File gnupg-detect_FIPS_mode.patch of Package gpg2.6742

Overview Repositories Revisions Requests Users Attributes Meta

File gnupg-detect_FIPS_mode.patch of Package gpg2.6742

Index: gnupg-2.0.19/g10/encode.c
===================================================================
--- gnupg-2.0.19.orig/g10/encode.c	2013-03-14 14:23:58.009483967 +0100
+++ gnupg-2.0.19/g10/encode.c	2013-03-14 15:49:50.524306304 +0100
@@ -732,7 +732,10 @@ encrypt_filter( void *opaque, int contro
 		if( efx->cfx.dek->algo == -1 ) {
                     /* because 3DES is implicitly in the prefs, this can only
                      * happen if we do not have any public keys in the list */
-		    efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
+		   /* Libgcrypt manual says that gcry_version_check must be called
+		      before calling gcry_fips_mode_active. */
+		    gcry_check_version (NULL);
+		    efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
                 }
 
                 /* In case 3DES has been selected, print a warning if
Index: gnupg-2.0.19/g10/gpg.c
===================================================================
--- gnupg-2.0.19.orig/g10/gpg.c	2013-03-14 14:24:00.031545611 +0100
+++ gnupg-2.0.19/g10/gpg.c	2013-03-14 14:24:37.495687612 +0100
@@ -1975,7 +1975,7 @@ main (int argc, char **argv)
     opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
     opt.s2k_mode = 3; /* iterated+salted */
     opt.s2k_count = 0; /* Auto-calibrate when needed.  */
-    opt.s2k_cipher_algo = CIPHER_ALGO_CAST5;
+    opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5;
     opt.completes_needed = 1;
     opt.marginals_needed = 3;
     opt.max_cert_depth = 5;
Index: gnupg-2.0.19/g10/mainproc.c
===================================================================
--- gnupg-2.0.19.orig/g10/mainproc.c	2013-03-14 14:23:58.011484028 +0100
+++ gnupg-2.0.19/g10/mainproc.c	2013-03-14 15:50:50.970127383 +0100
@@ -685,9 +685,15 @@ proc_plaintext( CTX c, PACKET *pkt )
 	   often.  There is no good way to specify what algorithms to
 	   use in that case, so these three are the historical
 	   answer. */
-	gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
+
+	/* Libgcrypt manual says that gcry_version_check must be called
+	   before calling gcry_fips_mode_active. */
+	gcry_check_version (NULL);
+	if( !gcry_fips_mode_active() )
+	  gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
 	gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 );
-	gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
+	if( !gcry_fips_mode_active() )
+	  gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
       }
     if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) {
 	/* This is a kludge to work around a bug in pgp2.  It does only

Places

File gnupg-detect_FIPS_mode.patch of Package gpg2.6742

Places