|
 |
9f54a2 |
diff -up gnupg-2.0.22/g10/encode.c.fips gnupg-2.0.22/g10/encode.c
|
|
|
9f54a2 |
--- gnupg-2.0.22/g10/encode.c.fips 2013-10-04 14:32:53.000000000 +0200
|
|
|
9f54a2 |
+++ gnupg-2.0.22/g10/encode.c 2013-10-11 10:35:29.779420279 +0200
|
|
|
9f54a2 |
@@ -732,7 +732,7 @@ encrypt_filter( void *opaque, int contro
|
|
|
9f54a2 |
if( efx->cfx.dek->algo == -1 ) {
|
|
|
9f54a2 |
/* because 3DES is implicitly in the prefs, this can only
|
|
|
9f54a2 |
* happen if we do not have any public keys in the list */
|
|
|
9f54a2 |
- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
|
|
|
9f54a2 |
+ efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
|
|
|
9f54a2 |
}
|
|
|
9f54a2 |
|
|
|
9f54a2 |
/* In case 3DES has been selected, print a warning if
|
|
|
9f54a2 |
diff -up gnupg-2.0.22/g10/gpg.c.fips gnupg-2.0.22/g10/gpg.c
|
|
|
9f54a2 |
--- gnupg-2.0.22/g10/gpg.c.fips 2013-10-11 10:35:29.775420188 +0200
|
|
|
9f54a2 |
+++ gnupg-2.0.22/g10/gpg.c 2013-10-11 10:35:29.780420301 +0200
|
|
|
9f54a2 |
@@ -1973,7 +1973,7 @@ main (int argc, char **argv)
|
|
|
9f54a2 |
opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
|
|
|
9f54a2 |
opt.s2k_mode = 3; /* iterated+salted */
|
|
|
9f54a2 |
opt.s2k_count = 0; /* Auto-calibrate when needed. */
|
|
|
9f54a2 |
- opt.s2k_cipher_algo = CIPHER_ALGO_CAST5;
|
|
|
9f54a2 |
+ opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5;
|
|
|
9f54a2 |
opt.completes_needed = 1;
|
|
|
9f54a2 |
opt.marginals_needed = 3;
|
|
|
9f54a2 |
opt.max_cert_depth = 5;
|
|
|
9f54a2 |
diff -up gnupg-2.0.22/g10/mainproc.c.fips gnupg-2.0.22/g10/mainproc.c
|
|
|
9f54a2 |
--- gnupg-2.0.22/g10/mainproc.c.fips 2013-10-04 15:00:22.000000000 +0200
|
|
|
9f54a2 |
+++ gnupg-2.0.22/g10/mainproc.c 2016-03-24 12:52:24.463174830 +0100
|
|
|
9f54a2 |
@@ -696,9 +696,11 @@ proc_plaintext( CTX c, PACKET *pkt )
|
|
|
9f54a2 |
often. There is no good way to specify what algorithms to
|
|
|
9f54a2 |
use in that case, so these three are the historical
|
|
|
9f54a2 |
answer. */
|
|
|
9f54a2 |
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
|
|
|
9f54a2 |
+ if( !gcry_fips_mode_active() )
|
|
|
9f54a2 |
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
|
|
|
9f54a2 |
gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 );
|
|
|
9f54a2 |
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
|
|
|
9f54a2 |
+ if( !gcry_fips_mode_active() )
|
|
|
9f54a2 |
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
|
|
|
9f54a2 |
}
|
|
|
9f54a2 |
if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) {
|
|
|
9f54a2 |
/* This is a kludge to work around a bug in pgp2. It does only
|
|
|
9f54a2 |
@@ -2160,24 +2162,30 @@ proc_tree( CTX c, KBNODE node )
|
|
|
9f54a2 |
else if( !c->any.data ) {
|
|
|
9f54a2 |
/* detached signature */
|
|
|
9f54a2 |
free_md_filter_context( &c->mfx );
|
|
|
9f54a2 |
- if (gcry_md_open (&c->mfx.md, sig->digest_algo, 0))
|
|
|
9f54a2 |
- BUG ();
|
|
|
9f54a2 |
+ if (gcry_md_open (&c->mfx.md, sig->digest_algo, 0)) {
|
|
|
9f54a2 |
+ log_error("Digest algorithm not available probably due to FIPS mode.\n");
|
|
|
9f54a2 |
+ return;
|
|
|
9f54a2 |
+ }
|
|
|
9f54a2 |
|
|
|
9f54a2 |
if( !opt.pgp2_workarounds )
|
|
|
9f54a2 |
;
|
|
|
9f54a2 |
else if( sig->digest_algo == DIGEST_ALGO_MD5
|
|
|
9f54a2 |
&& is_RSA( sig->pubkey_algo ) ) {
|
|
|
9f54a2 |
/* enable a workaround for a pgp2 bug */
|
|
|
9f54a2 |
- if (gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0))
|
|
|
9f54a2 |
- BUG ();
|
|
|
9f54a2 |
+ if (gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0)) {
|
|
|
9f54a2 |
+ log_error("Digest algorithm not available probably due to FIPS mode.\n");
|
|
|
9f54a2 |
+ return;
|
|
|
9f54a2 |
+ }
|
|
|
9f54a2 |
}
|
|
|
9f54a2 |
else if( sig->digest_algo == DIGEST_ALGO_SHA1
|
|
|
9f54a2 |
&& sig->pubkey_algo == PUBKEY_ALGO_DSA
|
|
|
9f54a2 |
&& sig->sig_class == 0x01 ) {
|
|
|
9f54a2 |
/* enable the workaround also for pgp5 when the detached
|
|
|
9f54a2 |
* signature has been created in textmode */
|
|
|
9f54a2 |
- if (gcry_md_open (&c->mfx.md2, sig->digest_algo, 0 ))
|
|
|
9f54a2 |
- BUG ();
|
|
|
9f54a2 |
+ if (gcry_md_open (&c->mfx.md2, sig->digest_algo, 0 )) {
|
|
|
9f54a2 |
+ log_error("Digest algorithm not available.\n");
|
|
|
9f54a2 |
+ return;
|
|
|
9f54a2 |
+ }
|
|
|
9f54a2 |
}
|
|
|
9f54a2 |
#if 0 /* workaround disabled */
|
|
|
9f54a2 |
/* Here we have another hack to work around a pgp 2 bug
|