]> git.ipfire.org Git - thirdparty/openssl.git/commit
FIPS POST: Change PBKDF2 CAST to use less iterations.
authorslontis <shane.lontis@oracle.com>
Tue, 25 Feb 2025 02:31:46 +0000 (13:31 +1100)
committerTomas Mraz <tomas@openssl.org>
Wed, 26 Feb 2025 11:13:03 +0000 (12:13 +0100)
commit69d15b28afc21d11354fb949de3cd642609d0c24
tree7531d5db7077e7e7778a17eea28edbcf8642c19c
parentc0eb5c57f77c5a158b989285b1344297e0186235
FIPS POST: Change PBKDF2 CAST to use less iterations.

Fixes #26876

The issue here is that the pbkdf2 'lower_bounds_checks' currently errors by default
in FIPS mode if iterations < 1000.
i.e. the "pkcs5" flag = 0 triggers an error..
Turning the flag on means the FIPS indicator is triggered (which is probably correct behaviour)
Not sure testing the fips state here is a good idea (i.e. taking a TSAN hit).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26887)
providers/fips/self_test_data.inc