Blame SOURCES/rh1995150-disable_non-fips_crypto.patch

840a84
diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java
840a84
index 63bb580eb3a..238735c0c8c 100644
840a84
--- openjdk.orig/src/java.base/share/classes/module-info.java
0a390a
+++ openjdk/src/java.base/share/classes/module-info.java
840a84
@@ -152,6 +152,7 @@ module java.base {
0a390a
         java.naming,
0a390a
         java.rmi,
840a84
         jdk.charsets,
0a390a
+        jdk.crypto.ec,
0a390a
         jdk.jartool,
0a390a
         jdk.jlink,
0a390a
         jdk.net,
840a84
diff --git openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
840a84
index 912cad59714..7cb5ebcde51 100644
840a84
--- openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java
0a390a
+++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
0a390a
@@ -30,6 +30,7 @@ import java.net.*;
0a390a
 import java.util.*;
0a390a
 import java.security.*;
0a390a
 
0a390a
+import jdk.internal.access.SharedSecrets;
0a390a
 import jdk.internal.util.StaticProperty;
0a390a
 import sun.security.action.GetPropertyAction;
0a390a
 import sun.security.util.SecurityProviderConstants;
0a390a
@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
0a390a
 
0a390a
 public final class SunEntries {
0a390a
 
0a390a
+    private static final boolean systemFipsEnabled =
0a390a
+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
0a390a
+            .isSystemFipsEnabled();
0a390a
+
0a390a
     // the default algo used by SecureRandom class for new SecureRandom() calls
0a390a
     public static final String DEF_SECURE_RANDOM_ALGO;
0a390a
 
0a390a
@@ -94,147 +99,149 @@ public final class SunEntries {
0a390a
         // common attribute map
0a390a
         HashMap<String, String> attrs = new HashMap<>(3);
0a390a
 
0a390a
-        /*
0a390a
-         * SecureRandom engines
0a390a
-         */
0a390a
-        attrs.put("ThreadSafe", "true");
0a390a
-        if (NativePRNG.isAvailable()) {
0a390a
-            add(p, "SecureRandom", "NativePRNG",
0a390a
-                    "sun.security.provider.NativePRNG", attrs);
0a390a
-        }
0a390a
-        if (NativePRNG.Blocking.isAvailable()) {
0a390a
-            add(p, "SecureRandom", "NativePRNGBlocking",
0a390a
-                    "sun.security.provider.NativePRNG$Blocking", attrs);
0a390a
-        }
0a390a
-        if (NativePRNG.NonBlocking.isAvailable()) {
0a390a
-            add(p, "SecureRandom", "NativePRNGNonBlocking",
0a390a
-                    "sun.security.provider.NativePRNG$NonBlocking", attrs);
840a84
-        }
840a84
-        attrs.put("ImplementedIn", "Software");
840a84
-        add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
840a84
-        add(p, "SecureRandom", "SHA1PRNG",
840a84
-                "sun.security.provider.SecureRandom", attrs);
840a84
-
840a84
-        /*
840a84
-         * Signature engines
840a84
-         */
840a84
-        attrs.clear();
840a84
-        String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
840a84
-                "|java.security.interfaces.DSAPrivateKey";
840a84
-        attrs.put("SupportedKeyClasses", dsaKeyClasses);
840a84
-        attrs.put("ImplementedIn", "Software");
840a84
-
840a84
-        attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
840a84
-
840a84
-        addWithAlias(p, "Signature", "SHA1withDSA",
840a84
-                "sun.security.provider.DSA$SHA1withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "NONEwithDSA",
840a84
-                "sun.security.provider.DSA$RawDSA", attrs);
840a84
-
840a84
-        // for DSA signatures with 224/256-bit digests
840a84
-        attrs.put("KeySize", "2048");
840a84
-
840a84
-        addWithAlias(p, "Signature", "SHA224withDSA",
840a84
-                "sun.security.provider.DSA$SHA224withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "SHA256withDSA",
840a84
-                "sun.security.provider.DSA$SHA256withDSA", attrs);
840a84
-
840a84
-        addWithAlias(p, "Signature", "SHA3-224withDSA",
840a84
-                "sun.security.provider.DSA$SHA3_224withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "SHA3-256withDSA",
840a84
-                "sun.security.provider.DSA$SHA3_256withDSA", attrs);
840a84
-
840a84
-        attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
840a84
-
840a84
-        addWithAlias(p, "Signature", "SHA384withDSA",
840a84
-                "sun.security.provider.DSA$SHA384withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "SHA512withDSA",
840a84
-                "sun.security.provider.DSA$SHA512withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "SHA3-384withDSA",
840a84
-                "sun.security.provider.DSA$SHA3_384withDSA", attrs);
840a84
-        addWithAlias(p, "Signature", "SHA3-512withDSA",
840a84
-                "sun.security.provider.DSA$SHA3_512withDSA", attrs);
840a84
-
840a84
-        attrs.remove("KeySize");
840a84
-
840a84
-        add(p, "Signature", "SHA1withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA1withDSAinP1363Format");
840a84
-        add(p, "Signature", "NONEwithDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$RawDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA224withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA224withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA256withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA256withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA384withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA384withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA512withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA512withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA3-224withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA3-256withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA3-384withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
840a84
-        add(p, "Signature", "SHA3-512withDSAinP1363Format",
840a84
-                "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
840a84
-        /*
840a84
-         *  Key Pair Generator engines
840a84
-         */
840a84
-        attrs.clear();
840a84
-        attrs.put("ImplementedIn", "Software");
840a84
-        attrs.put("KeySize", "2048"); // for DSA KPG and APG only
0a390a
+        if (!systemFipsEnabled) {
0a390a
+            /*
0a390a
+             * SecureRandom engines
0a390a
+             */
0a390a
+            attrs.put("ThreadSafe", "true");
0a390a
+            if (NativePRNG.isAvailable()) {
0a390a
+                add(p, "SecureRandom", "NativePRNG",
0a390a
+                        "sun.security.provider.NativePRNG", attrs);
0a390a
+            }
0a390a
+            if (NativePRNG.Blocking.isAvailable()) {
0a390a
+                add(p, "SecureRandom", "NativePRNGBlocking",
0a390a
+                        "sun.security.provider.NativePRNG$Blocking", attrs);
0a390a
+            }
0a390a
+            if (NativePRNG.NonBlocking.isAvailable()) {
0a390a
+                add(p, "SecureRandom", "NativePRNGNonBlocking",
0a390a
+                        "sun.security.provider.NativePRNG$NonBlocking", attrs);
0a390a
+            }
0a390a
+            attrs.put("ImplementedIn", "Software");
0a390a
+            add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
0a390a
+            add(p, "SecureRandom", "SHA1PRNG",
0a390a
+                    "sun.security.provider.SecureRandom", attrs);
840a84
 
840a84
-        String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
840a84
-        dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
840a84
-        addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
0a390a
+            /*
0a390a
+             * Signature engines
0a390a
+             */
0a390a
+            attrs.clear();
0a390a
+            String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
0a390a
+                    "|java.security.interfaces.DSAPrivateKey";
0a390a
+            attrs.put("SupportedKeyClasses", dsaKeyClasses);
0a390a
+            attrs.put("ImplementedIn", "Software");
0a390a
+
0a390a
+            attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
0a390a
+
0a390a
+            addWithAlias(p, "Signature", "SHA1withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA1withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "NONEwithDSA",
0a390a
+                    "sun.security.provider.DSA$RawDSA", attrs);
0a390a
+
0a390a
+            // for DSA signatures with 224/256-bit digests
0a390a
+            attrs.put("KeySize", "2048");
0a390a
+
0a390a
+            addWithAlias(p, "Signature", "SHA224withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA224withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "SHA256withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA256withDSA", attrs);
0a390a
+
0a390a
+            addWithAlias(p, "Signature", "SHA3-224withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA3_224withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "SHA3-256withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA3_256withDSA", attrs);
0a390a
+
0a390a
+            attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
0a390a
+
0a390a
+            addWithAlias(p, "Signature", "SHA384withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA384withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "SHA512withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA512withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "SHA3-384withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA3_384withDSA", attrs);
0a390a
+            addWithAlias(p, "Signature", "SHA3-512withDSA",
0a390a
+                    "sun.security.provider.DSA$SHA3_512withDSA", attrs);
0a390a
+
0a390a
+            attrs.remove("KeySize");
0a390a
+
0a390a
+            add(p, "Signature", "SHA1withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA1withDSAinP1363Format");
0a390a
+            add(p, "Signature", "NONEwithDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$RawDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA224withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA224withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA256withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA256withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA384withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA384withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA512withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA512withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA3-224withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA3-256withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA3-384withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
0a390a
+            add(p, "Signature", "SHA3-512withDSAinP1363Format",
0a390a
+                    "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
0a390a
+            /*
0a390a
+             *  Key Pair Generator engines
0a390a
+             */
0a390a
+            attrs.clear();
0a390a
+            attrs.put("ImplementedIn", "Software");
0a390a
+            attrs.put("KeySize", "2048"); // for DSA KPG and APG only
840a84
 
840a84
-        /*
840a84
-         * Algorithm Parameter Generator engines
840a84
-         */
840a84
-        addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
840a84
-                "sun.security.provider.DSAParameterGenerator", attrs);
840a84
-        attrs.remove("KeySize");
0a390a
+            String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
0a390a
+            dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
0a390a
+            addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
840a84
 
840a84
-        /*
840a84
-         * Algorithm Parameter engines
840a84
-         */
840a84
-        addWithAlias(p, "AlgorithmParameters", "DSA",
840a84
-                "sun.security.provider.DSAParameters", attrs);
0a390a
+            /*
0a390a
+             * Algorithm Parameter Generator engines
0a390a
+             */
0a390a
+            addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
0a390a
+                    "sun.security.provider.DSAParameterGenerator", attrs);
0a390a
+            attrs.remove("KeySize");
840a84
 
840a84
-        /*
840a84
-         * Key factories
840a84
-         */
840a84
-        addWithAlias(p, "KeyFactory", "DSA",
840a84
-                "sun.security.provider.DSAKeyFactory", attrs);
0a390a
+            /*
0a390a
+             * Algorithm Parameter engines
0a390a
+             */
0a390a
+            addWithAlias(p, "AlgorithmParameters", "DSA",
0a390a
+                    "sun.security.provider.DSAParameters", attrs);
840a84
 
840a84
-        /*
840a84
-         * Digest engines
840a84
-         */
840a84
-        add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs);
840a84
-        add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
840a84
-                attrs);
0a390a
+            /*
0a390a
+             * Key factories
0a390a
+             */
0a390a
+            addWithAlias(p, "KeyFactory", "DSA",
0a390a
+                    "sun.security.provider.DSAKeyFactory", attrs);
840a84
 
840a84
-        addWithAlias(p, "MessageDigest", "SHA-224",
840a84
-                "sun.security.provider.SHA2$SHA224", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-256",
840a84
-                "sun.security.provider.SHA2$SHA256", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-384",
840a84
-                "sun.security.provider.SHA5$SHA384", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-512",
840a84
-                "sun.security.provider.SHA5$SHA512", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-512/224",
840a84
-                "sun.security.provider.SHA5$SHA512_224", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA-512/256",
840a84
-                "sun.security.provider.SHA5$SHA512_256", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA3-224",
840a84
-                "sun.security.provider.SHA3$SHA224", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA3-256",
840a84
-                "sun.security.provider.SHA3$SHA256", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA3-384",
840a84
-                "sun.security.provider.SHA3$SHA384", attrs);
840a84
-        addWithAlias(p, "MessageDigest", "SHA3-512",
840a84
-                "sun.security.provider.SHA3$SHA512", attrs);
0a390a
+            /*
0a390a
+             * Digest engines
0a390a
+             */
0a390a
+            add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs);
0a390a
+            add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
0a390a
+                    attrs);
0a390a
+
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-224",
0a390a
+                    "sun.security.provider.SHA2$SHA224", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-256",
0a390a
+                    "sun.security.provider.SHA2$SHA256", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-384",
0a390a
+                    "sun.security.provider.SHA5$SHA384", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-512",
0a390a
+                    "sun.security.provider.SHA5$SHA512", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-512/224",
0a390a
+                    "sun.security.provider.SHA5$SHA512_224", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA-512/256",
0a390a
+                    "sun.security.provider.SHA5$SHA512_256", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA3-224",
0a390a
+                    "sun.security.provider.SHA3$SHA224", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA3-256",
0a390a
+                    "sun.security.provider.SHA3$SHA256", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA3-384",
0a390a
+                    "sun.security.provider.SHA3$SHA384", attrs);
0a390a
+            addWithAlias(p, "MessageDigest", "SHA3-512",
0a390a
+                    "sun.security.provider.SHA3$SHA512", attrs);
840a84
+        }
0a390a
 
0a390a
         /*
0a390a
          * Certificates
840a84
diff --git openjdk.orig/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
840a84
index 8c9e4f9dbe6..883dc04758e 100644
840a84
--- openjdk.orig/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
0a390a
+++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
0a390a
@@ -38,6 +38,7 @@ import java.util.HashMap;
0a390a
 import java.util.Iterator;
0a390a
 import java.util.List;
0a390a
 
0a390a
+import jdk.internal.access.SharedSecrets;
0a390a
 import sun.security.ec.ed.EdDSAAlgorithmParameters;
0a390a
 import sun.security.ec.ed.EdDSAKeyFactory;
0a390a
 import sun.security.ec.ed.EdDSAKeyPairGenerator;
0a390a
@@ -56,6 +57,10 @@ public final class SunEC extends Provider {
0a390a
 
0a390a
     private static final long serialVersionUID = -2279741672933606418L;
0a390a
 
0a390a
+    private static final boolean systemFipsEnabled =
0a390a
+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
0a390a
+            .isSystemFipsEnabled();
0a390a
+
0a390a
     private static class ProviderServiceA extends ProviderService {
0a390a
         ProviderServiceA(Provider p, String type, String algo, String cn,
0a390a
             HashMap<String, String> attrs) {
0a390a
@@ -249,85 +254,86 @@ public final class SunEC extends Provider {
0a390a
 
0a390a
         putXDHEntries();
0a390a
         putEdDSAEntries();
0a390a
-
0a390a
-        /*
0a390a
-         * Signature engines
0a390a
-         */
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
0a390a
-            null, ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
0a390a
-            ATTRS));
0a390a
-
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "NONEwithECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$RawinP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "SHA1withECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "SHA224withECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "SHA256withECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "SHA384withECDSAinP1363Format",
0a390a
-            "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "SHA512withECDSAinP1363Format",
0a390a
-            "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
0a390a
-
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "SHA3-224withECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-             "SHA3-256withECDSAinP1363Format",
0a390a
-             "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "SHA3-384withECDSAinP1363Format",
0a390a
-            "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "SHA3-512withECDSAinP1363Format",
0a390a
-            "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
0a390a
-
0a390a
-        /*
0a390a
-         *  Key Pair Generator engine
0a390a
-         */
0a390a
-        putService(new ProviderService(this, "KeyPairGenerator",
0a390a
-            "EC", "sun.security.ec.ECKeyPairGenerator",
0a390a
-            List.of("EllipticCurve"), ATTRS));
0a390a
-
0a390a
-        /*
0a390a
-         * Key Agreement engine
0a390a
-         */
0a390a
-        putService(new ProviderService(this, "KeyAgreement",
0a390a
-            "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
0a390a
+        if (!systemFipsEnabled) {
0a390a
+            /*
0a390a
+             * Signature engines
0a390a
+             */
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
0a390a
+                null, ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
0a390a
+                ATTRS));
0a390a
+
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "NONEwithECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$RawinP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "SHA1withECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "SHA224withECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "SHA256withECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "SHA384withECDSAinP1363Format",
0a390a
+                "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "SHA512withECDSAinP1363Format",
0a390a
+                "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
0a390a
+
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "SHA3-224withECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                 "SHA3-256withECDSAinP1363Format",
0a390a
+                 "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "SHA3-384withECDSAinP1363Format",
0a390a
+                "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "SHA3-512withECDSAinP1363Format",
0a390a
+                "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
0a390a
+
0a390a
+            /*
0a390a
+             *  Key Pair Generator engine
0a390a
+             */
0a390a
+            putService(new ProviderService(this, "KeyPairGenerator",
0a390a
+                "EC", "sun.security.ec.ECKeyPairGenerator",
0a390a
+                List.of("EllipticCurve"), ATTRS));
0a390a
+
0a390a
+            /*
0a390a
+             * Key Agreement engine
0a390a
+             */
0a390a
+            putService(new ProviderService(this, "KeyAgreement",
0a390a
+                "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
0a390a
+        }
0a390a
     }
0a390a
 
0a390a
     private void putXDHEntries() {
0a390a
@@ -344,23 +350,25 @@ public final class SunEC extends Provider {
0a390a
             "X448", "sun.security.ec.XDHKeyFactory.X448",
0a390a
             ATTRS));
0a390a
 
0a390a
-        putService(new ProviderService(this, "KeyPairGenerator",
0a390a
-            "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
-            "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
-            "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
0a390a
-            ATTRS));
0a390a
-
0a390a
-        putService(new ProviderService(this, "KeyAgreement",
0a390a
-            "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyAgreement",
0a390a
-            "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyAgreement",
0a390a
-            "X448", "sun.security.ec.XDHKeyAgreement.X448",
0a390a
-            ATTRS));
0a390a
+        if (!systemFipsEnabled) {
0a390a
+            putService(new ProviderService(this, "KeyPairGenerator",
0a390a
+                "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
+                "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
+                "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
0a390a
+                ATTRS));
0a390a
+
0a390a
+            putService(new ProviderService(this, "KeyAgreement",
0a390a
+                "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyAgreement",
0a390a
+                "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyAgreement",
0a390a
+                "X448", "sun.security.ec.XDHKeyAgreement.X448",
0a390a
+                ATTRS));
0a390a
+        }
0a390a
     }
0a390a
 
0a390a
     private void putEdDSAEntries() {
0a390a
@@ -375,21 +383,23 @@ public final class SunEC extends Provider {
0a390a
         putService(new ProviderServiceA(this, "KeyFactory",
0a390a
             "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS));
0a390a
 
0a390a
-        putService(new ProviderService(this, "KeyPairGenerator",
0a390a
-            "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
-            "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
0a390a
-            ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
-            "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
0a390a
-            ATTRS));
0a390a
-
0a390a
-        putService(new ProviderService(this, "Signature",
0a390a
-            "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
0a390a
-        putService(new ProviderServiceA(this, "Signature",
0a390a
-            "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
0a390a
+        if (!systemFipsEnabled) {
0a390a
+            putService(new ProviderService(this, "KeyPairGenerator",
0a390a
+                "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
+                "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
0a390a
+                ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "KeyPairGenerator",
0a390a
+                "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
0a390a
+                ATTRS));
0a390a
+
0a390a
+            putService(new ProviderService(this, "Signature",
0a390a
+                "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
0a390a
+            putService(new ProviderServiceA(this, "Signature",
0a390a
+                "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
0a390a
+        }
0a390a
 
0a390a
     }
0a390a
 }