From: Richard Levitte <levitte@openssl.org>
Date: Mon, 17 May 2004 04:31:14 +0000 (+0000)
Subject: When in FIPS mode, use SHA1 to digest the key, rather than MD5, as MD5
X-Git-Tag: OpenSSL_0_9_7e~96
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=a8bb3d0e15001c5270120169bb32ada01a957b1d;p=oweals%2Fopenssl.git

When in FIPS mode, use SHA1 to digest the key, rather than MD5, as MD5
isn't a FIPS-approved algorithm.

Note: this means the user needs to keep track of this, and we need to
add support for that...
---

diff --git a/apps/enc.c b/apps/enc.c
index 30378a9542..bd1ecfc6ff 100644
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -124,6 +124,7 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_ENGINE
 	char *engine = NULL;
 #endif
+	const EVP_MD *dgst=NULL;
 
 	apps_startup();
 
@@ -296,6 +297,14 @@ bad:
         e = setup_engine(bio_err, engine, 0);
 #endif
 
+	if (dgst == NULL)
+		{
+		if (in_FIPS_mode)
+			dgst = EVP_sha1();
+		else
+			dgst = EVP_md5();
+		}
+
 	if (bufsize != NULL)
 		{
 		unsigned long n;
@@ -483,7 +492,7 @@ bad:
 				sptr = salt;
 			}
 
-			EVP_BytesToKey(cipher,EVP_md5(),sptr,
+			EVP_BytesToKey(cipher,dgst,sptr,
 				(unsigned char *)str,
 				strlen(str),1,key,iv);
 			/* zero the complete buffer or the string