From 9c57eb736e9f4d63380d31f37c6c2a1fa267df9b Mon Sep 17 00:00:00 2001 From: Pauli Date: Fri, 26 Jul 2024 11:59:09 +1000 Subject: [PATCH] drbg: streamline test for allowed digests Under FIPS, we've got a whitelist of algorithms. There is no need to then also check for XOF digests because they aren't possible. Reviewed-by: Shane Lontis Reviewed-by: Tom Cosgrove Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/25007) --- providers/implementations/rands/drbg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/providers/implementations/rands/drbg.c b/providers/implementations/rands/drbg.c index 66b61bbd33bc6..c15c4606e62da 100644 --- a/providers/implementations/rands/drbg.c +++ b/providers/implementations/rands/drbg.c @@ -1029,11 +1029,12 @@ int ossl_drbg_verify_digest(PROV_DRBG *drbg, OSSL_LIB_CTX *libctx, return 0; } } -#endif +#else /* FIPS_MODULE */ /* Outside of FIPS, any digests that are not XOF are allowed */ if ((EVP_MD_get_flags(md) & EVP_MD_FLAG_XOF) != 0) { ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED); return 0; } +#endif /* FIPS_MODULE */ return 1; }