diff options
| author | NIIBE Yutaka <gniibe@fsij.org> | 2021-10-20 12:09:39 +0900 |
|---|---|---|
| committer | NIIBE Yutaka <gniibe@fsij.org> | 2021-10-20 12:09:39 +0900 |
| commit | a23cf78102f3200dc441a3123c3fbeaa28f38b50 (patch) | |
| tree | 4098dd33fd86aa0f4ef4d95a67285051cd0e6d28 /cipher/pubkey.c | |
| parent | 8f31f652d453f480d4d2559dfa17e7bd42145a49 (diff) | |
| download | libgcrypt-a23cf78102f3200dc441a3123c3fbeaa28f38b50.tar.gz | |
cipher: Reject SHA-1 for hash+sign/verify when FIPS enabled.
* cipher/pubkey.c (_gcry_pk_sign_md): Reject SHA-1 when FIPS.
(_gcry_pk_verify_md): Likewise.
--
GnuPG-bug-id: 5665
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Diffstat (limited to 'cipher/pubkey.c')
| -rw-r--r-- | cipher/pubkey.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/cipher/pubkey.c b/cipher/pubkey.c index f205f009..4a78123a 100644 --- a/cipher/pubkey.c +++ b/cipher/pubkey.c @@ -458,7 +458,7 @@ _gcry_pk_sign_md (gcry_sexp_t *r_sig, const char *tmpl, gcry_md_hd_t hd_orig, /* Check if it has fixed hash name or %s */ s = strstr (tmpl, "(hash "); if (s == NULL) - return gpg_err_code (GPG_ERR_DIGEST_ALGO); + return GPG_ERR_DIGEST_ALGO; s += 6; if (!strncmp (s, "%s", 2)) @@ -487,11 +487,12 @@ _gcry_pk_sign_md (gcry_sexp_t *r_sig, const char *tmpl, gcry_md_hd_t hd_orig, if (hash_name) { algo = _gcry_md_map_name (hash_name); - if (algo == 0) + if (algo == 0 + || (fips_mode () && algo == GCRY_MD_SHA1)) { xfree (hash_name); _gcry_md_close (hd); - return gpg_err_code (GPG_ERR_DIGEST_ALGO); + return GPG_ERR_DIGEST_ALGO; } digest = _gcry_md_read (hd, algo); @@ -499,6 +500,10 @@ _gcry_pk_sign_md (gcry_sexp_t *r_sig, const char *tmpl, gcry_md_hd_t hd_orig, else { algo = _gcry_md_get_algo (hd); + + if (fips_mode () && algo == GCRY_MD_SHA1) + return GPG_ERR_DIGEST_ALGO; + digest = _gcry_md_read (hd, 0); } @@ -615,6 +620,9 @@ _gcry_pk_verify_md (gcry_sexp_t s_sig, const char *tmpl, gcry_md_hd_t hd_orig, algo = _gcry_md_get_algo (hd); + if (fips_mode () && algo == GCRY_MD_SHA1) + return GPG_ERR_DIGEST_ALGO; + digest = _gcry_md_read (hd, 0); if (!digest) { |