openssl/0045-FIPS-services-minimize.patch

From a9dc983f82cabe29d6b48f3af3e30e26074ce5cf Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Mon, 21 Aug 2023 12:55:57 +0200
Subject: [PATCH 21/48] 0045-FIPS-services-minimize.patch

Patch-name: 0045-FIPS-services-minimize.patch
Patch-id: 45
Patch-status: |
    # Minimize fips services
---
 apps/ecparam.c                                |  7 +++
 apps/req.c                                    |  2 +-
 providers/common/capabilities.c               |  2 +-
 providers/fips/fipsprov.c                     | 44 +++++++++++--------
 providers/fips/self_test_data.inc             |  9 +++-
 providers/implementations/signature/rsa_sig.c | 26 +++++++++++
 ssl/ssl_ciph.c                                |  3 ++
 test/acvp_test.c                              |  2 +
 test/endecode_test.c                          |  4 ++
 test/evp_libctx_test.c                        |  9 +++-
 test/recipes/15-test_gendsa.t                 |  2 +-
 test/recipes/20-test_cli_fips.t               |  3 +-
 test/recipes/30-test_evp.t                    | 16 +++----
 .../30-test_evp_data/evpmac_common.txt        | 22 ++++++++++
 test/recipes/80-test_cms.t                    | 22 +++++-----
 test/recipes/80-test_ssl_old.t                |  2 +-
 16 files changed, 128 insertions(+), 47 deletions(-)

diff --git a/apps/ecparam.c b/apps/ecparam.c
index 9e9ad13683..9c66cf2434 100644
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -79,6 +79,13 @@ static int list_builtin_curves(BIO *out)
         const char *comment = curves[n].comment;
         const char *sname = OBJ_nid2sn(curves[n].nid);
 
+        if (((curves[n].nid == NID_secp256k1) || (curves[n].nid == NID_brainpoolP256r1)
+            || (curves[n].nid == NID_brainpoolP256t1) || (curves[n].nid == NID_brainpoolP320r1)
+            || (curves[n].nid == NID_brainpoolP320t1) || (curves[n].nid == NID_brainpoolP384r1)
+            || (curves[n].nid == NID_brainpoolP384t1) || (curves[n].nid == NID_brainpoolP512r1)
+            || (curves[n].nid == NID_brainpoolP512t1)) && EVP_default_properties_is_fips_enabled(NULL))
+            continue;
+
         if (comment == NULL)
             comment = "CURVE DESCRIPTION NOT AVAILABLE";
         if (sname == NULL)
diff --git a/apps/req.c b/apps/req.c
index 23757044ab..5916914978 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -266,7 +266,7 @@ int req_main(int argc, char **argv)
     unsigned long chtype = MBSTRING_ASC, reqflag = 0;
 
 #ifndef OPENSSL_NO_DES
-    cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
+    cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
 #endif
 
     prog = opt_init(argc, argv, req_options);
diff --git a/providers/common/capabilities.c b/providers/common/capabilities.c
index ed37e76969..eb836dfa6a 100644
--- a/providers/common/capabilities.c
+++ b/providers/common/capabilities.c
@@ -186,9 +186,9 @@ static const OSSL_PARAM param_group_list[][10] = {
     TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
     TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
     TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
-#  endif
     TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28),
     TLS_GROUP_ENTRY("x448", "X448", "X448", 29),
+#  endif
 # endif /* OPENSSL_NO_EC */
 # ifndef OPENSSL_NO_DH
     /* Security bit values for FFDHE groups are as per RFC 7919 */
diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index 518226dfc6..29438faea8 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -199,13 +199,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[])
                                               OSSL_LIB_CTX_FIPS_PROV_INDEX);
 
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
-    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider"))
+    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider"))
         return 0;
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION);
-    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR))
+    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, REDHAT_FIPS_VERSION))
         return 0;
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO);
-    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR))
+    if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, REDHAT_FIPS_VERSION))
         return 0;
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_STATUS);
     if (p != NULL && !OSSL_PARAM_set_int(p, ossl_prov_is_running()))
@@ -298,10 +298,11 @@ static const OSSL_ALGORITHM fips_digests[] = {
      * KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for
      * KMAC128 and KMAC256.
      */
-    { PROV_NAMES_KECCAK_KMAC_128, FIPS_DEFAULT_PROPERTIES,
+    /* We don't certify KECCAK in our FIPS provider */
+    /* { PROV_NAMES_KECCAK_KMAC_128, FIPS_DEFAULT_PROPERTIES,
       ossl_keccak_kmac_128_functions },
     { PROV_NAMES_KECCAK_KMAC_256, FIPS_DEFAULT_PROPERTIES,
-      ossl_keccak_kmac_256_functions },
+      ossl_keccak_kmac_256_functions }, */
     { NULL, NULL, NULL }
 };
 
@@ -360,8 +361,9 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
     ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA256, ossl_aes256cbc_hmac_sha256_functions,
          ossl_cipher_capable_aes_cbc_hmac_sha256),
 #ifndef OPENSSL_NO_DES
-    UNAPPROVED_ALG(PROV_NAMES_DES_EDE3_ECB, ossl_tdes_ede3_ecb_functions),
-    UNAPPROVED_ALG(PROV_NAMES_DES_EDE3_CBC, ossl_tdes_ede3_cbc_functions),
+    /* We don't certify 3DES in our FIPS provider */
+    /* UNAPPROVED_ALG(PROV_NAMES_DES_EDE3_ECB, ossl_tdes_ede3_ecb_functions),
+    UNAPPROVED_ALG(PROV_NAMES_DES_EDE3_CBC, ossl_tdes_ede3_cbc_functions), */
 #endif  /* OPENSSL_NO_DES */
     { { NULL, NULL, NULL }, NULL }
 };
@@ -373,8 +375,9 @@ static const OSSL_ALGORITHM fips_macs[] = {
 #endif
     { PROV_NAMES_GMAC, FIPS_DEFAULT_PROPERTIES, ossl_gmac_functions },
     { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, ossl_hmac_functions },
-    { PROV_NAMES_KMAC_128, FIPS_DEFAULT_PROPERTIES, ossl_kmac128_functions },
-    { PROV_NAMES_KMAC_256, FIPS_DEFAULT_PROPERTIES, ossl_kmac256_functions },
+    /* We don't certify KMAC in our FIPS provider */
+    /*{ PROV_NAMES_KMAC_128, FIPS_DEFAULT_PROPERTIES, ossl_kmac128_functions },
+    { PROV_NAMES_KMAC_256, FIPS_DEFAULT_PROPERTIES, ossl_kmac256_functions }, */
     { NULL, NULL, NULL }
 };
 
@@ -409,8 +412,9 @@ static const OSSL_ALGORITHM fips_keyexch[] = {
 #endif
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_ECDH, FIPS_DEFAULT_PROPERTIES, ossl_ecdh_keyexch_functions },
-    { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keyexch_functions },
-    { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keyexch_functions },
+    /* We don't certify Edwards curves in our FIPS provider */
+    /*{ PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keyexch_functions },
+    { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keyexch_functions },*/
 #endif
     { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES,
       ossl_kdf_tls1_prf_keyexch_functions },
@@ -420,13 +424,15 @@ static const OSSL_ALGORITHM fips_keyexch[] = {
 
 static const OSSL_ALGORITHM fips_signature[] = {
 #ifndef OPENSSL_NO_DSA
-    { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions },
+    /* We don't certify DSA in our FIPS provider */
+    /* { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions }, */
 #endif
     { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_signature_functions },
 #ifndef OPENSSL_NO_EC
-    { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES,
+    /* We don't certify Edwards curves in our FIPS provider */
+    /* { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES,
       ossl_ed25519_signature_functions },
-    { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions },
+    { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions }, */
     { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions },
 #endif
     { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES,
@@ -456,8 +462,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
       PROV_DESCS_DHX },
 #endif
 #ifndef OPENSSL_NO_DSA
-    { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_keymgmt_functions,
-      PROV_DESCS_DSA },
+    /* We don't certify DSA in our FIPS provider */
+    /* { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_keymgmt_functions,
+      PROV_DESCS_DSA }, */
 #endif
     { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_keymgmt_functions,
       PROV_DESCS_RSA },
@@ -466,14 +473,15 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_EC, FIPS_DEFAULT_PROPERTIES, ossl_ec_keymgmt_functions,
       PROV_DESCS_EC },
-    { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keymgmt_functions,
+    /* We don't certify Edwards curves in our FIPS provider */
+    /* { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keymgmt_functions,
       PROV_DESCS_X25519 },
     { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keymgmt_functions,
       PROV_DESCS_X448 },
     { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, ossl_ed25519_keymgmt_functions,
       PROV_DESCS_ED25519 },
     { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_keymgmt_functions,
-      PROV_DESCS_ED448 },
+      PROV_DESCS_ED448 }, */
 #endif
     { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_keymgmt_functions,
       PROV_DESCS_TLS1_PRF_SIGN },
diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
index 2057378d3d..4b80bb70b9 100644
--- a/providers/fips/self_test_data.inc
+++ b/providers/fips/self_test_data.inc
@@ -177,6 +177,7 @@ static const ST_KAT_DIGEST st_kat_digest_tests[] =
 /*- CIPHER TEST DATA */
 
 /* DES3 test data */
+#if 0
 static const unsigned char des_ede3_cbc_pt[] = {
     0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
     0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
@@ -197,7 +198,7 @@ static const unsigned char des_ede3_cbc_ct[] = {
     0x51, 0x65, 0x70, 0x48, 0x1F, 0x25, 0xB5, 0x0F,
     0x73, 0xC0, 0xBD, 0xA8, 0x5C, 0x8E, 0x0D, 0xA7
 };
-
+#endif
 /* AES-256 GCM test data */
 static const unsigned char aes_256_gcm_key[] = {
     0x92, 0xe1, 0x1d, 0xcd, 0xaa, 0x86, 0x6f, 0x5c,
@@ -1454,8 +1455,9 @@ static const ST_KAT_PARAM ecdsa_bin_key[] = {
 # endif /* OPENSSL_NO_EC2M */
 #endif /* OPENSSL_NO_EC */
 
-#ifndef OPENSSL_NO_DSA
 /* dsa 2048 */
+#if 0
+#ifndef OPENSSL_NO_DSA
 static const unsigned char dsa_p[] = {
     0xa2, 0x9b, 0x88, 0x72, 0xce, 0x8b, 0x84, 0x23,
     0xb7, 0xd5, 0xd2, 0x1d, 0x4b, 0x02, 0xf5, 0x7e,
@@ -1590,6 +1592,7 @@ static const ST_KAT_PARAM dsa_key[] = {
     ST_KAT_PARAM_END()
 };
 #endif /* OPENSSL_NO_DSA */
+#endif
 
 /* Hash DRBG inputs for signature KATs */
 static const unsigned char sig_kat_entropyin[] = {
@@ -1642,6 +1645,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
     },
 # endif
 #endif /* OPENSSL_NO_EC */
+#if 0
 #ifndef OPENSSL_NO_DSA
     {
         OSSL_SELF_TEST_DESC_SIGN_DSA,
@@ -1654,6 +1658,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
         ITM(dsa_expected_sig)
     },
 #endif /* OPENSSL_NO_DSA */
+#endif
 };
 
 static const ST_KAT_ASYM_CIPHER st_kat_asym_cipher_tests[] = {
diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
index d4261e8f7d..2a5504d104 100644
--- a/providers/implementations/signature/rsa_sig.c
+++ b/providers/implementations/signature/rsa_sig.c
@@ -689,6 +689,19 @@ static int rsa_verify_recover(void *vprsactx,
 {
     PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
     int ret;
+# ifdef FIPS_MODULE
+    size_t rsabits = RSA_bits(prsactx->rsa);
+
+    if (rsabits < 2048) {
+        if (rsabits != 1024
+            && rsabits != 1280
+            && rsabits != 1536
+            && rsabits != 1792) {
+            ERR_raise(ERR_LIB_FIPS, PROV_R_INVALID_KEY_LENGTH);
+            return 0;
+        }
+    }
+# endif
 
     if (!ossl_prov_is_running())
         return 0;
@@ -777,6 +790,19 @@ static int rsa_verify(void *vprsactx, const unsigned char *sig, size_t siglen,
 {
     PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
     size_t rslen;
+# ifdef FIPS_MODULE
+    size_t rsabits = RSA_bits(prsactx->rsa);
+
+    if (rsabits < 2048) {
+        if (rsabits != 1024
+            && rsabits != 1280
+            && rsabits != 1536
+            && rsabits != 1792) {
+            ERR_raise(ERR_LIB_FIPS, PROV_R_INVALID_KEY_LENGTH);
+            return 0;
+        }
+    }
+# endif
 
     if (!ossl_prov_is_running())
         return 0;
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index a5e60e8839..f9af07d12b 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -356,6 +356,9 @@ int ssl_load_ciphers(SSL_CTX *ctx)
     ctx->disabled_mkey_mask = 0;
     ctx->disabled_auth_mask = 0;
 
+    if (EVP_default_properties_is_fips_enabled(ctx->libctx))
+        ctx->disabled_mkey_mask |= SSL_kRSA | SSL_kRSAPSK;
+
     /*
      * We ignore any errors from the fetches below. They are expected to fail
      * if theose algorithms are not available.
diff --git a/test/acvp_test.c b/test/acvp_test.c
index fee880d441..13d7a0ea8b 100644
--- a/test/acvp_test.c
+++ b/test/acvp_test.c
@@ -1476,6 +1476,7 @@ int setup_tests(void)
                   OSSL_NELEM(dh_safe_prime_keyver_data));
 #endif /* OPENSSL_NO_DH */
 
+#if 0 /* Red Hat FIPS provider doesn't have fips=yes property on DSA */
 #ifndef OPENSSL_NO_DSA
     ADD_ALL_TESTS(dsa_keygen_test, OSSL_NELEM(dsa_keygen_data));
     ADD_ALL_TESTS(dsa_paramgen_test, OSSL_NELEM(dsa_paramgen_data));
@@ -1483,6 +1484,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(dsa_siggen_test, OSSL_NELEM(dsa_siggen_data));
     ADD_ALL_TESTS(dsa_sigver_test, OSSL_NELEM(dsa_sigver_data));
 #endif /* OPENSSL_NO_DSA */
+#endif
 
 #ifndef OPENSSL_NO_EC
     ADD_ALL_TESTS(ecdsa_keygen_test, OSSL_NELEM(ecdsa_keygen_data));
diff --git a/test/endecode_test.c b/test/endecode_test.c
index 9a437d8c64..53385028fc 100644
--- a/test/endecode_test.c
+++ b/test/endecode_test.c
@@ -1407,6 +1407,7 @@ int setup_tests(void)
          * so no legacy tests.
          */
 #endif
+    if (is_fips == 0) {
 #ifndef OPENSSL_NO_DSA
         ADD_TEST_SUITE(DSA);
         ADD_TEST_SUITE_PARAMS(DSA);
@@ -1417,6 +1418,7 @@ int setup_tests(void)
         ADD_TEST_SUITE_PROTECTED_PVK(DSA);
 # endif
 #endif
+    }
 #ifndef OPENSSL_NO_EC
         ADD_TEST_SUITE(EC);
         ADD_TEST_SUITE_PARAMS(EC);
@@ -1431,10 +1433,12 @@ int setup_tests(void)
         ADD_TEST_SUITE(ECExplicitTri2G);
         ADD_TEST_SUITE_LEGACY(ECExplicitTri2G);
 # endif
+    if (is_fips == 0) {
         ADD_TEST_SUITE(ED25519);
         ADD_TEST_SUITE(ED448);
         ADD_TEST_SUITE(X25519);
         ADD_TEST_SUITE(X448);
+    }
         /*
          * ED25519, ED448, X25519 and X448 have no support for
          * PEM_write_bio_PrivateKey_traditional(), so no legacy tests.
diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c
index 2448c35a14..a7913cda4c 100644
--- a/test/evp_libctx_test.c
+++ b/test/evp_libctx_test.c
@@ -21,6 +21,7 @@
  */
 #include "internal/deprecated.h"
 #include <assert.h>
+#include <string.h>
 #include <openssl/evp.h>
 #include <openssl/provider.h>
 #include <openssl/dsa.h>
@@ -726,7 +727,9 @@ int setup_tests(void)
         return 0;
 
 #if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DH)
-    ADD_ALL_TESTS(test_dsa_param_keygen, 3 * 3 * 3);
+    if (strcmp(prov_name, "fips") != 0) {
+        ADD_ALL_TESTS(test_dsa_param_keygen, 3 * 3 * 3);
+    }
 #endif
 #ifndef OPENSSL_NO_DH
     ADD_ALL_TESTS(test_dh_safeprime_param_keygen, 3 * 3 * 3);
@@ -746,7 +749,9 @@ int setup_tests(void)
     ADD_TEST(kem_invalid_keytype);
 #endif
 #ifndef OPENSSL_NO_DES
-    ADD_TEST(test_cipher_tdes_randkey);
+    if (strcmp(prov_name, "fips") != 0) {
+        ADD_TEST(test_cipher_tdes_randkey);
+    }
 #endif
     return 1;
 }
diff --git a/test/recipes/15-test_gendsa.t b/test/recipes/15-test_gendsa.t
index b495b08bda..69bd299521 100644
--- a/test/recipes/15-test_gendsa.t
+++ b/test/recipes/15-test_gendsa.t
@@ -24,7 +24,7 @@ use lib bldtop_dir('.');
 plan skip_all => "This test is unsupported in a no-dsa build"
     if disabled("dsa");
 
-my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
+my $no_fips = 1;
 
 plan tests =>
     ($no_fips ? 0 : 2)          # FIPS related tests
diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t
index 6d3c5ba1bb..2ba47b5fca 100644
--- a/test/recipes/20-test_cli_fips.t
+++ b/test/recipes/20-test_cli_fips.t
@@ -273,8 +273,7 @@ SKIP: {
 }
 
 SKIP : {
-    skip "FIPS DSA tests because of no dsa in this build", 1
-        if disabled("dsa");
+    skip "FIPS DSA tests because of no dsa in this build", 1;
 
     subtest DSA => sub {
         my $testtext_prefix = 'DSA';
diff --git a/test/recipes/30-test_evp.t b/test/recipes/30-test_evp.t
index 9d7040ced2..f8beb538d4 100644
--- a/test/recipes/30-test_evp.t
+++ b/test/recipes/30-test_evp.t
@@ -42,10 +42,8 @@ my @files = qw(
                 evpciph_aes_cts.txt
                 evpciph_aes_wrap.txt
                 evpciph_aes_stitched.txt
-                evpciph_des3_common.txt
                 evpkdf_hkdf.txt
                 evpkdf_kbkdf_counter.txt
-                evpkdf_kbkdf_kmac.txt
                 evpkdf_pbkdf1.txt
                 evpkdf_pbkdf2.txt
                 evpkdf_ss.txt
@@ -65,12 +63,6 @@ push @files, qw(
                 evppkey_ffdhe.txt
                 evppkey_dh.txt
                ) unless $no_dh;
-push @files, qw(
-                evpkdf_x942_des.txt
-                evpmac_cmac_des.txt
-               ) unless $no_des;
-push @files, qw(evppkey_dsa.txt) unless $no_dsa;
-push @files, qw(evppkey_ecx.txt) unless $no_ec;
 push @files, qw(
                 evppkey_ecc.txt
                 evppkey_ecdh.txt
@@ -91,6 +83,7 @@ my @defltfiles = qw(
                      evpciph_cast5.txt
                      evpciph_chacha.txt
                      evpciph_des.txt
+                     evpciph_des3_common.txt
                      evpciph_idea.txt
                      evpciph_rc2.txt
                      evpciph_rc4.txt
@@ -114,10 +107,17 @@ my @defltfiles = qw(
                      evpmd_whirlpool.txt
                      evppbe_scrypt.txt
                      evppbe_pkcs12.txt
+                     evpkdf_kbkdf_kmac.txt
                      evppkey_kdf_scrypt.txt
                      evppkey_kdf_tls1_prf.txt
                      evppkey_rsa.txt
                     );
+push @defltfiles, qw(evppkey_dsa.txt) unless $no_dsa;
+push @defltfiles, qw(evppkey_ecx.txt) unless $no_ec;
+push @defltfiles, qw(
+                evpkdf_x942_des.txt
+                evpmac_cmac_des.txt
+               ) unless $no_des;
 push @defltfiles, qw(evppkey_brainpool.txt) unless $no_ec;
 push @defltfiles, qw(evppkey_sm2.txt) unless $no_sm2;
 
diff --git a/test/recipes/30-test_evp_data/evpmac_common.txt b/test/recipes/30-test_evp_data/evpmac_common.txt
index 93195df97c..315413cd9b 100644
--- a/test/recipes/30-test_evp_data/evpmac_common.txt
+++ b/test/recipes/30-test_evp_data/evpmac_common.txt
@@ -340,6 +340,7 @@ IV = 7AE8E2CA4EC500012E58495C
 Input = 68F2E77696CE7AE8E2CA4EC588E541002E58495C08000F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D0007
 Result = MAC_INIT_ERROR
 
+Availablein = default
 Title = KMAC Tests (From NIST)
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
@@ -350,12 +351,14 @@ Ctrl = xof:0
 OutputSize = 32
 BlockSize = 168
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
 Custom = "My Tagged Application"
 Output = 3B1FBA963CD8B0B59E8C1A6D71888B7143651AF8BA0A7070C0979E2811324AA5
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -363,6 +366,7 @@ Custom = "My Tagged Application"
 Output = 1F5B4E6CCA02209E0DCB5CA635B89A15E271ECC760071DFD805FAA38F9729230
 Ctrl = size:32
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
@@ -371,12 +375,14 @@ Output = 20C570C31346F703C9AC36C61C03CB64C3970D0CFC787E9B79599D273A68D2F7F69D4CC
 OutputSize = 64
 BlockSize = 136
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
 Custom = ""
 Output = 75358CF39E41494E949707927CEE0AF20A3FF553904C86B08F21CC414BCFD691589D27CF5E15369CBBFF8B9A4C2EB17800855D0235FF635DA82533EC6B759B69
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -386,12 +392,14 @@ Ctrl = size:64
 
 Title = KMAC XOF Tests (From NIST)
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
 Output = CD83740BBD92CCC8CF032B1481A0F4460E7CA9DD12B08A0C4031178BACD6EC35
 XOF = 1
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
@@ -399,6 +407,7 @@ Custom = "My Tagged Application"
 Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C
 XOF = 1
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -407,6 +416,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F
 XOF = 1
 Ctrl = size:32
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
@@ -414,6 +424,7 @@ Custom = "My Tagged Application"
 Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B
 XOF = 1
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -421,6 +432,7 @@ Custom = ""
 Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B
 XOF = 1
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -431,6 +443,7 @@ XOF = 1
 
 Title = KMAC long customisation string (from NIST ACVP)
 
+Availablein = default
 MAC = KMAC256
 Key = 9743DBF93102FAF11227B154B8ACD16CF142671F7AA16C559A393A38B4CEF461ED29A6A328D7379C99718790E38B54CA25E9E831CBEA463EE704D1689F94629AB795DF0C77F756DA743309C0E054596BA2D9CC1768ACF7CD351D9A7EB1ABD0A3
 Input = BA63AC9C711F143CCE7FF92D0322649D1BE437D805FD225C0A2879A008373EC3BCCDB09971FAD2BCE5F4347AF7E5238EF01A90ED34193D6AFC1D
@@ -441,12 +454,14 @@ XOF = 1
 
 Title = KMAC XOF Tests via ctrl (From NIST)
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
 Output = CD83740BBD92CCC8CF032B1481A0F4460E7CA9DD12B08A0C4031178BACD6EC35
 Ctrl = xof:1
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
@@ -454,6 +469,7 @@ Custom = "My Tagged Application"
 Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C
 Ctrl = xof:1
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -462,6 +478,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F
 Ctrl = xof:1
 Ctrl = size:32
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 00010203
@@ -469,6 +486,7 @@ Custom = "My Tagged Application"
 Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B
 Ctrl = xof:1
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -476,6 +494,7 @@ Custom = ""
 Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B
 Ctrl = xof:1
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -486,6 +505,7 @@ Ctrl = xof:1
 
 Title = KMAC long customisation string via ctrl (from NIST ACVP)
 
+Availablein = default
 MAC = KMAC256
 Key = 9743DBF93102FAF11227B154B8ACD16CF142671F7AA16C559A393A38B4CEF461ED29A6A328D7379C99718790E38B54CA25E9E831CBEA463EE704D1689F94629AB795DF0C77F756DA743309C0E054596BA2D9CC1768ACF7CD351D9A7EB1ABD0A3
 Input = BA63AC9C711F143CCE7FF92D0322649D1BE437D805FD225C0A2879A008373EC3BCCDB09971FAD2BCE5F4347AF7E5238EF01A90ED34193D6AFC1D
@@ -496,6 +516,7 @@ Ctrl = xof:1
 
 Title = KMAC long customisation string negative test
 
+Availablein = default
 MAC = KMAC128
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
@@ -504,6 +525,7 @@ Result = MAC_INIT_ERROR
 
 Title = KMAC output is too large
 
+Availablein = default
 MAC = KMAC256
 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
index 40dd585c18..cbec426137 100644
--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
@@ -96,7 +96,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed content DER format, DSA key",
+    [ "signed content DER format, DSA key, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
@@ -104,7 +104,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed detached content DER format, DSA key",
+    [ "signed detached content DER format, DSA key, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
@@ -113,7 +113,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed detached content DER format, add RSA signer (with DSA existing)",
+    [ "signed detached content DER format, add RSA signer (with DSA existing), no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
       [ "{cmd1}", @prov, "-resign", "-in", "{output}.cms", "-inform", "DER", "-outform", "DER",
@@ -124,7 +124,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed content test streaming BER format, DSA key",
+    [ "signed content test streaming BER format, DSA key, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-nodetach", "-stream",
         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
@@ -133,7 +133,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys",
+    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-nodetach", "-stream",
         "-signer", $smrsa1,
@@ -146,7 +146,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes",
+    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-noattr", "-nodetach", "-stream",
         "-signer", $smrsa1,
@@ -176,7 +176,7 @@ my @smime_pkcs7_tests = (
       \&zero_compare
     ],
 
-    [ "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys",
+    [ "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
         "-signer", $smrsa1,
         "-signer", catfile($smdir, "smrsa2.pem"),
@@ -188,7 +188,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys",
+    [ "signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont,
         "-signer", $smrsa1,
         "-signer", catfile($smdir, "smrsa2.pem"),
@@ -248,7 +248,7 @@ my @smime_pkcs7_tests = (
 
 my @smime_cms_tests = (
 
-    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid",
+    [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
         "-nodetach", "-keyid",
         "-signer", $smrsa1,
@@ -261,7 +261,7 @@ my @smime_cms_tests = (
       \&final_compare
     ],
 
-    [ "signed content test streaming PEM format, 2 DSA and 2 RSA keys",
+    [ "signed content test streaming PEM format, 2 DSA and 2 RSA keys, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
         "-signer", $smrsa1,
         "-signer", catfile($smdir, "smrsa2.pem"),
@@ -371,7 +371,7 @@ my @smime_cms_tests = (
       \&final_compare
     ],
 
-    [ "encrypted content test streaming PEM format, triple DES key",
+    [ "encrypted content test streaming PEM format, triple DES key, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
         "-stream", "-out", "{output}.cms" ],
diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t
index 50b74a1e29..e2dcb68fb5 100644
--- a/test/recipes/80-test_ssl_old.t
+++ b/test/recipes/80-test_ssl_old.t
@@ -436,7 +436,7 @@ sub testssl {
         my @exkeys = ();
         my $ciphers = '-PSK:-SRP:@SECLEVEL=0';
 
-        if (!$no_dsa) {
+        if (!$no_dsa && $provider ne "fips") {
             push @exkeys, "-s_cert", "certD.ss", "-s_key", $Dkey;
         }
 
-- 
2.41.0