5 Commits (d53f31aa805e037f96e1517ba19c439848151edf)

Author	SHA1	Message	Date
Dmitry Belyavskiy	2c5c3fcced	Rebasing to OpenSSL 3.2.1 ... Resolves: RHEL-26271	10 months ago
Clemens Lang	9a075c13c3	Mark RSA-OAEP as approved in FIPS mode ... Switch explicit FIPS indicator for RSA-OAEP to approved following clarification with CMVP. Additionally, backport a check required by SP800-56Br2 6.4.1.2.1 (3.c). Resolves: RHEL-14083	1 year ago
Clemens Lang	0dea6db970	Change explicit FIPS indicator for RSA decryption to unapproved ... Resolves: rhbz#2179379 Signed-off-by: Clemens Lang <cllang@redhat.com>	2 years ago
Clemens Lang	1bd2a0cee3	Add missing patchfile, fix gettable params ... Add the patchfile that was committed but not referenced in the spec file. Fix the patch to apply on openssl 3.0.7 and fix the gettable FIPS indicator parameter for the RSA asymmetric cipher implementation. Resolves: rhbz#2179379 Signed-off-by: Clemens Lang <cllang@redhat.com>	2 years ago
Clemens Lang	1bd49c394a	Add explicit FIPS indicator to RSA encryption and RSASVE ... NIST SP 800-56Br2 section 6.4.2.1 requires either explicit key confirmation (section 6.4.2.3.2), or assurance from a trusted third party (section 6.4.2.3.1) for the KTS-OAEP key transport scheme and key agreement schemes, but explicit key confirmation is not implemented and cannot be implemented without protocol changes, and the FIPS provider does not implement trusted third party validation, since it relies on its callers to do that. We must thus mark RSA-OAEP encryption and RSASVE as unapproved until we have received clarification from NIST on how library modules such as OpenSSL should implement TTP validation. This does not affect RSA-OAEP decryption, because it is approved as a component according to the FIPS 140-3 IG, section 2.4.G. Resolves: rhbz#2179379 Signed-off-by: Clemens Lang <cllang@redhat.com>	2 years ago