From 7c75c6f52700efbee8d960601c0b1943295b6ae5 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Fri, 7 Mar 2025 18:15:13 -0500
Subject: [PATCH 44/59] FIPS: NO DES support

Signed-off-by: Simo Sorce <simo@redhat.com>
---
 providers/fips/fipsprov.c                           |  3 ++-
 providers/fips/self_test_data.inc                   |  4 ++++
 test/evp_libctx_test.c                              |  4 +++-
 .../30-test_evp_data/evpciph_des3_common.txt        | 13 ++++---------
 test/recipes/30-test_evp_data/evpmac_cmac_des.txt   | 10 ----------
 test/recipes/80-test_cms.t                          |  2 +-
 6 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index a807c76fd8..767073fce4 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -356,7 +356,8 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
          ossl_cipher_capable_aes_cbc_hmac_sha256),
     ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA256, ossl_aes256cbc_hmac_sha256_functions,
          ossl_cipher_capable_aes_cbc_hmac_sha256),
-#ifndef OPENSSL_NO_DES
+/* We don't certify 3DES in our FIPS provider */
+#if 0 /* ifndef OPENSSL_NO_DES */
     ALG(PROV_NAMES_DES_EDE3_ECB, ossl_tdes_ede3_ecb_functions),
     ALG(PROV_NAMES_DES_EDE3_CBC, ossl_tdes_ede3_cbc_functions),
 #endif  /* OPENSSL_NO_DES */
diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
index a7d7684d96..c9ce8f3340 100644
--- a/providers/fips/self_test_data.inc
+++ b/providers/fips/self_test_data.inc
@@ -262,6 +262,7 @@ static const unsigned char aes_128_ecb_ct[] = {
     0x4e, 0xaa, 0x6f, 0xb4, 0xdb, 0xf7, 0x84, 0x65
 };
 
+#if 0
 #ifndef OPENSSL_NO_DES
 /*
  * TDES-ECB test data from
@@ -280,6 +281,7 @@ static const unsigned char tdes_pt[] = {
     0x4B, 0xAB, 0x3B, 0xE1, 0x50, 0x2E, 0x3B, 0x36
 };
 #endif
+#endif
 
 static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
     {
@@ -305,6 +307,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
         CIPHER_MODE_DECRYPT,
         ITM(aes_128_ecb_key)
     },
+#if 0
 #ifndef OPENSSL_NO_DES
     {
         {
@@ -317,6 +320,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
         ITM(tdes_key)
     }
 #endif
+#endif
 };
 
 static const char hkdf_digest[] = "SHA256";
diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c
index 2838f343bd..19dd2c6c63 100644
--- a/test/evp_libctx_test.c
+++ b/test/evp_libctx_test.c
@@ -831,7 +831,9 @@ int setup_tests(void)
     ADD_TEST(kem_invalid_keytype);
 #endif
 #ifndef OPENSSL_NO_DES
-    ADD_TEST(test_cipher_tdes_randkey);
+    if (strcmp(prov_name, "fips") != 0) {
+        ADD_TEST(test_cipher_tdes_randkey);
+    }
 #endif
     return 1;
 }
diff --git a/test/recipes/30-test_evp_data/evpciph_des3_common.txt b/test/recipes/30-test_evp_data/evpciph_des3_common.txt
index 6c74b65cef..8bcb78cd2d 100644
--- a/test/recipes/30-test_evp_data/evpciph_des3_common.txt
+++ b/test/recipes/30-test_evp_data/evpciph_des3_common.txt
@@ -14,7 +14,7 @@
 Title = DES3 Tests
 
 # DES EDE3 CBC tests (from destest)
-FIPSversion = <3.4.0
+Availablein = default
 Cipher = DES-EDE3-CBC
 Key = 0123456789abcdeff1e0d3c2b5a49786fedcba9876543210
 IV = fedcba9876543210
@@ -24,8 +24,7 @@ NextIV = 1c673812cfde9675
 
 # DES EDE3 ECB test
 # FIPS(3.0.0): has a bug in the IV length #17591
-FIPSversion = >3.0.0
-FIPSversion = <3.4.0
+Availablein = default
 Cipher = DES-EDE3-ECB
 Key = 0123456789abcdeff1e0d3c2b5a49786fedcba9876543210
 Plaintext = 37363534333231204E6F77206973207468652074696D6520666F722000000000
@@ -42,7 +41,6 @@ Ciphertext = 4d1332e49f380e23d80a0d8b2bae5e4e6a0094171abcfc27df2bfd40da9f4e4d
 
 # Test that DES3 CBC mode encryption fails because it is not FIPS approved
 Availablein = fips
-FIPSversion = >=3.4.0
 Cipher = DES-EDE3-CBC
 Key = 0123456789abcdeff1e0d3c2b5a49786fedcba9876543210
 IV = fedcba9876543210
@@ -52,7 +50,6 @@ Result = CIPHERINIT_ERROR
 
 # Test that DES3 EBC mode encryption fails because it is not FIPS approved
 Availablein = fips
-FIPSversion = >=3.4.0
 Cipher = DES-EDE3-ECB
 Key = 0123456789abcdeff1e0d3c2b5a49786fedcba9876543210
 Plaintext = 37363534333231204E6F77206973207468652074696D6520666F722000000000
@@ -62,8 +59,7 @@ Result = CIPHERINIT_ERROR
 Title = DES3 FIPS Indicator Tests
 
 # Test that DES3 CBC mode encryption is not FIPS approved
-Availablein = fips
-FIPSversion = >=3.4.0
+Availablein = none
 Cipher = DES-EDE3-CBC
 Unapproved = 1
 CtrlInit = encrypt-check:0
@@ -74,8 +70,7 @@ Plaintext = 37363534333231204E6F77206973207468652074696D6520666F722000000000
 Ciphertext = 3FE301C962AC01D02213763C1CBD4CDC799657C064ECF5D41C673812CFDE9675
 
 # Test that DES3 ECB mode encryption is not FIPS approved
-Availablein = fips
-FIPSversion = >=3.4.0
+Availablein = none
 Cipher = DES-EDE3-ECB
 Operation = ENCRYPT
 Unapproved = 1
diff --git a/test/recipes/30-test_evp_data/evpmac_cmac_des.txt b/test/recipes/30-test_evp_data/evpmac_cmac_des.txt
index a11e5ffe54..e4a7cbe75e 100644
--- a/test/recipes/30-test_evp_data/evpmac_cmac_des.txt
+++ b/test/recipes/30-test_evp_data/evpmac_cmac_des.txt
@@ -35,13 +35,3 @@ Algorithm = DES-EDE3-CBC
 Key = 89BCD952A8C8AB371AF48AC7D07085D5EFF702E6D62CDC23
 Input = FA620C1BBE97319E9A0CF0492121F7A20EB08A6A709DCBD00AAF38E4F99E754E
 Result = MAC_INIT_ERROR
-
-Availablein = fips
-FIPSversion = >=3.4.0
-MAC = CMAC
-Unapproved = 1
-Ctrl = encrypt-check:0
-Algorithm = DES-EDE3-CBC
-Key = 89BCD952A8C8AB371AF48AC7D07085D5EFF702E6D62CDC23
-Input = FA620C1BBE97319E9A0CF0492121F7A20EB08A6A709DCBD00AAF38E4F99E754E
-Output = 8F49A1B7D6AA2258
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
index 7350baa921..740823c61e 100644
--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
@@ -415,7 +415,7 @@ my @smime_cms_tests = (
       \&final_compare
     ],
 
-    [ "encrypted content test streaming PEM format, triple DES key",
+    [ "encrypted content test streaming PEM format, triple DES key, no Red Hat FIPS",
       [ "{cmd1}", @defaultprov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
         "-stream", "-out", "{output}.cms" ],
-- 
2.51.0

