From: Dr. Stephen Henson <steve@openssl.org>
Date: Wed, 29 Jul 2015 15:16:02 +0000 (+0100)
Subject: use X9.31 keygen by default in FIPS mode
X-Git-Tag: OpenSSL_1_0_1q~109
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=5030cc69ffd6137d3d3f2b221c3313042940c1fd;p=oweals%2Fopenssl.git

use X9.31 keygen by default in FIPS mode

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit d0c9a90640c8902fef3eb74e8ef05227f8e7dcb7)
---

diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index 2465fbdebf..7f7dca39fd 100644
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -69,6 +69,8 @@
 #include <openssl/rsa.h>
 #ifdef OPENSSL_FIPS
 # include <openssl/fips.h>
+extern int FIPS_rsa_x931_generate_key_ex(RSA *rsa, int bits, BIGNUM *e,
+                                         BN_GENCB *cb);
 #endif
 
 static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
@@ -94,7 +96,7 @@ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
         return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
 #ifdef OPENSSL_FIPS
     if (FIPS_mode())
-        return FIPS_rsa_generate_key_ex(rsa, bits, e_value, cb);
+        return FIPS_rsa_x931_generate_key_ex(rsa, bits, e_value, cb);
 #endif
     return rsa_builtin_keygen(rsa, bits, e_value, cb);
 }