From 72a137b3f51ef8aeb2747bbc102ea5c98b6daa05 Mon Sep 17 00:00:00 2001

From: rpm-build <rpm-build>

Date: Wed, 6 Mar 2024 19:17:17 +0100

Subject: [PATCH 43/49] 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch

Patch-name: 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch

Patch-id: 113

Patch-status: |

    # 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch

From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

---

 include/openssl/evp.h                         |  4 +++

 .../implementations/asymciphers/rsa_enc.c     | 22 ++++++++++++++

 providers/implementations/kem/rsa_kem.c       | 30 ++++++++++++++++++-

 util/perl/OpenSSL/paramnames.pm               |  6 ++--

 4 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/include/openssl/evp.h b/include/openssl/evp.h

index dc42140932..3a6345d71e 100644

--- a/include/openssl/evp.h

+++ b/include/openssl/evp.h

@@ -1772,6 +1772,10 @@ OSSL_DEPRECATEDIN_3_0 size_t EVP_PKEY_meth_get_count(void);

 OSSL_DEPRECATEDIN_3_0 const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx);

 # endif

+# define EVP_PKEY_REDHAT_FIPS_INDICATOR_UNDETERMINED 0

+# define EVP_PKEY_REDHAT_FIPS_INDICATOR_APPROVED     1

+# define EVP_PKEY_REDHAT_FIPS_INDICATOR_NOT_APPROVED 2

+

 EVP_KEYMGMT *EVP_KEYMGMT_fetch(OSSL_LIB_CTX *ctx, const char *algorithm,

                                const char *properties);

 int EVP_KEYMGMT_up_ref(EVP_KEYMGMT *keymgmt);

diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c

index f3443b0c66..b2c239c03b 100644

--- a/providers/implementations/asymciphers/rsa_enc.c

+++ b/providers/implementations/asymciphers/rsa_enc.c

@@ -462,6 +462,27 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params)

     if (p != NULL && !OSSL_PARAM_set_uint(p, prsactx->implicit_rejection))

         return 0;

+#ifdef FIPS_MODULE

+    p = OSSL_PARAM_locate(params, OSSL_ASYM_CIPHER_PARAM_REDHAT_FIPS_INDICATOR);

+    if (p != NULL) {

+        int fips_indicator = EVP_PKEY_REDHAT_FIPS_INDICATOR_APPROVED;

+

+        /* NIST SP 800-56Br2 section 6.4.2.1 requires either explicit key

+         * confirmation (section 6.4.2.3.2), or assurance from a trusted third

+         * party (section 6.4.2.3.1) for the KTS-OAEP key transport scheme, but

+         * explicit key confirmation is not implemented here and cannot be

+         * implemented without protocol changes, and the FIPS provider does not

+         * implement trusted third party validation, since it relies on its

+         * callers to do that. We must thus mark RSA-OAEP as unapproved until

+         * we have received clarification from NIST on how library modules such

+         * as OpenSSL should implement TTP validation. */

+        fips_indicator = EVP_PKEY_REDHAT_FIPS_INDICATOR_NOT_APPROVED;

+

+        if (!OSSL_PARAM_set_int(p, fips_indicator))

+            return 0;

+    }

+#endif /* defined(FIPS_MODULE) */

+

     return 1;

 }

@@ -475,6 +496,7 @@ static const OSSL_PARAM known_gettable_ctx_params[] = {

     OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION, NULL),

 #ifdef FIPS_MODULE

     OSSL_PARAM_octet_string(OSSL_ASYM_CIPHER_PARAM_REDHAT_KAT_OEAP_SEED, NULL, 0),

+    OSSL_PARAM_int(OSSL_ASYM_CIPHER_PARAM_REDHAT_FIPS_INDICATOR, NULL),

 #endif /* FIPS_MODULE */

     OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION, NULL),

     OSSL_PARAM_END

diff --git a/providers/implementations/kem/rsa_kem.c b/providers/implementations/kem/rsa_kem.c

index 0824c6bdd6..2e637bdf30 100644

--- a/providers/implementations/kem/rsa_kem.c

+++ b/providers/implementations/kem/rsa_kem.c

@@ -152,11 +152,39 @@ static int rsakem_decapsulate_init(void *vprsactx, void *vrsa,

 static int rsakem_get_ctx_params(void *vprsactx, OSSL_PARAM *params)

 {

     PROV_RSA_CTX *ctx = (PROV_RSA_CTX *)vprsactx;

+#ifdef FIPS_MODULE

+    OSSL_PARAM *p;

+#endif /* defined(FIPS_MODULE) */

+

+    if (ctx == NULL)

+        return 0;

+

+#ifdef FIPS_MODULE

+    p = OSSL_PARAM_locate(params, OSSL_KEM_PARAM_REDHAT_FIPS_INDICATOR);

+    if (p != NULL) {

+        /* NIST SP 800-56Br2 section 6.4.2.1 requires either explicit key

+         * confirmation (section 6.4.2.3.2), or assurance from a trusted third

+         * party (section 6.4.2.3.1) for key agreement or key transport, but

+         * explicit key confirmation is not implemented here and cannot be

+         * implemented without protocol changes, and the FIPS provider does not

+         * implement trusted third party validation, since it relies on its

+         * callers to do that. We must thus mark RSASVE unapproved until we

+         * have received clarification from NIST on how library modules such as

+         * OpenSSL should implement TTP validation. */

+        int fips_indicator = EVP_PKEY_REDHAT_FIPS_INDICATOR_NOT_APPROVED;

+

+        if (!OSSL_PARAM_set_int(p, fips_indicator))

+            return 0;

+    }

+#endif /* defined(FIPS_MODULE) */

-    return ctx != NULL;

+    return 1;

 }

 static const OSSL_PARAM known_gettable_rsakem_ctx_params[] = {

+#ifdef FIPS_MODULE

+    OSSL_PARAM_int(OSSL_KEM_PARAM_REDHAT_FIPS_INDICATOR, NULL),

+#endif /* defined(FIPS_MODULE) */

     OSSL_PARAM_END

 };

diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm

index 64e9809387..45ab0c8dc4 100644

--- a/util/perl/OpenSSL/paramnames.pm

+++ b/util/perl/OpenSSL/paramnames.pm

@@ -406,6 +406,7 @@ my %params = (

     'ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION' =>   "tls-negotiated-version",

     'ASYM_CIPHER_PARAM_IMPLICIT_REJECTION' =>       "implicit-rejection",

     'ASYM_CIPHER_PARAM_REDHAT_KAT_OEAP_SEED' =>     "redhat-kat-oaep-seed",

+    'ASYM_CIPHER_PARAM_REDHAT_FIPS_INDICATOR' =>    "redhat-fips-indicator",

 # Encoder / decoder parameters

@@ -438,8 +439,9 @@ my %params = (

     'SIGNATURE_PARAM_KAT' =>     "kat",

 # KEM parameters

-    'KEM_PARAM_OPERATION' =>            "operation",

-    'KEM_PARAM_IKME' =>                 "ikme",

+    'KEM_PARAM_OPERATION' =>             "operation",

+    'KEM_PARAM_REDHAT_FIPS_INDICATOR' => "redhat-fips-indicator",

+    'KEM_PARAM_IKME' =>                  "ikme",

 # Capabilities

-- 

2.44.0