1 /* 2 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"). 5 * You may not use this file except in compliance with the License. 6 * A copy of the License is located at 7 * 8 * http://aws.amazon.com/apache2.0 9 * 10 * or in the "license" file accompanying this file. This file is distributed 11 * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either 12 * express or implied. See the License for the specific language governing 13 * permissions and limitations under the License. 14 */ 15 16 #include "crypto/s2n_evp.h" 17 #include "crypto/s2n_fips.h" 18 #include "error/s2n_errno.h" 19 #include "utils/s2n_safety.h" 20 s2n_digest_allow_md5_for_fips(struct s2n_evp_digest * evp_digest)21int s2n_digest_allow_md5_for_fips(struct s2n_evp_digest *evp_digest) 22 { 23 POSIX_ENSURE_REF(evp_digest); 24 /* This is only to be used for EVP digests that will require MD5 to be used 25 * to comply with the TLS 1.0 and 1.1 RFC's for the PRF. MD5 cannot be used 26 * outside of the TLS 1.0 and 1.1 PRF when in FIPS mode. 27 */ 28 S2N_ERROR_IF(!s2n_is_in_fips_mode() || (evp_digest->ctx == NULL), S2N_ERR_ALLOW_MD5_FOR_FIPS_FAILED); 29 30 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) 31 EVP_MD_CTX_set_flags(evp_digest->ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); 32 #endif 33 return S2N_SUCCESS; 34 } 35 s2n_digest_is_md5_allowed_for_fips(struct s2n_evp_digest * evp_digest,bool * out)36S2N_RESULT s2n_digest_is_md5_allowed_for_fips(struct s2n_evp_digest *evp_digest, bool *out) 37 { 38 RESULT_ENSURE_REF(out); 39 *out = false; 40 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) 41 if (evp_digest && evp_digest->ctx && s2n_is_in_fips_mode() && EVP_MD_CTX_test_flags(evp_digest->ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)) { 42 /* s2n is in FIPS mode and the EVP digest allows MD5. */ 43 *out = true; 44 } 45 #endif 46 return S2N_RESULT_OK; 47 } 48