]> git.ipfire.org Git - thirdparty/openssl.git/commit
Add RSA Signature restrictions for X9.31 padding in the FIPS provider.
authorslontis <shane.lontis@oracle.com>
Mon, 29 Jul 2024 00:16:30 +0000 (10:16 +1000)
committerslontis <shane.lontis@oracle.com>
Mon, 29 Jul 2024 00:16:30 +0000 (10:16 +1000)
commit07e4d7f4747005e3ce56423182ad047eb05d8e16
tree8caed31fe3772fe95e51df88cad0d305b5ff7f38
parent9c57eb736e9f4d63380d31f37c6c2a1fa267df9b
Add RSA Signature restrictions for X9.31 padding in the FIPS provider.

In FIPS 140-3, RSA Signing with X9.31 padding is not approved,
but verification is allowed for legacy purposes. An indicator has been added
for RSA signing with X9.31 padding.

A strict restriction on the size of the RSA modulus has been added
i.e. It must be 1024 + 256 * s (which is part of the ANSI X9.31 spec).

Added implementation comments to the X9.31 padding code

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24021)
15 files changed:
apps/fipsinstall.c
crypto/rsa/rsa_ossl.c
crypto/rsa/rsa_x931.c
doc/man1/openssl-fipsinstall.pod.in
doc/man7/EVP_SIGNATURE-RSA.pod
doc/man7/OSSL_PROVIDER-FIPS.pod
doc/man7/provider-signature.pod
include/openssl/fips_names.h
providers/common/include/prov/fipscommon.h
providers/fips/fipsprov.c
providers/implementations/signature/rsa_sig.c
test/evp_test.c
test/recipes/30-test_evp_data/evppkey_rsa_common.txt
util/mk-fipsmodule-cnf.pl
util/perl/OpenSSL/paramnames.pm