Skip to content

Commit d43904b

Browse files
committed
Remove test_ed25519_not_approved_on_fips.
This commit fixes the following failure on OpenSSL master FIPS case. ``` 1) Failure: test_ed25519_not_approved_on_fips(OpenSSL::TestPKey): OpenSSL::PKey::PKeyError expected but nothing was raised. /home/runner/work/openssl/openssl/vendor/bundle/ruby/3.0.0/gems/test-unit-ruby-core-1.0.6/lib/core_assertions.rb:462:in `assert_raise' /home/runner/work/openssl/openssl/test/openssl/test_pkey.rb:174:in `test_ed25519_not_approved_on_fips' 171: MC4CAQAwBQYDK2VwBCIEIEzNCJso/5banbbDRuwRTg9bijGfNaumJNqM9u1PuKb7 172: -----END PRIVATE KEY----- 173: EOF => 174: assert_raise(OpenSSL::PKey::PKeyError) do 175: OpenSSL::PKey.read(priv_pem) 176: end 177: end ``` Because FIPS compliance is a continually moving target. According to the [1], FIPS 140-3 *currently* allows ED25519. The ED25519 is allowed again with the latest OpenSSL FIPS by the commit [2], while it is not allowed in OpenSSL stable version 3.x FIPS. Remove this test because we want to keep our tests stable. [1] openssl/openssl#22054 [2] openssl/openssl@5f04124
1 parent 3fc8972 commit d43904b

File tree

1 file changed

+0
-26
lines changed

1 file changed

+0
-26
lines changed

test/openssl/test_pkey.rb

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -150,32 +150,6 @@ def test_ed25519
150150
assert_raise(OpenSSL::PKey::PKeyError) { priv.derive(pub) }
151151
end
152152

153-
def test_ed25519_not_approved_on_fips
154-
omit_on_non_fips
155-
# Ed25519 is technically allowed in the OpenSSL 3.0 code as a kind of bug.
156-
# So, we need to omit OpenSSL 3.0.
157-
#
158-
# See OpenSSL providers/fips/fipsprov.c PROV_NAMES_ED25519 entries with
159-
# FIPS_DEFAULT_PROPERTIES on openssl-3.0 branch and
160-
# FIPS_UNAPPROVED_PROPERTIES on openssl-3.1 branch.
161-
#
162-
# See also
163-
# https://github.com/openssl/openssl/issues/20758#issuecomment-1639658102
164-
# for details.
165-
unless openssl?(3, 1, 0, 0)
166-
omit 'Ed25519 is allowed in the OpenSSL 3.0 FIPS code as a kind of bug'
167-
end
168-
169-
priv_pem = <<~EOF
170-
-----BEGIN PRIVATE KEY-----
171-
MC4CAQAwBQYDK2VwBCIEIEzNCJso/5banbbDRuwRTg9bijGfNaumJNqM9u1PuKb7
172-
-----END PRIVATE KEY-----
173-
EOF
174-
assert_raise(OpenSSL::PKey::PKeyError) do
175-
OpenSSL::PKey.read(priv_pem)
176-
end
177-
end
178-
179153
def test_x25519
180154
# Test vector from RFC 7748 Section 6.1
181155
alice_pem = <<~EOF

0 commit comments

Comments
 (0)