Skip to content

Conversation

junaruga
Copy link
Member

I would like to add OpenSSL 3.1 FIPS case to the CI. In some cases, a behavior between OpenSSL 3.1 FIPS and 3.0 FIPS is different.

For example the crypto ed25519 is not allowed by the FIPS_UNAPPROVED_PROPERTIES in OpenSSL 3.1 FIPS according to the head of the openssl-3.1 branch.

$ grep PROV_NAMES_ED25519 providers/fips/fipsprov.c
    { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES,
    { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, ossl_ed25519_keymgmt_functions,

But the crypto ed25519 is allowed by the FIPS_DEFAULT_PROPERTIES in the OpenSSL 3.0 FIPS according to the head of the openssl-3.0 branch.

$ grep PROV_NAMES_ED25519 providers/fips/fipsprov.c
    { PROV_NAMES_ED25519, FIPS_DEFAULT_PROPERTIES, ossl_ed25519_signature_functions },
    { PROV_NAMES_ED25519, FIPS_DEFAULT_PROPERTIES, ossl_ed25519_keymgmt_functions,

@junaruga junaruga merged commit b050141 into ruby:master Jul 25, 2023
@junaruga junaruga deleted the wip/ci-openssl-3.1-fips branch July 25, 2023 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant