From: Dr. Stephen Henson <steve@openssl.org>
Date: Wed, 27 Jan 2010 00:51:24 +0000 (+0000)
Subject: Bypass algorithm blocking with TLS MD5+SHA1 signature in FIPS mode by
X-Git-Tag: OpenSSL_0_9_8m~33
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=93b810637b4d96ed2a6021b4a334820ba84dad0c;p=oweals%2Fopenssl.git

Bypass algorithm blocking with TLS MD5+SHA1 signature in FIPS mode by
calling underlying method directly.
---

diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c
index 5488c06f6d..743dfd7650 100644
--- a/crypto/rsa/rsa_sign.c
+++ b/crypto/rsa/rsa_sign.c
@@ -137,7 +137,12 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
 		i2d_X509_SIG(&sig,&p);
 		s=tmps;
 	}
+#ifdef OPENSSL_FIPS
+	/* Bypass algorithm blocking: this is allowed if we get this far */
+	i=rsa->meth->rsa_priv_enc(i,s,sigret,rsa,RSA_PKCS1_PADDING);
+#else
 	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
+#endif
 	if (i <= 0)
 		ret=0;
 	else
@@ -190,8 +195,11 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
 		RSAerr(RSA_F_RSA_VERIFY, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
 		return 0;
 		}
-#endif
+	/* Bypass algorithm blocking: this is allowed */
+	i=rsa->meth->rsa_pub_dec((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
+#else
 	i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
+#endif
 
 	if (i <= 0) goto err;