+#endif /* FIPS_MODE */
+
+/*
+ * TODO(3.0): keygen should be able to use this method to do a FIPS186-4 style
+ * paramgen.
+ */
+int dh_generate_ffc_parameters(OPENSSL_CTX *libctx, DH *dh, int bits,
+ int qbits, int gindex, BN_GENCB *cb)
+{
+ int ret, res;
+
+ if (qbits <= 0) {
+ const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();
+
+ qbits = EVP_MD_size(evpmd) * 8;
+ }
+ dh->params.gindex = gindex;
+ ret = ffc_params_FIPS186_4_generate(libctx, &dh->params, FFC_PARAM_TYPE_DH,
+ bits, qbits, NULL, &res, cb);
+ if (ret > 0)
+ dh->dirty_cnt++;
+ return ret;
+}