wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

New cipher "strength" FIPS which specifies that a

Browse source 
cipher suite is FIPS compatible.

New cipherstring "FIPS" is all FIPS compatible ciphersuites except eNULL.

Only allow FIPS ciphersuites in FIPS mode.
This commit is contained in:
Dr. Stephen Henson 2004-07-27 18:28:49 +00:00
parent 7f911c668d
commit 0b948f3677
4 changed files with 47 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
ssl/s3_lib.c
View file

@ -142,7 +142,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_RSA_NULL_SHA,
SSL3_CK_RSA_NULL_SHA,
SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
0,
0,
0,
@ -183,7 +183,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_ADH_DES_40_CBC_SHA,
SSL3_CK_ADH_DES_40_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
128,
@ -196,7 +196,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_ADH_DES_64_CBC_SHA,
SSL3_CK_ADH_DES_64_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -209,7 +209,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_ADH_DES_192_CBC_SHA,
SSL3_CK_ADH_DES_192_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -291,7 +291,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_RSA_DES_40_CBC_SHA,
SSL3_CK_RSA_DES_40_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
56,
@ -304,7 +304,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_RSA_DES_64_CBC_SHA,
SSL3_CK_RSA_DES_64_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -317,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_RSA_DES_192_CBC3_SHA,
SSL3_CK_RSA_DES_192_CBC3_SHA,
SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -332,7 +332,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
SSL3_CK_DH_DSS_DES_40_CBC_SHA,
SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
56,
@ -345,7 +345,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
SSL3_CK_DH_DSS_DES_64_CBC_SHA,
SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -358,7 +358,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -371,7 +371,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
SSL3_CK_DH_RSA_DES_40_CBC_SHA,
SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
56,
@ -384,7 +384,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
SSL3_CK_DH_RSA_DES_64_CBC_SHA,
SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -397,7 +397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -412,7 +412,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
56,
@ -425,7 +425,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -438,7 +438,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -451,7 +451,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
SSL_EXPORT|SSL_EXP40|SSL_FIPS,
0,
40,
56,
@ -464,7 +464,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
0,
56,
56,
@ -477,7 +477,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
168,
168,
@ -767,7 +767,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
SSL_EXPORT|SSL_EXP56|SSL_FIPS,
0,
56,
56,
@ -780,7 +780,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
SSL_EXPORT|SSL_EXP56|SSL_FIPS,
0,
56,
56,
@ -835,7 +835,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_RSA_WITH_AES_128_SHA,
TLS1_CK_RSA_WITH_AES_128_SHA,
SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -848,7 +848,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
TLS1_CK_DH_DSS_WITH_AES_128_SHA,
SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -861,7 +861,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
TLS1_CK_DH_RSA_WITH_AES_128_SHA,
SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -874,7 +874,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -887,7 +887,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -900,7 +900,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_ADH_WITH_AES_128_SHA,
TLS1_CK_ADH_WITH_AES_128_SHA,
SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
0,
128,
128,
@ -914,7 +914,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_RSA_WITH_AES_256_SHA,
TLS1_CK_RSA_WITH_AES_256_SHA,
SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,
@ -927,7 +927,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
TLS1_CK_DH_DSS_WITH_AES_256_SHA,
SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,
@ -940,7 +940,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
TLS1_CK_DH_RSA_WITH_AES_256_SHA,
SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,
@ -953,7 +953,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,
@ -966,7 +966,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,
@ -979,7 +979,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
TLS1_TXT_ADH_WITH_AES_256_SHA,
TLS1_CK_ADH_WITH_AES_256_SHA,
SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
0,
256,
256,

1
ssl/ssl.h
View file

@ -239,6 +239,7 @@ extern "C" {
#define SSL_TXT_LOW "LOW"
#define SSL_TXT_MEDIUM "MEDIUM"
#define SSL_TXT_HIGH "HIGH"
#define SSL_TXT_FIPS "FIPS"
#define SSL_TXT_kFZA "kFZA"
#define SSL_TXT_aFZA "aFZA"
#define SSL_TXT_eFZA "eFZA"

11
ssl/ssl_ciph.c
View file

@ -59,6 +59,7 @@
#include <stdio.h>
#include <openssl/objects.h>
#include <openssl/comp.h>
#include <openssl/fips.h>
#include "ssl_locl.h"
#define SSL_ENC_DES_IDX 0
@ -153,6 +154,7 @@ static const SSL_CIPHER cipher_aliases[]={
{0,SSL_TXT_LOW, 0, 0, SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
{0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
{0,SSL_TXT_HIGH, 0, 0, SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
{0,SSL_TXT_FIPS, 0, 0, SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
};
static int init_ciphers=1;
@ -359,7 +361,12 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
{
c = ssl_method->get_cipher(i);
/* drop those that use any of that is not available */
#ifdef OPENSSL_FIPS
if ((c != NULL) && c->valid && !(c->algorithms & mask)
&& (!FIPS_mode || (c->algo_strength & SSL_FIPS)))
#else
if ((c != NULL) && c->valid && !(c->algorithms & mask))
#endif
{
co_list[co_list_num].cipher = c;
co_list[co_list_num].next = NULL;
@ -854,7 +861,11 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
*/
for (curr = head; curr != NULL; curr = curr->next)
{
#ifdef OPENSSL_FIPS
if (curr->active && (!FIPS_mode || curr->cipher->algo_strength & SSL_FIPS))
#else
if (curr->active)
#endif
{
sk_SSL_CIPHER_push(cipherstack, curr->cipher);
#ifdef CIPHER_DEBUG

3
ssl/ssl_locl.h
View file

@ -302,8 +302,9 @@
#define SSL_LOW 0x00000020L
#define SSL_MEDIUM 0x00000040L
#define SSL_HIGH 0x00000080L
#define SSL_FIPS 0x00000100L
/* we have used 000000ff - 24 bits left to go */
/* we have used 000001ff - 23 bits left to go */
/*
* Macros to check the export status and cipher strength for export ciphers.