Skip to content

Commit b31e485

Browse files
author
Andras Fekete
committed
Remove 'HAVE_FIPS_VERSION < 2' blocks
1 parent f5164d3 commit b31e485

24 files changed

Lines changed: 10 additions & 1273 deletions

File tree

‎src/internal.c‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -17907,14 +17907,6 @@ static WC_INLINE int EncryptDo(WOLFSSL* ssl, byte* out, const byte* input,
1790717907
* IV length minus the authentication tag size. */
1790817908
c16toa(sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
1790917909
ssl->encrypt.additional + AEAD_LEN_OFFSET);
17910-
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
17911-
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
17912-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
17913-
XMEMCPY(ssl->encrypt.nonce,
17914-
ssl->keys.aead_enc_imp_IV, AESGCM_IMP_IV_SZ);
17915-
XMEMCPY(ssl->encrypt.nonce + AESGCM_IMP_IV_SZ,
17916-
ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ);
17917-
#endif
1791817910
#ifdef HAVE_PK_CALLBACKS
1791917911
ret = NOT_COMPILED_IN;
1792017912
if (ssl->ctx && ssl->ctx->PerformTlsRecordProcessingCb) {
@@ -18259,11 +18251,6 @@ static WC_INLINE int Encrypt(WOLFSSL* ssl, byte* out, const byte* input,
1825918251
ssl->specs.bulk_cipher_algorithm == wolfssl_aria_gcm)
1826018252
{
1826118253
/* finalize authentication cipher */
18262-
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
18263-
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
18264-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
18265-
AeadIncrementExpIV(ssl);
18266-
#endif
1826718254
if (ssl->encrypt.nonce)
1826818255
ForceZero(ssl->encrypt.nonce, AESGCM_NONCE_SZ);
1826918256
}
@@ -21726,15 +21713,6 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
2172621713
if (ret != 0)
2172721714
goto exit_buildmsg;
2172821715
}
21729-
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
21730-
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
21731-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) && \
21732-
defined(HAVE_AEAD))
21733-
if (ssl->specs.cipher_type == aead) {
21734-
if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
21735-
XMEMCPY(args->iv, ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ);
21736-
}
21737-
#endif
2173821716

2173921717
args->size = (word16)(args->sz - args->headerSz); /* include mac and digest */
2174021718
AddRecordHeader(output, args->size, (byte)type, ssl, epochOrder);

‎src/ssl.c‎

Lines changed: 2 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,8 @@
213213
#include "src/ssl_certman.c"
214214
#endif
215215

216+
#define _HMAC_Init _InitHmac
217+
216218
#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \
217219
!defined(WOLFCRYPT_ONLY)
218220
/* Convert shortname to NID.
@@ -25461,80 +25463,6 @@ int wolfSSL_HMAC_CTX_copy(WOLFSSL_HMAC_CTX* des, WOLFSSL_HMAC_CTX* src)
2546125463
return wolfSSL_HmacCopy(&des->hmac, &src->hmac);
2546225464
}
2546325465

25464-
25465-
#if defined(HAVE_FIPS) && \
25466-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
25467-
25468-
static int _HMAC_Init(Hmac* hmac, int type, void* heap)
25469-
{
25470-
int ret = 0;
25471-
25472-
switch (type) {
25473-
#ifndef NO_MD5
25474-
case WC_MD5:
25475-
ret = wc_InitMd5(&hmac->hash.md5);
25476-
break;
25477-
#endif /* !NO_MD5 */
25478-
25479-
#ifndef NO_SHA
25480-
case WC_SHA:
25481-
ret = wc_InitSha(&hmac->hash.sha);
25482-
break;
25483-
#endif /* !NO_SHA */
25484-
25485-
#ifdef WOLFSSL_SHA224
25486-
case WC_SHA224:
25487-
ret = wc_InitSha224(&hmac->hash.sha224);
25488-
break;
25489-
#endif /* WOLFSSL_SHA224 */
25490-
25491-
#ifndef NO_SHA256
25492-
case WC_SHA256:
25493-
ret = wc_InitSha256(&hmac->hash.sha256);
25494-
break;
25495-
#endif /* !NO_SHA256 */
25496-
25497-
#ifdef WOLFSSL_SHA384
25498-
case WC_SHA384:
25499-
ret = wc_InitSha384(&hmac->hash.sha384);
25500-
break;
25501-
#endif /* WOLFSSL_SHA384 */
25502-
#ifdef WOLFSSL_SHA512
25503-
case WC_SHA512:
25504-
ret = wc_InitSha512(&hmac->hash.sha512);
25505-
break;
25506-
#endif /* WOLFSSL_SHA512 */
25507-
25508-
#ifdef WOLFSSL_SHA3
25509-
case WC_SHA3_224:
25510-
ret = wc_InitSha3_224(&hmac->hash.sha3, heap, INVALID_DEVID);
25511-
break;
25512-
case WC_SHA3_256:
25513-
ret = wc_InitSha3_256(&hmac->hash.sha3, heap, INVALID_DEVID);
25514-
break;
25515-
case WC_SHA3_384:
25516-
ret = wc_InitSha3_384(&hmac->hash.sha3, heap, INVALID_DEVID);
25517-
break;
25518-
case WC_SHA3_512:
25519-
ret = wc_InitSha3_512(&hmac->hash.sha3, heap, INVALID_DEVID);
25520-
break;
25521-
#endif
25522-
25523-
default:
25524-
ret = BAD_FUNC_ARG;
25525-
break;
25526-
}
25527-
25528-
(void)heap;
25529-
25530-
return ret;
25531-
}
25532-
25533-
#else
25534-
#define _HMAC_Init _InitHmac
25535-
#endif
25536-
25537-
2553825466
int wolfSSL_HMAC_Init(WOLFSSL_HMAC_CTX* ctx, const void* key, int keylen,
2553925467
const EVP_MD* type)
2554025468
{

‎src/tls13.c‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2572,20 +2572,13 @@ static int EncryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
25722572
#endif
25732573
{
25742574

2575-
#if ((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
2576-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
2577-
ret = wc_AesGcmEncrypt(ssl->encrypt.aes, output, input,
2578-
dataSz, ssl->encrypt.nonce, nonceSz,
2579-
output + dataSz, macSz, aad, aadSz);
2580-
#else
25812575
ret = wc_AesGcmSetExtIV(ssl->encrypt.aes,
25822576
ssl->encrypt.nonce, nonceSz);
25832577
if (ret == 0) {
25842578
ret = wc_AesGcmEncrypt_ex(ssl->encrypt.aes, output,
25852579
input, dataSz, ssl->encrypt.nonce, nonceSz,
25862580
output + dataSz, macSz, aad, aadSz);
25872581
}
2588-
#endif
25892582
}
25902583
break;
25912584
#endif
@@ -2613,20 +2606,13 @@ static int EncryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
26132606
if (ret == NOT_COMPILED_IN)
26142607
#endif
26152608
{
2616-
#if ((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
2617-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
2618-
ret = wc_AesCcmEncrypt(ssl->encrypt.aes, output, input,
2619-
dataSz, ssl->encrypt.nonce, nonceSz,
2620-
output + dataSz, macSz, aad, aadSz);
2621-
#else
26222609
ret = wc_AesCcmSetNonce(ssl->encrypt.aes,
26232610
ssl->encrypt.nonce, nonceSz);
26242611
if (ret == 0) {
26252612
ret = wc_AesCcmEncrypt_ex(ssl->encrypt.aes, output,
26262613
input, dataSz, ssl->encrypt.nonce, nonceSz,
26272614
output + dataSz, macSz, aad, aadSz);
26282615
}
2629-
#endif
26302616
}
26312617
break;
26322618
#endif

‎wolfcrypt/src/aes.c‎

Lines changed: 0 additions & 210 deletions
Original file line numberDiff line numberDiff line change
@@ -84,215 +84,6 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
8484
#include <wolfssl/wolfcrypt/port/psa/psa.h>
8585
#endif
8686

87-
/* fips wrapper calls, user can call direct */
88-
#if defined(HAVE_FIPS) && \
89-
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
90-
91-
int wc_AesSetKey(Aes* aes, const byte* key, word32 len, const byte* iv,
92-
int dir)
93-
{
94-
if (aes == NULL || !( (len == 16) || (len == 24) || (len == 32)) ) {
95-
return BAD_FUNC_ARG;
96-
}
97-
98-
return AesSetKey_fips(aes, key, len, iv, dir);
99-
}
100-
int wc_AesSetIV(Aes* aes, const byte* iv)
101-
{
102-
if (aes == NULL) {
103-
return BAD_FUNC_ARG;
104-
}
105-
106-
return AesSetIV_fips(aes, iv);
107-
}
108-
#ifdef HAVE_AES_CBC
109-
int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
110-
{
111-
if (aes == NULL || out == NULL || in == NULL) {
112-
return BAD_FUNC_ARG;
113-
}
114-
115-
return AesCbcEncrypt_fips(aes, out, in, sz);
116-
}
117-
#ifdef HAVE_AES_DECRYPT
118-
int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
119-
{
120-
if (aes == NULL || out == NULL || in == NULL
121-
|| sz % AES_BLOCK_SIZE != 0) {
122-
return BAD_FUNC_ARG;
123-
}
124-
125-
return AesCbcDecrypt_fips(aes, out, in, sz);
126-
}
127-
#endif /* HAVE_AES_DECRYPT */
128-
#endif /* HAVE_AES_CBC */
129-
130-
/* AES-CTR */
131-
#ifdef WOLFSSL_AES_COUNTER
132-
int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
133-
{
134-
if (aes == NULL || out == NULL || in == NULL) {
135-
return BAD_FUNC_ARG;
136-
}
137-
138-
return AesCtrEncrypt(aes, out, in, sz);
139-
}
140-
#endif
141-
142-
/* AES-DIRECT */
143-
#if defined(WOLFSSL_AES_DIRECT)
144-
void wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in)
145-
{
146-
AesEncryptDirect(aes, out, in);
147-
}
148-
149-
#ifdef HAVE_AES_DECRYPT
150-
void wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in)
151-
{
152-
AesDecryptDirect(aes, out, in);
153-
}
154-
#endif /* HAVE_AES_DECRYPT */
155-
156-
int wc_AesSetKeyDirect(Aes* aes, const byte* key, word32 len,
157-
const byte* iv, int dir)
158-
{
159-
return AesSetKeyDirect(aes, key, len, iv, dir);
160-
}
161-
#endif /* WOLFSSL_AES_DIRECT */
162-
163-
/* AES-GCM */
164-
#ifdef HAVE_AESGCM
165-
int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
166-
{
167-
if (aes == NULL || !( (len == 16) || (len == 24) || (len == 32)) ) {
168-
return BAD_FUNC_ARG;
169-
}
170-
171-
return AesGcmSetKey_fips(aes, key, len);
172-
}
173-
int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
174-
const byte* iv, word32 ivSz,
175-
byte* authTag, word32 authTagSz,
176-
const byte* authIn, word32 authInSz)
177-
{
178-
if (aes == NULL || authTagSz > AES_BLOCK_SIZE ||
179-
authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ ||
180-
ivSz == 0 || ivSz > AES_BLOCK_SIZE) {
181-
return BAD_FUNC_ARG;
182-
}
183-
184-
return AesGcmEncrypt_fips(aes, out, in, sz, iv, ivSz, authTag,
185-
authTagSz, authIn, authInSz);
186-
}
187-
188-
#ifdef HAVE_AES_DECRYPT
189-
int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
190-
const byte* iv, word32 ivSz,
191-
const byte* authTag, word32 authTagSz,
192-
const byte* authIn, word32 authInSz)
193-
{
194-
if (aes == NULL || out == NULL || in == NULL || iv == NULL
195-
|| authTag == NULL || authTagSz > AES_BLOCK_SIZE ||
196-
ivSz == 0 || ivSz > AES_BLOCK_SIZE) {
197-
return BAD_FUNC_ARG;
198-
}
199-
200-
return AesGcmDecrypt_fips(aes, out, in, sz, iv, ivSz, authTag,
201-
authTagSz, authIn, authInSz);
202-
}
203-
#endif /* HAVE_AES_DECRYPT */
204-
205-
int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len)
206-
{
207-
if (gmac == NULL || key == NULL || !((len == 16) ||
208-
(len == 24) || (len == 32)) ) {
209-
return BAD_FUNC_ARG;
210-
}
211-
212-
return GmacSetKey(gmac, key, len);
213-
}
214-
int wc_GmacUpdate(Gmac* gmac, const byte* iv, word32 ivSz,
215-
const byte* authIn, word32 authInSz,
216-
byte* authTag, word32 authTagSz)
217-
{
218-
if (gmac == NULL || authTagSz > AES_BLOCK_SIZE ||
219-
authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) {
220-
return BAD_FUNC_ARG;
221-
}
222-
223-
return GmacUpdate(gmac, iv, ivSz, authIn, authInSz,
224-
authTag, authTagSz);
225-
}
226-
#endif /* HAVE_AESGCM */
227-
228-
/* AES-CCM */
229-
#if defined(HAVE_AESCCM) && \
230-
defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
231-
int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz)
232-
{
233-
return AesCcmSetKey(aes, key, keySz);
234-
}
235-
int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
236-
const byte* nonce, word32 nonceSz,
237-
byte* authTag, word32 authTagSz,
238-
const byte* authIn, word32 authInSz)
239-
{
240-
/* sanity check on arguments */
241-
if (aes == NULL || out == NULL || in == NULL || nonce == NULL
242-
|| authTag == NULL || nonceSz < 7 || nonceSz > 13)
243-
return BAD_FUNC_ARG;
244-
245-
AesCcmEncrypt(aes, out, in, inSz, nonce, nonceSz, authTag,
246-
authTagSz, authIn, authInSz);
247-
return 0;
248-
}
249-
250-
#ifdef HAVE_AES_DECRYPT
251-
int wc_AesCcmDecrypt(Aes* aes, byte* out,
252-
const byte* in, word32 inSz,
253-
const byte* nonce, word32 nonceSz,
254-
const byte* authTag, word32 authTagSz,
255-
const byte* authIn, word32 authInSz)
256-
{
257-
258-
if (aes == NULL || out == NULL || in == NULL || nonce == NULL
259-
|| authTag == NULL || nonceSz < 7 || nonceSz > 13) {
260-
return BAD_FUNC_ARG;
261-
}
262-
263-
return AesCcmDecrypt(aes, out, in, inSz, nonce, nonceSz,
264-
authTag, authTagSz, authIn, authInSz);
265-
}
266-
#endif /* HAVE_AES_DECRYPT */
267-
#endif /* HAVE_AESCCM && HAVE_FIPS_VERSION 2 */
268-
269-
int wc_AesInit(Aes* aes, void* h, int i)
270-
{
271-
if (aes == NULL)
272-
return BAD_FUNC_ARG;
273-
274-
(void)h;
275-
(void)i;
276-
277-
/* FIPS doesn't support */
278-
#ifdef WOLFSSL_KCAPI_AES
279-
return AesInit(aes, h, i);
280-
#else
281-
return 0;
282-
#endif
283-
}
284-
void wc_AesFree(Aes* aes)
285-
{
286-
(void)aes;
287-
/* FIPS doesn't support */
288-
#ifdef WOLFSSL_KCAPI_AES
289-
AesFree(aes);
290-
#endif
291-
}
292-
293-
#else /* else build without fips, or for FIPS v2+ */
294-
295-
29687
#if defined(WOLFSSL_TI_CRYPT)
29788
#include <wolfcrypt/src/port/ti/ti-aes.c>
29889
#else
@@ -11590,5 +11381,4 @@ int wc_AesSivDecrypt(const byte* key, word32 keySz, const byte* assoc,
1159011381

1159111382
#endif /* WOLFSSL_AES_SIV */
1159211383

11593-
#endif /* HAVE_FIPS */
1159411384
#endif /* !NO_AES */

0 commit comments

Comments
 (0)