]> git.ipfire.org Git - thirdparty/openssl.git/commit
Refactor FIPS integrity check to use KAT framework
authorSimo Sorce <simo@redhat.com>
Tue, 9 Dec 2025 19:29:43 +0000 (14:29 -0500)
committerDmitry Belyavskiy <beldmit@gmail.com>
Fri, 13 Feb 2026 09:53:41 +0000 (10:53 +0100)
commit53fecfc80bfe8fbef5923f4e84255f07695eb92f
tree94908eefb6e2df633a4aa485cfa41db6700977bc
parent40240719507cfc09870f0faa28cc6e70084d3ee7
Refactor FIPS integrity check to use KAT framework

The FIPS module integrity check (HMAC-SHA256) is refactored to use the
generic Known Answer Test (KAT) framework instead of a standalone
function.

- Remove `integrity_self_test` and use `ST_ID_MAC_HMAC` with
  `SELF_TEST_kats_single`.
- Add `self_test_mac` to `self_test_kats.c` to support MAC tests.
- Move HMAC test data to `self_test_data.c`.
- Rename the self-test type from "KAT_Integrity" to "KAT_Mac".
- Ensure on-demand tests reset state so they can be repeated.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
doc/man7/OSSL_PROVIDER-FIPS.pod
include/internal/fips.h
include/openssl/self_test.h
providers/fips/self_test.c
providers/fips/self_test.h
providers/fips/self_test_data.c
providers/fips/self_test_kats.c