restricted combinations of security parameters in FIPS mode.

diff --git a/lib/algorithms/secparams.c b/lib/algorithms/secparams.c
index 2dc04b72563a50f4fda54f5a1a7bb5e927f5d600..9fee3e405bafef471bf4831635c3aab22e3560b9 100644 (file)
--- a/lib/algorithms/secparams.c
+++ b/lib/algorithms/secparams.c
@@ -42,11 +42,19 @@ static const gnutls_sec_params_entry sec_params[] = {
        {"Export", GNUTLS_SEC_PARAM_EXPORT, 42, 512, 0, 150, 0},
        {"Very weak", GNUTLS_SEC_PARAM_VERY_WEAK, 64, 767, 0, 160, 0},
        {"Weak", GNUTLS_SEC_PARAM_WEAK, 72, 1008, 1024, 160, 160},
-       {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 2048, 160, 160},
+#ifdef ENABLE_FIPS140
+       {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1024, 1024, 160, 160},
+       {"Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1024, 1024, 192, 192},
+       {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2048, 2048, 224, 224},
+       {"High", GNUTLS_SEC_PARAM_HIGH, 128, 3072, 3072, 256, 256},
+       {"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15360, 3072, 512, 512},
+#else
+       {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 1024, 160, 160},
        {"Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1776, 2048, 192, 192},
-       {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 3072, 224, 224},
+       {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 2048, 224, 224},
        {"High", GNUTLS_SEC_PARAM_HIGH, 128, 3248, 3072, 256, 256},
        {"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15424, 3072, 512, 512},
+#endif
        {NULL, 0, 0, 0, 0, 0}
 };