From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Mon, 7 Jul 2014 16:34:02 +0000 (+0200)
Subject: FIPS140-2 mode: enforce the minimum GCM IV size required by SP800-38D (section 8.2)
X-Git-Tag: gnutls_3_3_6~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3e557bb09b00278cb39f28887778d201eb6b4d4c;p=thirdparty%2Fgnutls.git

FIPS140-2 mode: enforce the minimum GCM IV size required by SP800-38D (section 8.2)
---

diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
index 1bc164960b..f367f2f9fa 100644
--- a/lib/nettle/cipher.c
+++ b/lib/nettle/cipher.c
@@ -391,6 +391,8 @@ wrap_nettle_cipher_setiv(void *_ctx, const void *iv, size_t ivsize)
 	switch (ctx->algo) {
 	case GNUTLS_CIPHER_AES_128_GCM:
 	case GNUTLS_CIPHER_AES_256_GCM:
+		if (_gnutls_fips_mode_enabled() != 0 && ivsize < GCM_IV_SIZE)
+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
 		gcm_aes_set_iv(&ctx->ctx.aes_gcm, 
 				ivsize, iv);
 		break;