Block DH key gen for small key sizes too.

diff --git a/fips/dh/fips_dh_key.c b/fips/dh/fips_dh_key.c
index 390f6d9a11e92cf5d10f747979e5f4e4f6a3163e..0cb4eb21e532c2093c3b79744da90e16f4e84d47 100644 (file)
--- a/fips/dh/fips_dh_key.c
+++ b/fips/dh/fips_dh_key.c
@@ -112,6 +112,12 @@ static int generate_key(DH *dh)
        BN_MONT_CTX *mont=NULL;
        BIGNUM *pub_key=NULL,*priv_key=NULL;
 
+       if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+               {
+               DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
+               goto err;
+               }
+
        ctx = BN_CTX_new();
        if (ctx == NULL) goto err;