 @@ typedef struct SHAstate_st
        } SHA_CTX;
 
 #ifndef OPENSSL_NO_SHA0
+#ifdef OPENSSL_FIPS
+int private_SHA_Init(SHA_CTX *c);
+#endif
 int SHA_Init(SHA_CTX *c);
 int SHA_Update(SHA_CTX *c, const void *data, size_t len);
 int SHA_Final(unsigned char *md, SHA_CTX *c);

diff --git a/crypto/sha/sha1_one.c b/crypto/sha/sha1_one.c
index 7c65b60276cdb85115fa7447dbb00ce28cda90cf..4831174198e73a5a12f573dc512173f230698228 100644 (file)
--- a/crypto/sha/sha1_one.c
+++ b/crypto/sha/sha1_one.c
@@ -61,7 +61,7 @@
 #include <openssl/sha.h>
 #include <openssl/crypto.h>
 
-#ifndef OPENSSL_NO_SHA1
+#if !defined(OPENSSL_NO_SHA1)
 unsigned char *SHA1(const unsigned char *d, size_t n, unsigned char *md)
        {
        SHA_CTX c;

diff --git a/crypto/sha/sha1dgst.c b/crypto/sha/sha1dgst.c
index 50d1925cdeb261887d2926140e53fe9cbf4387bd..d31f0781a06a8846c07fcdb81b23e76c8941a084 100644 (file)
--- a/crypto/sha/sha1dgst.c
+++ b/crypto/sha/sha1dgst.c
@@ -63,6 +63,10 @@
 #define SHA_1
 
 #include <openssl/opensslv.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const char SHA1_version[]="SHA1" OPENSSL_VERSION_PTEXT;
 

diff --git a/crypto/sha/sha256.c b/crypto/sha/sha256.c
index 867f90cc97c3d274cca2f363443f56b2aae45f1f..3256a83e98e10f74ead2111b2522ef830f5966e1 100644 (file)
--- a/crypto/sha/sha256.c
+++ b/crypto/sha/sha256.c
@@ -12,12 +12,19 @@
 
 #include <openssl/crypto.h>
 #include <openssl/sha.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include <openssl/opensslv.h>
 
 const char SHA256_version[]="SHA-256" OPENSSL_VERSION_PTEXT;
 
 int SHA224_Init (SHA256_CTX *c)
        {
+#ifdef OPENSSL_FIPS
+       FIPS_selftest_check();
+#endif
        c->h[0]=0xc1059ed8UL;   c->h[1]=0x367cd507UL;
        c->h[2]=0x3070dd17UL;   c->h[3]=0xf70e5939UL;
        c->h[4]=0xffc00b31UL;   c->h[5]=0x68581511UL;
@@ -29,6 +36,9 @@ int SHA224_Init (SHA256_CTX *c)
 
 int SHA256_Init (SHA256_CTX *c)
        {
+#ifdef OPENSSL_FIPS
+       FIPS_selftest_check();
+#endif
        c->h[0]=0x6a09e667UL;   c->h[1]=0xbb67ae85UL;
        c->h[2]=0x3c6ef372UL;   c->h[3]=0xa54ff53aUL;
        c->h[4]=0x510e527fUL;   c->h[5]=0x9b05688cUL;

diff --git a/crypto/sha/sha512.c b/crypto/sha/sha512.c
index 987fc07c99d170325de058218860aa7ea42c228a..f5ed468b85eb8140c6f3c8c9d85e55ff8b96a5e9 100644 (file)
--- a/crypto/sha/sha512.c
+++ b/crypto/sha/sha512.c
@@ -5,6 +5,10 @@
  * ====================================================================
  */
 #include <openssl/opensslconf.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512)
 /*
  * IMPLEMENTATION NOTES.
@@ -61,6 +65,9 @@ const char SHA512_version[]="SHA-512" OPENSSL_VERSION_PTEXT;
 
 int SHA384_Init (SHA512_CTX *c)
        {
+#ifdef OPENSSL_FIPS
+       FIPS_selftest_check();
+#endif
        c->h[0]=U64(0xcbbb9d5dc1059ed8);
        c->h[1]=U64(0x629a292a367cd507);
        c->h[2]=U64(0x9159015a3070dd17);
@@ -76,6 +83,9 @@ int SHA384_Init (SHA512_CTX *c)
 
 int SHA512_Init (SHA512_CTX *c)
        {
+#ifdef OPENSSL_FIPS
+       FIPS_selftest_check();
+#endif
        c->h[0]=U64(0x6a09e667f3bcc908);
        c->h[1]=U64(0xbb67ae8584caa73b);
        c->h[2]=U64(0x3c6ef372fe94f82b);
@@ -327,7 +337,7 @@ static const SHA_LONG64 K512[80] = {
                                ((SHA_LONG64)hi)<<32|lo;        })
 #   else
 #    define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\
-                        unsigned int hi=p[0],lo=p[1];          \
+                        unsigned int hi=p[0],lo=p[1];                  \
                                asm ("bswapl %0; bswapl %1;"    \
                                : "=r"(lo),"=r"(hi)             \
                                : "0"(lo),"1"(hi));             \

diff --git a/crypto/sha/sha_dgst.c b/crypto/sha/sha_dgst.c
index 70eb56032c38a4b4c3b792ab504413d14d546a55..598f4d721af963695c05eb665b32c78243163a5a 100644 (file)
--- a/crypto/sha/sha_dgst.c
+++ b/crypto/sha/sha_dgst.c
@@ -57,6 +57,12 @@
  */
 
 #include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
+#include <openssl/err.h>
 #if !defined(OPENSSL_NO_SHA0) && !defined(OPENSSL_NO_SHA)
 
 #undef  SHA_1

diff --git a/crypto/sha/sha_locl.h b/crypto/sha/sha_locl.h
index e37e5726e33dcb08ade15fa31eaa91c09bda40d0..da46ddfe794367695c69eac926c6dfe167d8a230 100644 (file)
--- a/crypto/sha/sha_locl.h
+++ b/crypto/sha/sha_locl.h
@@ -122,8 +122,15 @@ void sha1_block_data_order (SHA_CTX *c, const void *p,size_t num);
 #define INIT_DATA_h3 0x10325476UL
 #define INIT_DATA_h4 0xc3d2e1f0UL
 
+#if defined(SHA_0) && defined(OPENSSL_FIPS)
+FIPS_NON_FIPS_MD_Init(SHA)
+#else
 int HASH_INIT (SHA_CTX *c)
+#endif
        {
+#if defined(SHA_1) && defined(OPENSSL_FIPS)
+       FIPS_selftest_check();
+#endif
        c->h0=INIT_DATA_h0;
        c->h1=INIT_DATA_h1;
        c->h2=INIT_DATA_h2;