From 0fd9322af1051da5123bda6eaaef42b14cce901b Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sat, 18 Aug 2007 02:46:11 +0000 Subject: [PATCH] Block DH key gen for small key sizes too. --- fips/dh/fips_dh_key.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fips/dh/fips_dh_key.c b/fips/dh/fips_dh_key.c index 390f6d9a11..0cb4eb21e5 100644 --- a/fips/dh/fips_dh_key.c +++ b/fips/dh/fips_dh_key.c @@ -112,6 +112,12 @@ static int generate_key(DH *dh) BN_MONT_CTX *mont=NULL; BIGNUM *pub_key=NULL,*priv_key=NULL; + if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) + { + DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL); + goto err; + } + ctx = BN_CTX_new(); if (ctx == NULL) goto err; -- 2.25.1