Repository navigation
Test FIPS builds with DES3 and MD5 enabled - #524
Open
padelsbach wants to merge 1 commit into
Open
padelsbach wants to merge 1 commit into
padelsbach wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
Raw ECDSA acceptance now depends on wolfSSL’s separate signing and verification minimums, but missing dependency headers leave compatibility and FIPS behavior unconfirmed across supported FIPS Ready builds.
No open issues 🎉
What changed in this PR
This PR expands wolfProvider’s FIPS Ready testing to cover builds with DES3 and MD5 enabled, and aligns ECDSA digest-length checks with wolfSSL’s separate signing and verification minimums.
Changes:
- Add a DES3-enabled FIPS Ready CI variant with a distinct cache key.
- Support and document extra wolfSSL configure options.
- Share digest-minimum fallbacks, update ECDSA boundary tests, and skip MD5/SHA-1 TLS PRF testing when FIPS policy disallows it.
| File | Description |
|---|---|
test/test_tls1_prf.c |
Gate MD5/SHA-1 PRF testing on non-FIPS algorithm permission. |
test/test_ecc.c |
Test separate signing and verification digest boundaries. |
src/wp_ecdsa_sig.c |
Apply operation-specific minimum digest sizes. |
scripts/utils-wolfssl.sh |
Pass extra options to wolfSSL configuration. |
scripts/build-wolfprovider.sh |
Document WOLFSSL_EXTRA_CONFIG_OPTS. |
include/wolfprovider/internal.h |
Centralize compatibility fallbacks for digest minimums. |
.github/workflows/fips-ready.yml |
Add a DES3-enabled build variant and isolate its cache. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.