From: Dr. Stephen Henson <steve@openssl.org>
Date: Sat, 18 Aug 2007 02:46:11 +0000 (+0000)
Subject: Block DH key gen for small key sizes too.
X-Git-Tag: FIPS_098_TEST_3~1
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0fd9322af1051da5123bda6eaaef42b14cce901b;p=oweals%2Fopenssl.git

Block DH key gen for small key sizes too.
---

diff --git a/fips/dh/fips_dh_key.c b/fips/dh/fips_dh_key.c
index 390f6d9a11..0cb4eb21e5 100644
--- a/fips/dh/fips_dh_key.c
+++ b/fips/dh/fips_dh_key.c
@@ -112,6 +112,12 @@ static int generate_key(DH *dh)
 	BN_MONT_CTX *mont=NULL;
 	BIGNUM *pub_key=NULL,*priv_key=NULL;
 
+	if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+		{
+		DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
+		goto err;
+		}
+
 	ctx = BN_CTX_new();
 	if (ctx == NULL) goto err;