From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Wed, 20 Nov 2013 13:43:30 +0000 (+0100)
Subject: restricted combinations of security parameters in FIPS mode.
X-Git-Tag: gnutls_3_3_0pre0~520^2~64
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=91371f925be73cfb1ecb130efbe16ed17cd64f87;p=thirdparty%2Fgnutls.git

restricted combinations of security parameters in FIPS mode.
---

diff --git a/lib/algorithms/secparams.c b/lib/algorithms/secparams.c
index 2dc04b7256..9fee3e405b 100644
--- a/lib/algorithms/secparams.c
+++ b/lib/algorithms/secparams.c
@@ -42,11 +42,19 @@ static const gnutls_sec_params_entry sec_params[] = {
 	{"Export", GNUTLS_SEC_PARAM_EXPORT, 42, 512, 0, 150, 0},
 	{"Very weak", GNUTLS_SEC_PARAM_VERY_WEAK, 64, 767, 0, 160, 0},
 	{"Weak", GNUTLS_SEC_PARAM_WEAK, 72, 1008, 1024, 160, 160},
-	{"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 2048, 160, 160},
+#ifdef ENABLE_FIPS140
+	{"Low", GNUTLS_SEC_PARAM_LOW, 80, 1024, 1024, 160, 160},
+	{"Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1024, 1024, 192, 192},
+	{"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2048, 2048, 224, 224},
+	{"High", GNUTLS_SEC_PARAM_HIGH, 128, 3072, 3072, 256, 256},
+	{"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15360, 3072, 512, 512},
+#else
+	{"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 1024, 160, 160},
 	{"Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1776, 2048, 192, 192},
-	{"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 3072, 224, 224},
+	{"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 2048, 224, 224},
 	{"High", GNUTLS_SEC_PARAM_HIGH, 128, 3248, 3072, 256, 256},
 	{"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15424, 3072, 512, 512},
+#endif
 	{NULL, 0, 0, 0, 0, 0}
 };