From b9756ef7e04d09f3ab54824f07af7e3958a9bd22 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Tue, 25 Aug 2026 16:24:42 +0200 Subject: [PATCH] Rebase to OpenSSL 3.5.8 Resolves: RHEL-242942 Resolves: RHEL-246259 Resolves: RHEL-246288 Resolves: RHEL-246320 Resolves: RHEL-246440 Resolves: RHEL-246444 Resolves: RHEL-246448 Resolves: RHEL-246452 Resolves: RHEL-246456 --- .gitignore | 1 + 0001-RH-Aarch64-and-ppc64le-use-lib64.patch | 10 +- ...-config-file-to-use-for-rpm-installs.patch | 4 +- 0003-RH-Do-not-install-html-docs.patch | 8 +- ...a-fix-md-option-help-text.patch-DROP.patch | 4 +- ...ture-verification-with-bad-digests-R.patch | 4 +- ...or-PROFILE-SYSTEM-system-default-cip.patch | 48 +-- ...RH-Add-FIPS_mode-compatibility-macro.patch | 4 +- ...rnel-FIPS-mode-flag-support-FIXSTYLE.patch | 4 +- ...k-curve-definitions-RENAMED-SQUASHED.patch | 22 +- 0010-RH-Disable-explicit-ec-curves.patch | 48 +-- 0011-RH-skipped-tests-EC-curves.patch | 4 +- 0012-RH-skip-quic-pairwise.patch | 50 +-- 0013-RH-version-aliasing.patch | 10 +- ...wo-symbols-for-OPENSSL_str-n-casecmp.patch | 16 +- 0015-RH-TMP-KTLS-test-skip.patch | 6 +- ...H-Allow-disabling-of-SHA1-signatures.patch | 26 +- ...d-Hat-s-FIPS-module-name-and-version.patch | 8 +- 0018-FIPS-disable-fipsinstall.patch | 6 +- 0019-FIPS-Force-fips-provider-on.patch | 6 +- ...TEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch | 20 +- ...CHECK-Add-script-to-hmac-ify-fips.so.patch | 4 +- ...HECK-Execute-KATS-before-HMAC-REVIEW.patch | 10 +- 0023-FIPS-RSA-encrypt-limits-REVIEW.patch | 8 +- 0024-FIPS-RSA-PCTs.patch | 10 +- 0025-FIPS-RSA-encapsulate-limits.patch | 10 +- ...S-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch | 4 +- 0027-FIPS-RSA-size-mode-restrictions.patch | 10 +- ...Mark-x931-as-not-approved-by-default.patch | 4 +- ...emove-X9.31-padding-signatures-tests.patch | 4 +- ...EWORK-FIPS-Use-OAEP-in-KATs-support-.patch | 4 +- ...PS-Deny-SHA-1-signature-verification.patch | 14 +- ...PS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch | 8 +- ...S-RAND-Forbid-truncated-hashes-SHA-3.patch | 276 ++++++++-------- ...S-PBKDF2-Set-minimum-password-length.patch | 4 +- 0035-FIPS-DH-PCT.patch | 4 +- ...H-Disable-FIPS-186-4-type-parameters.patch | 20 +- ...FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch | 16 +- ...FIPS-CMS-Set-default-padding-to-OAEP.patch | 6 +- 0039-FIPS-PKCS12-PBMAC1-defaults.patch | 4 +- ...PS-Fix-encoder-decoder-negative-test.patch | 4 +- 0041-FIPS-EC-DH-DSA-PCTs.patch | 12 +- 0042-FIPS-EC-disable-weak-curves.patch | 4 +- 0043-FIPS-NO-DSA-Support.patch | 32 +- 0044-FIPS-NO-DES-support.patch | 16 +- 0045-FIPS-NO-Kmac.patch | 12 +- ...e-tests-due-to-our-versioning-change.patch | 4 +- 0047-Current-Rebase-status.patch | 4 +- 0048-FIPS-KDF-key-lenght-errors.patch | 4 +- 0049-FIPS-fix-disallowed-digests-tests.patch | 4 +- ...-Make-openssl-speed-run-in-FIPS-mode.patch | 10 +- ...port-upstream-27483-for-PKCS11-needs.patch | 10 +- 0052-Red-Hat-9-FIPS-indicator-defines.patch | 4 +- 0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch | 40 +-- ...rily-disable-SLH-DSA-FIPS-self-tests.patch | 18 +- ...-define-to-disable-symver-attributes.patch | 16 +- ...kip-build-of-non-installable-program.patch | 24 +- ...S1.5-FIPS-POST-not-relevant-for-RHEL.patch | 8 +- 0058-asn1_d2i_read_bio_EOF.patch | 304 ------------------ ...clevel-2-if-rh-allow-sha1-signatures.patch | 39 +-- openssl.spec | 17 +- sources | 2 +- 62 files changed, 487 insertions(+), 830 deletions(-) delete mode 100644 0058-asn1_d2i_read_bio_EOF.patch diff --git a/.gitignore b/.gitignore index dfc91ad..8a54527 100644 --- a/.gitignore +++ b/.gitignore @@ -61,3 +61,4 @@ openssl-1.0.0a-usa.tar.bz2 /openssl-3.5.1.tar.gz /openssl-3.5.5.tar.gz /openssl-3.5.7.tar.gz +/openssl-3.5.8.tar.gz diff --git a/0001-RH-Aarch64-and-ppc64le-use-lib64.patch b/0001-RH-Aarch64-and-ppc64le-use-lib64.patch index e7da73a..57902d5 100644 --- a/0001-RH-Aarch64-and-ppc64le-use-lib64.patch +++ b/0001-RH-Aarch64-and-ppc64le-use-lib64.patch @@ -1,4 +1,4 @@ -From ad6ba90718f814f1db71e86a4156098eb2bbeef5 Mon Sep 17 00:00:00 2001 +From be9aad001bf7a45264a88f0f0f6504944369490b Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:14 +0100 Subject: [PATCH 01/57] RH: Aarch64 and ppc64le use lib64 @@ -14,10 +14,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 1 file changed, 2 insertions(+) diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf -index cba57b4127..3e327017ef 100644 +index 692eccbfa1..08918399e4 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf -@@ -726,6 +726,7 @@ my %targets = ( +@@ -727,6 +727,7 @@ my %targets = ( lib_cppflags => add("-DL_ENDIAN"), asm_arch => 'ppc64', perlasm_scheme => "linux64le", @@ -25,7 +25,7 @@ index cba57b4127..3e327017ef 100644 }, "linux-armv4" => { -@@ -768,6 +769,7 @@ my %targets = ( +@@ -769,6 +770,7 @@ my %targets = ( inherit_from => [ "linux-generic64" ], asm_arch => 'aarch64', perlasm_scheme => "linux64", @@ -34,5 +34,5 @@ index cba57b4127..3e327017ef 100644 "linux-arm64ilp32" => { # https://wiki.linaro.org/Platform/arm64-ilp32 inherit_from => [ "linux-generic32" ], -- -2.52.0 +2.55.0 diff --git a/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch b/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch index bcbc939..65b10d7 100644 --- a/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch +++ b/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch @@ -1,4 +1,4 @@ -From a10a60403c197128ea6d8076b5111c64594a5026 Mon Sep 17 00:00:00 2001 +From dc4488c19469cb95d7bb1c4f7ff62a5d57cdde95 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 6 Mar 2025 08:40:29 -0500 Subject: [PATCH 02/57] Add a separate config file to use for rpm installs @@ -452,5 +452,5 @@ index 0000000000..fe2346eb2b +cmd = rr +oldcert = $insta::certout # insta.cert.pem -- -2.52.0 +2.55.0 diff --git a/0003-RH-Do-not-install-html-docs.patch b/0003-RH-Do-not-install-html-docs.patch index 5f6117d..3b33bdb 100644 --- a/0003-RH-Do-not-install-html-docs.patch +++ b/0003-RH-Do-not-install-html-docs.patch @@ -1,4 +1,4 @@ -From 44f15e373a78a1fb01edf15e7530cea4c8a1b79b Mon Sep 17 00:00:00 2001 +From 7f7ac4e921f70a9cad079ca9475561f355c085bf Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:14 +0100 Subject: [PATCH 03/57] RH: Do not install html docs @@ -13,10 +13,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index 78be4a3199..962d1330bb 100644 +index 5bf397eba0..9a7d51ac1f 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -669,7 +669,7 @@ install_sw: install_dev install_engines install_modules install_runtime ## Insta +@@ -670,7 +670,7 @@ install_sw: install_dev install_engines install_modules install_runtime ## Insta uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev ## Uninstall the software and libraries @@ -26,5 +26,5 @@ index 78be4a3199..962d1330bb 100644 uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and HTML documentation $(RM) -r "$(DESTDIR)$(DOCDIR)" -- -2.52.0 +2.55.0 diff --git a/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch b/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch index 951849d..6f13b06 100644 --- a/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch +++ b/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch @@ -1,4 +1,4 @@ -From 3e60b46747eae0aec3171f13da6be706bcac6b48 Mon Sep 17 00:00:00 2001 +From 398109b4775fc42f1f5d1bdfc34068a51f2b7cc8 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:14 +0100 Subject: [PATCH 04/57] RH: apps ca fix md option help text.patch - DROP? @@ -26,5 +26,5 @@ index 02b00c7c03..7f77e069ab 100644 { "keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)" }, -- -2.52.0 +2.55.0 diff --git a/0005-RH-Disable-signature-verification-with-bad-digests-R.patch b/0005-RH-Disable-signature-verification-with-bad-digests-R.patch index d3d81a9..43322bb 100644 --- a/0005-RH-Disable-signature-verification-with-bad-digests-R.patch +++ b/0005-RH-Disable-signature-verification-with-bad-digests-R.patch @@ -1,4 +1,4 @@ -From 04f1fc282cd5f5e7a9fbf2d82a62a9810d2e4acc Mon Sep 17 00:00:00 2001 +From 2e5c5494f72433a7dc4f1979fb29ba7c7d5f1fc1 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:14 +0100 Subject: [PATCH 05/57] RH: Disable signature verification with bad digests - @@ -30,5 +30,5 @@ index 55f86ee83f..95483afc00 100644 const EVP_MD *type = NULL; -- -2.52.0 +2.55.0 diff --git a/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch b/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch index 8d7cae7..fd3ec3c 100644 --- a/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch +++ b/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch @@ -1,4 +1,4 @@ -From ced223dc078708514c65b1903c783062ec568bb7 Mon Sep 17 00:00:00 2001 +From 80977968258324654798a2cc7be3e8c56407004a Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:14 +0100 Subject: [PATCH 06/57] RH: Add support for PROFILE SYSTEM system default @@ -20,10 +20,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 7 files changed, 106 insertions(+), 15 deletions(-) diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index 962d1330bb..1920d38655 100644 +index 9a7d51ac1f..dc5811f639 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -355,6 +355,10 @@ MANDIR=$(INSTALLTOP)/share/man +@@ -356,6 +356,10 @@ MANDIR=$(INSTALLTOP)/share/man DOCDIR=$(INSTALLTOP)/share/doc/$(BASENAME) HTMLDIR=$(DOCDIR)/html @@ -34,7 +34,7 @@ index 962d1330bb..1920d38655 100644 # MANSUFFIX is for the benefit of anyone who may want to have a suffix # appended after the manpage file section number. "ssl" is popular, # resulting in files such as config.5ssl rather than config.5. -@@ -378,6 +382,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -} +@@ -379,6 +383,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -} CXX={- $config{CXX} ? "\$(CROSS_COMPILE)$config{CXX}" : '' -} CPPFLAGS={- our $cppflags1 = join(" ", (map { "-D".$_} @{$config{CPPDEFINES}}), @@ -43,7 +43,7 @@ index 962d1330bb..1920d38655 100644 @{$config{CPPFLAGS}}) -} CFLAGS={- join(' ', @{$config{CFLAGS}}) -} diff --git a/Configure b/Configure -index 499585438a..e1b908fe13 100755 +index 1b020faadb..407cca1656 100755 --- a/Configure +++ b/Configure @@ -27,7 +27,7 @@ use OpenSSL::config; @@ -66,7 +66,7 @@ index 499585438a..e1b908fe13 100755 # --banner=".." Output specified text instead of default completion banner # # -w Don't wait after showing a Configure warning -@@ -409,6 +413,7 @@ $config{prefix}=""; +@@ -414,6 +418,7 @@ $config{prefix}=""; $config{openssldir}=""; $config{processor}=""; $config{libdir}=""; @@ -74,7 +74,7 @@ index 499585438a..e1b908fe13 100755 my $auto_threads=1; # enable threads automatically? true by default my $default_ranlib; -@@ -1105,6 +1110,10 @@ while (@argvcopy) +@@ -1110,6 +1115,10 @@ while (@argvcopy) die "FIPS key too long (64 bytes max)\n" if length $1 > 64; } @@ -86,10 +86,10 @@ index 499585438a..e1b908fe13 100755 { $banner = $1 . "\n"; diff --git a/doc/man1/openssl-ciphers.pod.in b/doc/man1/openssl-ciphers.pod.in -index 69195bcdcb..a6e0ede570 100644 +index e1f9845cee..2496d011aa 100644 --- a/doc/man1/openssl-ciphers.pod.in +++ b/doc/man1/openssl-ciphers.pod.in -@@ -189,6 +189,15 @@ As of OpenSSL 1.0.0, the B cipher suites are sensibly ordered by default. +@@ -190,6 +190,15 @@ As of OpenSSL 1.0.0, the B cipher suites are sensibly ordered by default. The cipher suites not enabled by B, currently B. @@ -106,7 +106,7 @@ index 69195bcdcb..a6e0ede570 100644 "High" encryption cipher suites. This currently means those with key lengths diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in -index bdcc68529b..82410670f4 100644 +index 90be33cb4f..81f6a19ce7 100644 --- a/include/openssl/ssl.h.in +++ b/include/openssl/ssl.h.in @@ -211,6 +211,11 @@ extern "C" { @@ -122,7 +122,7 @@ index bdcc68529b..82410670f4 100644 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ #define SSL_SENT_SHUTDOWN 1 diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c -index 7dccec6260..15be7e8067 100644 +index fd2c4b0833..cce1dde0dc 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -9,6 +9,7 @@ @@ -133,7 +133,7 @@ index 7dccec6260..15be7e8067 100644 #include #include #include -@@ -1404,6 +1405,49 @@ int SSL_set_ciphersuites(SSL *s, const char *str) +@@ -1408,6 +1409,49 @@ int SSL_set_ciphersuites(SSL *s, const char *str) return ret; } @@ -183,7 +183,7 @@ index 7dccec6260..15be7e8067 100644 STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, STACK_OF(SSL_CIPHER) *tls13_ciphersuites, STACK_OF(SSL_CIPHER) **cipher_list, -@@ -1418,15 +1462,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1422,15 +1466,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr; const SSL_CIPHER **ca_list = NULL; const SSL_METHOD *ssl_method = ctx->method; @@ -211,7 +211,7 @@ index 7dccec6260..15be7e8067 100644 /* * To reduce the work to do we only want to process the compiled -@@ -1448,7 +1502,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1452,7 +1506,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, if (num_of_ciphers > 0) { co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers); if (co_list == NULL) @@ -220,7 +220,7 @@ index 7dccec6260..15be7e8067 100644 } ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, -@@ -1514,8 +1568,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1518,8 +1572,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, * in force within each class */ if (!ssl_cipher_strength_sort(&head, &tail)) { @@ -230,7 +230,7 @@ index 7dccec6260..15be7e8067 100644 } /* -@@ -1559,8 +1612,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1563,8 +1616,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1; ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max); if (ca_list == NULL) { @@ -240,7 +240,7 @@ index 7dccec6260..15be7e8067 100644 } ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mkey, disabled_auth, disabled_enc, -@@ -1585,9 +1637,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1589,9 +1641,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, OPENSSL_free(ca_list); /* Not needed anymore */ @@ -252,7 +252,7 @@ index 7dccec6260..15be7e8067 100644 } /* -@@ -1595,10 +1646,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1599,10 +1650,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, * if we cannot get one. */ if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) { @@ -268,7 +268,7 @@ index 7dccec6260..15be7e8067 100644 /* Add TLSv1.3 ciphers first - we always prefer those if possible */ for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) { const SSL_CIPHER *sslc = sk_SSL_CIPHER_value(tls13_ciphersuites, i); -@@ -1653,6 +1707,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1657,6 +1711,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, *cipher_list = cipherstack; return cipherstack; @@ -283,7 +283,7 @@ index 7dccec6260..15be7e8067 100644 char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c -index ac77faa677..677b05ba64 100644 +index ba494f5fc0..e8207e1ee9 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -678,7 +678,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) @@ -295,7 +295,7 @@ index ac77faa677..677b05ba64 100644 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); return 0; -@@ -4102,7 +4102,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, +@@ -4100,7 +4100,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, if (!ssl_create_cipher_list(ret, ret->tls13_ciphersuites, &ret->cipher_list, &ret->cipher_list_by_id, @@ -305,10 +305,10 @@ index ac77faa677..677b05ba64 100644 ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS); goto err; diff --git a/test/cipherlist_test.c b/test/cipherlist_test.c -index 9874e6bad6..76b6befbad 100644 +index 921afe6234..be2c382f85 100644 --- a/test/cipherlist_test.c +++ b/test/cipherlist_test.c -@@ -260,7 +260,9 @@ end: +@@ -312,7 +312,9 @@ end: int setup_tests(void) { @@ -319,5 +319,5 @@ index 9874e6bad6..76b6befbad 100644 ADD_TEST(test_default_cipherlist_clear); #ifndef OPENSSL_NO_TLS1_3 -- -2.52.0 +2.55.0 diff --git a/0007-RH-Add-FIPS_mode-compatibility-macro.patch b/0007-RH-Add-FIPS_mode-compatibility-macro.patch index e84a405..4f39777 100644 --- a/0007-RH-Add-FIPS_mode-compatibility-macro.patch +++ b/0007-RH-Add-FIPS_mode-compatibility-macro.patch @@ -1,4 +1,4 @@ -From 60f55f072544cb998c42da41ee33ced2b4428b9f Mon Sep 17 00:00:00 2001 +From 005e6daf6097a420efdb869e641f2708a9d0c551 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 07/57] RH: Add FIPS_mode compatibility macro @@ -79,5 +79,5 @@ index d470731e50..0b044ec853 100644 ADD_TEST(test_property_list_to_string_bounds); return 1; -- -2.52.0 +2.55.0 diff --git a/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch b/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch index 5a406c3..2c2f141 100644 --- a/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch +++ b/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch @@ -1,4 +1,4 @@ -From 5aa108caf01f482d35aba7acae6b5a8fa1577410 Mon Sep 17 00:00:00 2001 +From d3013b93461e421ac5d13b1bd74dc8478d84cd94 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 08/57] RH: Add Kernel FIPS mode flag support - FIXSTYLE @@ -90,5 +90,5 @@ index 1b4050a81f..eb7f409af0 100644 #endif -- -2.52.0 +2.55.0 diff --git a/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch b/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch index 9e988c8..35ff1df 100644 --- a/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch +++ b/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch @@ -1,4 +1,4 @@ -From 8f48c77eb1c8f3e59d4d80041893a1dbf3e1a257 Mon Sep 17 00:00:00 2001 +From abb90da4c709dab8c919dde2f73d5643da95a332 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 09/57] RH: Drop weak curve definitions - RENAMED/SQUASHED @@ -28,7 +28,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 8 files changed, 10 insertions(+), 1083 deletions(-) diff --git a/apps/speed.c b/apps/speed.c -index a8d7cb14f5..13c8505ed9 100644 +index 6cf9748902..a36faa686d 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -458,8 +458,6 @@ static double ffdh_results[FFDH_NUM][1]; /* 1 op: derivation */ @@ -68,7 +68,7 @@ index a8d7cb14f5..13c8505ed9 100644 { "nistp256", NID_X9_62_prime256v1, 256 }, { "nistp384", NID_secp384r1, 384 }, diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c -index c17a7e5477..c6455ff691 100644 +index c3bc92fd75..28c83df735 100644 --- a/crypto/ec/ec_curve.c +++ b/crypto/ec/ec_curve.c @@ -30,34 +30,6 @@ typedef struct { @@ -799,7 +799,7 @@ index c17a7e5477..c6455ff691 100644 static const struct { EC_CURVE_DATA h; unsigned char data[0 + 32 * 6]; -@@ -2740,8 +2047,6 @@ static const ec_list_element curve_list[] = { +@@ -2570,8 +1877,6 @@ static const ec_list_element curve_list[] = { "NIST/SECG curve over a 521 bit prime field" }, /* X9.62 curves */ @@ -808,7 +808,7 @@ index c17a7e5477..c6455ff691 100644 { NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, #if defined(ECP_NISTZ256_ASM) EC_GFp_nistz256_method, -@@ -2784,26 +2089,6 @@ static const ec_list_element curve_list[] = { +@@ -2614,26 +1919,6 @@ static const ec_list_element curve_list[] = { static const ec_list_element curve_list[] = { /* prime field curves */ @@ -835,7 +835,7 @@ index c17a7e5477..c6455ff691 100644 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 { NID_secp224r1, &_EC_NIST_PRIME_224.h, EC_GFp_nistp224_method, "NIST/SECG curve over a 224 bit prime field" }, -@@ -2833,18 +2118,6 @@ static const ec_list_element curve_list[] = { +@@ -2663,18 +1948,6 @@ static const ec_list_element curve_list[] = { #endif "NIST/SECG curve over a 521 bit prime field" }, /* X9.62 curves */ @@ -854,7 +854,7 @@ index c17a7e5477..c6455ff691 100644 { NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, #if defined(ECP_NISTZ256_ASM) EC_GFp_nistz256_method, -@@ -2928,36 +2201,6 @@ static const ec_list_element curve_list[] = { +@@ -2758,36 +2031,6 @@ static const ec_list_element curve_list[] = { "X9.62 curve over a 368 bit binary field" }, { NID_X9_62_c2tnb431r1, &_EC_X9_62_CHAR2_431R1.h, 0, "X9.62 curve over a 431 bit binary field" }, @@ -891,7 +891,7 @@ index c17a7e5477..c6455ff691 100644 /* IPSec curves */ { NID_ipsec3, &_EC_IPSEC_155_ID3.h, 0, "\n\tIPSec/IKE/Oakley curve #3 over a 155 bit binary field.\n" -@@ -2967,18 +2210,6 @@ static const ec_list_element curve_list[] = { +@@ -2797,18 +2040,6 @@ static const ec_list_element curve_list[] = { "\tNot suitable for ECDSA.\n\tQuestionable extension field!" }, #endif /* brainpool curves */ @@ -1080,7 +1080,7 @@ index 700d7b5253..6aa4faa461 100644 { NID_secp224r1, NID_sha224, "699325d6fc8fbbb4981a6ded3c3a54ad2e4e3db8a5669201912064c64e700c139248cdc1" diff --git a/test/ectest.c b/test/ectest.c -index 0233f870b6..f243f6fb3c 100644 +index 1e4ae9c63e..56cfc99421 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -174,183 +174,26 @@ static int prime_field_tests(void) @@ -1275,7 +1275,7 @@ index 0233f870b6..f243f6fb3c 100644 "FFFFFFFF000000000000000000000001")) || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL)) || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFF" -@@ -3522,7 +3365,7 @@ int setup_tests(void) +@@ -3107,7 +2950,7 @@ int setup_tests(void) ADD_TEST(parameter_test); ADD_TEST(ossl_parameter_test); @@ -1344,5 +1344,5 @@ index e6a2c9eb59..861c01e177 100644 Ctrl = key-check:0 +Result = KEYGEN_GENERATE_ERROR -- -2.52.0 +2.55.0 diff --git a/0010-RH-Disable-explicit-ec-curves.patch b/0010-RH-Disable-explicit-ec-curves.patch index 29acf36..ebe7127 100644 --- a/0010-RH-Disable-explicit-ec-curves.patch +++ b/0010-RH-Disable-explicit-ec-curves.patch @@ -1,4 +1,4 @@ -From a925f827ebbd25236c7449e179cfcd716af60379 Mon Sep 17 00:00:00 2001 +From 1c73ee172cf5c48088b0f939dc75f3ce9d9f525a Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 10/57] RH: Disable explicit ec curves @@ -18,7 +18,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 5 files changed, 45 insertions(+), 38 deletions(-) diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c -index bfd0242c6f..bb462121b5 100644 +index 6b44b8068f..bb0d743e73 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -889,6 +889,12 @@ EC_GROUP *d2i_ECPKParameters(EC_GROUP **a, const unsigned char **in, long len) @@ -47,10 +47,10 @@ index bfd0242c6f..bb462121b5 100644 if (priv_key->privateKey) { diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c -index 13dcd29b11..de21cb2f10 100644 +index e29e39aca5..8cd2b8709c 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c -@@ -1551,7 +1551,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], +@@ -1553,7 +1553,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], int is_prime_field = 1; BN_CTX *bnctx = NULL; const unsigned char *buf = NULL; @@ -59,7 +59,7 @@ index 13dcd29b11..de21cb2f10 100644 #endif /* This is the simple named group case */ -@@ -1726,6 +1726,11 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], +@@ -1729,6 +1729,11 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], goto err; } if (named_group == group) { @@ -71,7 +71,7 @@ index 13dcd29b11..de21cb2f10 100644 /* * If we did not find a named group then the encoding should be explicit * if it was specified -@@ -1741,6 +1746,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], +@@ -1744,6 +1749,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], goto err; } EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE); @@ -80,10 +80,10 @@ index 13dcd29b11..de21cb2f10 100644 EC_GROUP_free(group); group = named_group; diff --git a/test/ectest.c b/test/ectest.c -index f243f6fb3c..d8246524f3 100644 +index 56cfc99421..045739617c 100644 --- a/test/ectest.c +++ b/test/ectest.c -@@ -2791,11 +2791,12 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, +@@ -2376,11 +2376,12 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)) || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) @@ -98,7 +98,7 @@ index f243f6fb3c..d8246524f3 100644 /*- Check that all the set values are retrievable -*/ /* There should be no match to a group name since the generator changed */ -@@ -2924,6 +2925,7 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, +@@ -2509,6 +2510,7 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, #endif ) goto err; @@ -106,7 +106,7 @@ index f243f6fb3c..d8246524f3 100644 ret = 1; err: BN_free(order_out); -@@ -3217,21 +3219,21 @@ static int custom_params_test(int id) +@@ -2802,21 +2804,21 @@ static int custom_params_test(int id) /* Compute keyexchange in both directions */ if (!TEST_ptr(pctx1 = EVP_PKEY_CTX_new(pkey1, NULL)) @@ -135,7 +135,7 @@ index f243f6fb3c..d8246524f3 100644 /* Both sides should expect the same shared secret */ if (!TEST_mem_eq(buf1, sslen, buf2, t)) goto err; -@@ -3286,7 +3288,7 @@ static int custom_params_test(int id) +@@ -2871,7 +2873,7 @@ static int custom_params_test(int id) /* compare with previous result */ || !TEST_mem_eq(buf1, t, buf2, sslen)) goto err; @@ -145,10 +145,10 @@ index f243f6fb3c..d8246524f3 100644 err: diff --git a/test/endecode_test.c b/test/endecode_test.c -index 3f8ed7f392..c3b55af3e7 100644 +index 64701d32b8..93347bed40 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c -@@ -63,7 +63,7 @@ static BN_CTX *bnctx = NULL; +@@ -64,7 +64,7 @@ static BN_CTX *bnctx = NULL; static OSSL_PARAM_BLD *bld_prime_nc = NULL; static OSSL_PARAM_BLD *bld_prime = NULL; static OSSL_PARAM *ec_explicit_prime_params_nc = NULL; @@ -157,7 +157,7 @@ index 3f8ed7f392..c3b55af3e7 100644 #ifndef OPENSSL_NO_EC2M static OSSL_PARAM_BLD *bld_tri_nc = NULL; -@@ -1013,10 +1013,10 @@ IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC") +@@ -1430,10 +1430,10 @@ IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC") DOMAIN_KEYS(ECExplicitPrimeNamedCurve); IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve, "EC") @@ -172,7 +172,7 @@ index 3f8ed7f392..c3b55af3e7 100644 DOMAIN_KEYS(ECExplicitTriNamedCurve); IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve, "EC") -@@ -1458,8 +1458,8 @@ int setup_tests(void) +@@ -1853,8 +1853,8 @@ int setup_tests(void) || !create_ec_explicit_prime_params_namedcurve(bld_prime_nc) || !create_ec_explicit_prime_params(bld_prime) || !TEST_ptr(ec_explicit_prime_params_nc = OSSL_PARAM_BLD_to_param(bld_prime_nc)) @@ -183,9 +183,9 @@ index 3f8ed7f392..c3b55af3e7 100644 || !TEST_ptr(bld_tri_nc = OSSL_PARAM_BLD_new()) || !TEST_ptr(bld_tri = OSSL_PARAM_BLD_new()) || !create_ec_explicit_trinomial_params_namedcurve(bld_tri_nc) -@@ -1486,8 +1486,8 @@ int setup_tests(void) - TEST_info("Generating EC keys..."); +@@ -1883,8 +1883,8 @@ int setup_tests(void) MAKE_DOMAIN_KEYS(EC, "EC", EC_params); + #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES MAKE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve, "EC", ec_explicit_prime_params_nc); - MAKE_DOMAIN_KEYS(ECExplicitPrime2G, "EC", ec_explicit_prime_params_explicit); -#ifndef OPENSSL_NO_EC2M @@ -194,8 +194,8 @@ index 3f8ed7f392..c3b55af3e7 100644 MAKE_DOMAIN_KEYS(ECExplicitTriNamedCurve, "EC", ec_explicit_tri_params_nc); MAKE_DOMAIN_KEYS(ECExplicitTri2G, "EC", ec_explicit_tri_params_explicit); #endif -@@ -1566,9 +1566,9 @@ int setup_tests(void) - ADD_TEST_SUITE_LEGACY(EC); +@@ -1970,9 +1970,9 @@ int setup_tests(void) + #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES ADD_TEST_SUITE(ECExplicitPrimeNamedCurve); ADD_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve); - ADD_TEST_SUITE(ECExplicitPrime2G); @@ -207,18 +207,18 @@ index 3f8ed7f392..c3b55af3e7 100644 ADD_TEST_SUITE(ECExplicitTriNamedCurve); ADD_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve); ADD_TEST_SUITE(ECExplicitTri2G); -@@ -1644,7 +1644,7 @@ void cleanup_tests(void) - { +@@ -2058,7 +2058,7 @@ void cleanup_tests(void) #ifndef OPENSSL_NO_EC + #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES OSSL_PARAM_free(ec_explicit_prime_params_nc); - OSSL_PARAM_free(ec_explicit_prime_params_explicit); +/* OSSL_PARAM_free(ec_explicit_prime_params_explicit);*/ OSSL_PARAM_BLD_free(bld_prime_nc); OSSL_PARAM_BLD_free(bld_prime); #ifndef OPENSSL_NO_EC2M -@@ -1666,8 +1666,8 @@ void cleanup_tests(void) - #ifndef OPENSSL_NO_EC +@@ -2082,8 +2082,8 @@ void cleanup_tests(void) FREE_DOMAIN_KEYS(EC); + #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES FREE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve); - FREE_DOMAIN_KEYS(ECExplicitPrime2G); -#ifndef OPENSSL_NO_EC2M @@ -251,5 +251,5 @@ index 07dc4b4298..4c47fa68c2 100644 -----BEGIN PRIVATE KEY----- MGMCAQAwEAYHKoZIzj0CAQYFK4EEAA8ETDBKAgEBBBUDnQW0mLiHVha/jqFznX/K -- -2.52.0 +2.55.0 diff --git a/0011-RH-skipped-tests-EC-curves.patch b/0011-RH-skipped-tests-EC-curves.patch index 5d2d1b5..5d9fc3e 100644 --- a/0011-RH-skipped-tests-EC-curves.patch +++ b/0011-RH-skipped-tests-EC-curves.patch @@ -1,4 +1,4 @@ -From 2afc42b7faa263387234aa747d676efd140a7c8a Mon Sep 17 00:00:00 2001 +From c607becfce55f1b62e8afc0ceebeab08e193036f Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 11/57] RH: skipped tests EC curves @@ -78,5 +78,5 @@ index f722800e27..26a01786bb 100644 my @basic_cmd = ("cmp_vfy_test", data_file("server.crt"), data_file("client.crt"), -- -2.52.0 +2.55.0 diff --git a/0012-RH-skip-quic-pairwise.patch b/0012-RH-skip-quic-pairwise.patch index 19fe4a2..a711a00 100644 --- a/0012-RH-skip-quic-pairwise.patch +++ b/0012-RH-skip-quic-pairwise.patch @@ -1,4 +1,4 @@ -From 48b4a63db033730ef98eb9968e45ba66688598c9 Mon Sep 17 00:00:00 2001 +From 263e1761f11b392337a4bbff6658b97fd7a65ae2 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Thu, 7 Mar 2024 17:37:09 +0100 Subject: [PATCH 12/57] RH: skip quic pairwise @@ -8,16 +8,16 @@ Patch-id: 115 Patch-status: | # skip quic and pairwise tests temporarily --- - test/quicapitest.c | 4 +++- - test/recipes/01-test_symbol_presence.t | 1 + - test/recipes/30-test_pairwise_fail.t | 10 ++++++++-- - 3 files changed, 12 insertions(+), 3 deletions(-) + test/quicapitest.c | 4 +++- + test/recipes/01-test_symbol_presence.t | 1 + + test/recipes/30-test_pairwise_fail.t | 6 ++++-- + 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/test/quicapitest.c b/test/quicapitest.c -index 6b9ee8e69a..96cd735819 100644 +index fd950772c8..2c489f528f 100644 --- a/test/quicapitest.c +++ b/test/quicapitest.c -@@ -3015,7 +3015,9 @@ int setup_tests(void) +@@ -3287,7 +3287,9 @@ int setup_tests(void) ADD_TEST(test_cipher_find); ADD_TEST(test_version); #if defined(DO_SSL_TRACE_TEST) @@ -41,38 +41,22 @@ index 6c8de64b0b..79a5584099 100644 note "Duplicates:"; note join('\n', @duplicates); diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t -index eaf0dbbb42..21864ad319 100644 +index 1b3269a982..6455f3de8b 100644 --- a/test/recipes/30-test_pairwise_fail.t +++ b/test/recipes/30-test_pairwise_fail.t -@@ -9,7 +9,7 @@ - use strict; - use warnings; +@@ -37,8 +37,10 @@ SKIP: { + } --use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file); -+use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file with); - use OpenSSL::Test::Utils; - - BEGIN { -@@ -39,20 +39,26 @@ SKIP: { SKIP: { - skip "Skip EC test because of no ec in this build", 2 - if disabled("ec"); -+ with({ exit_checker => sub {my $val = shift; return $val == 134; } }, -+ sub { ++ use Config; ++ my $is_s390 = ($Config{archname} =~ /^s390/) ? 1 : 0; + skip "Skip EC test because of no ec in this build", 1 +- if disabled("ec"); ++ if (disabled("ec") || $is_s390); ok(run(test(["pairwise_fail_test", "-config", $provconf, "-pairwise", "ec"])), "fips provider ec keygen pairwise failure test"); -+ }); - - skip "FIPS provider version is too old", 1 - if !$fips_exit; -+ with({ exit_checker => sub {my $val = shift; return $val == 134; } }, -+ sub { - ok(run(test(["pairwise_fail_test", "-config", $provconf, - "-pairwise", "eckat"])), - "fips provider ec keygen kat failure test"); -+ }); - } +@@ -46,7 +48,7 @@ SKIP: { SKIP: { skip "Skip DSA tests because of no dsa in this build", 2 @@ -82,5 +66,5 @@ index eaf0dbbb42..21864ad319 100644 "-pairwise", "dsa", "-dsaparam", data_file("dsaparam.pem")])), "fips provider dsa keygen pairwise failure test"); -- -2.52.0 +2.55.0 diff --git a/0013-RH-version-aliasing.patch b/0013-RH-version-aliasing.patch index 6fcb250..d83c8a5 100644 --- a/0013-RH-version-aliasing.patch +++ b/0013-RH-version-aliasing.patch @@ -1,4 +1,4 @@ -From 9a41889c1a026e203f936e0c3b511e6d4ddc4cf2 Mon Sep 17 00:00:00 2001 +From af4e864805feef1a6431bde880ddb6b09c5f1a1f Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 13/57] RH: version aliasing @@ -17,7 +17,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c -index 4b1c95c4ab..8a6e87c11a 100644 +index 224f3000ce..7f0d77ab69 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -572,7 +572,12 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size) @@ -35,10 +35,10 @@ index 4b1c95c4ab..8a6e87c11a 100644 EVP_MD_CTX *out = EVP_MD_CTX_new(); diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c -index 5584e06d7e..d5ff34a4e2 100644 +index 109412b342..b4cfe2b809 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c -@@ -1756,7 +1756,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) +@@ -1766,7 +1766,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) #endif /* FIPS_MODULE */ } @@ -79,5 +79,5 @@ index ceb4948839..eab3987a6b 100644 BN_signed_bn2bin 5568 3_2_0 EXIST::FUNCTION: BN_signed_lebin2bn 5569 3_2_0 EXIST::FUNCTION: -- -2.52.0 +2.55.0 diff --git a/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch b/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch index 32f3c18..3558d99 100644 --- a/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch +++ b/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch @@ -1,4 +1,4 @@ -From 51d485de6b9e2a714610daa886bde82b45016c0a Mon Sep 17 00:00:00 2001 +From 365f4de8ff84e3dc77551a0038652bb7973a18f2 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 13 Feb 2025 16:09:09 -0500 Subject: [PATCH 14/57] RH: Export two symbols for OPENSSL_str[n]casecmp @@ -17,7 +17,7 @@ with upstream. mode change 100644 => 100755 test/recipes/01-test_symbol_presence.t diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c -index 8a6e87c11a..638dac8844 100644 +index 7f0d77ab69..101f49862c 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -573,7 +573,7 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size) @@ -30,10 +30,10 @@ index 8a6e87c11a..638dac8844 100644 symver ("EVP_MD_CTX_dup@OPENSSL_3.2.0"))) #endif diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c -index d5ff34a4e2..b4edd825cd 100644 +index b4cfe2b809..30c2ec56dc 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c -@@ -1757,7 +1757,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) +@@ -1767,7 +1767,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) } EVP_CIPHER_CTX @@ -43,10 +43,10 @@ index d5ff34a4e2..b4edd825cd 100644 symver ("EVP_CIPHER_CTX_dup@OPENSSL_3.2.0"))) #endif diff --git a/crypto/o_str.c b/crypto/o_str.c -index 35540630be..fde43421ea 100644 +index 154393c7b3..b221ba789e 100644 --- a/crypto/o_str.c +++ b/crypto/o_str.c -@@ -406,7 +406,12 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen) +@@ -417,7 +417,12 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen) #endif } @@ -60,7 +60,7 @@ index 35540630be..fde43421ea 100644 { int t; -@@ -416,7 +421,12 @@ int OPENSSL_strcasecmp(const char *s1, const char *s2) +@@ -427,7 +432,12 @@ int OPENSSL_strcasecmp(const char *s1, const char *s2) return t; } @@ -104,5 +104,5 @@ index eab3987a6b..d377d542db 100644 RAND_set0_public 5559 3_1_0 EXIST::FUNCTION: RAND_set0_private 5560 3_1_0 EXIST::FUNCTION: -- -2.52.0 +2.55.0 diff --git a/0015-RH-TMP-KTLS-test-skip.patch b/0015-RH-TMP-KTLS-test-skip.patch index ffaa92b..c97b5f1 100644 --- a/0015-RH-TMP-KTLS-test-skip.patch +++ b/0015-RH-TMP-KTLS-test-skip.patch @@ -1,4 +1,4 @@ -From a6d43e2d94ba1f8ff57dfb403d9d70d9f6f0f433 Mon Sep 17 00:00:00 2001 +From 7db8402c2c44c585ee7e005d96cb715c144c6663 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 13 Feb 2025 18:11:19 -0500 Subject: [PATCH 15/57] RH: TMP KTLS test skip @@ -9,7 +9,7 @@ From-dist-git-commit: 83382cc2a09dfcc55d5740fd08fd95c2333a56c9 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/sslapitest.c b/test/sslapitest.c -index 993d9e6018..a94061d974 100644 +index ece9a59c82..f0aeaf8b89 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -1029,9 +1029,10 @@ end: @@ -26,5 +26,5 @@ index 993d9e6018..a94061d974 100644 static int ping_pong_query(SSL *clientssl, SSL *serverssl) -- -2.52.0 +2.55.0 diff --git a/0016-RH-Allow-disabling-of-SHA1-signatures.patch b/0016-RH-Allow-disabling-of-SHA1-signatures.patch index 08b87c3..a87d004 100644 --- a/0016-RH-Allow-disabling-of-SHA1-signatures.patch +++ b/0016-RH-Allow-disabling-of-SHA1-signatures.patch @@ -1,4 +1,4 @@ -From 1efe3493167934ee77a52eba9a6b2a492885a955 Mon Sep 17 00:00:00 2001 +From 2ba303329dd0f2a156a7a586ae81634ac779f01a Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Mon, 21 Aug 2023 13:07:07 +0200 Subject: [PATCH 16/57] RH: Allow disabling of SHA1 signatures @@ -172,7 +172,7 @@ index 184bab933c..2ae7ccea15 100644 ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION, "name=%s, value=%s", oval->name, oval->value); diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c -index 0a433adbe4..6c9f71569b 100644 +index 01f7e92393..67f07322d5 100644 --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c @@ -15,6 +15,7 @@ @@ -183,7 +183,7 @@ index 0a433adbe4..6c9f71569b 100644 static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) { -@@ -251,6 +252,19 @@ reinitialize: +@@ -253,6 +254,19 @@ reinitialize: } desc = signature->description != NULL ? signature->description : ""; @@ -277,7 +277,7 @@ index 1c181933e0..35bdfdb52d 100644 +#endif + diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h -index 50aec7e7f4..9678e150e0 100644 +index a4451ca9ee..67efc276c8 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -102,23 +102,24 @@ typedef struct ossl_ex_data_global_st { @@ -386,7 +386,7 @@ index 42823ffe14..4b80f14b40 100644 /* Disable the security checks in the default provider */ int ossl_fips_config_securitycheck_enabled(OSSL_LIB_CTX *libctx) diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c -index 51dcc3f230..31a89133a3 100644 +index 48237d7eb9..64e677015e 100644 --- a/providers/implementations/signature/dsa_sig.c +++ b/providers/implementations/signature/dsa_sig.c @@ -163,6 +163,7 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx, @@ -398,7 +398,7 @@ index 51dcc3f230..31a89133a3 100644 if (md == NULL) { ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST, diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c -index 0c04fc4ec6..2a4faf4a71 100644 +index 3ce4cd0d2a..758b11210e 100644 --- a/providers/implementations/signature/ecdsa_sig.c +++ b/providers/implementations/signature/ecdsa_sig.c @@ -197,13 +197,15 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, @@ -421,7 +421,7 @@ index 0c04fc4ec6..2a4faf4a71 100644 if (EVP_MD_xof(md)) { ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED); diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index fcdfebbbff..bbdd037728 100644 +index 4980474ac0..c92e7ca6ef 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -26,6 +26,7 @@ @@ -450,7 +450,7 @@ index fcdfebbbff..bbdd037728 100644 ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED, "digest=%s", mdname); goto err; -@@ -1760,8 +1763,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) +@@ -1785,8 +1788,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) prsactx->pad_mode = pad_mode; if (prsactx->md == NULL && pmdname == NULL @@ -467,7 +467,7 @@ index fcdfebbbff..bbdd037728 100644 if (pmgf1mdname != NULL && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops)) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c -index cd471a636d..35d0a6f1bb 100644 +index ef1114172a..d2d662b8ac 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -21,6 +21,7 @@ @@ -478,7 +478,7 @@ index cd471a636d..35d0a6f1bb 100644 #include "internal/nelem.h" #include "internal/sizes.h" #include "internal/tlsgroups.h" -@@ -2175,6 +2176,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) +@@ -2164,6 +2165,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) EVP_PKEY *tmpkey = EVP_PKEY_new(); int istls; int ret = 0; @@ -486,7 +486,7 @@ index cd471a636d..35d0a6f1bb 100644 if (ctx == NULL) goto err; -@@ -2192,6 +2194,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) +@@ -2181,6 +2183,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) goto err; ERR_set_mark(); @@ -494,7 +494,7 @@ index cd471a636d..35d0a6f1bb 100644 /* First fill cache and tls12_sigalgs list from legacy algorithm list */ for (i = 0, lu = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) { -@@ -2212,6 +2215,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) +@@ -2201,6 +2204,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) cache[i].available = 0; continue; } @@ -517,5 +517,5 @@ index d377d542db..c2c55129ae 100644 +ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION: +ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION: -- -2.52.0 +2.55.0 diff --git a/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch b/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch index 7ca651f..57627d6 100644 --- a/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch +++ b/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch @@ -1,4 +1,4 @@ -From 074607f7c460cda25654f1ee990ddba98af6d6db Mon Sep 17 00:00:00 2001 +From 9caf14916de441e5187e2bc7be6bfb638e784c29 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:12:33 -0500 Subject: [PATCH 17/57] FIPS: Red Hat's FIPS module name and version @@ -9,10 +9,10 @@ Signed-off-by: Simo Sorce 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c -index 419878719e..0f006301d7 100644 +index 3c749018bc..7928bd0e55 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c -@@ -201,13 +201,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[]) +@@ -200,13 +200,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[]) OSSL_LIB_CTX_FIPS_PROV_INDEX); p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME); @@ -30,5 +30,5 @@ index 419878719e..0f006301d7 100644 p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_STATUS); if (p != NULL && !OSSL_PARAM_set_int(p, ossl_prov_is_running())) -- -2.52.0 +2.55.0 diff --git a/0018-FIPS-disable-fipsinstall.patch b/0018-FIPS-disable-fipsinstall.patch index 15ff4ea..eb3b05a 100644 --- a/0018-FIPS-disable-fipsinstall.patch +++ b/0018-FIPS-disable-fipsinstall.patch @@ -1,4 +1,4 @@ -From e43a23f06a9e23f1091f88c6dfa6c1bd4e065a7a Mon Sep 17 00:00:00 2001 +From 4a470b2effd2473d876a85941b13a6318a500c4e Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 18/57] FIPS: disable fipsinstall @@ -530,7 +530,7 @@ index 2db5acd242..1c6b783413 100644 =head1 COPYRIGHT diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod -index 635b52aeb1..55bc6e44c6 100644 +index 1963715f38..0f8c415096 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -139,10 +139,6 @@ Engine (loadable module) information and manipulation. @@ -856,5 +856,5 @@ index 3dcbe67c6d..1a5a475d91 # Compatible options for pedantic FIPS compliance -- -2.52.0 +2.55.0 diff --git a/0019-FIPS-Force-fips-provider-on.patch b/0019-FIPS-Force-fips-provider-on.patch index afb8550..a961b81 100644 --- a/0019-FIPS-Force-fips-provider-on.patch +++ b/0019-FIPS-Force-fips-provider-on.patch @@ -1,4 +1,4 @@ -From b8a5ce1fbad62e0f7b023aab827d2888413d5ced Mon Sep 17 00:00:00 2001 +From 35bea414aee07bf83f41f16f9b583eeddf70b6ea Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 19/57] FIPS: Force fips provider on @@ -13,7 +13,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/crypto/provider_conf.c b/crypto/provider_conf.c -index f2e76ac402..a2a8a9942c 100644 +index f2e76ac402..d92827d3ba 100644 --- a/crypto/provider_conf.c +++ b/crypto/provider_conf.c @@ -10,6 +10,8 @@ @@ -75,5 +75,5 @@ index f2e76ac402..a2a8a9942c 100644 } -- -2.52.0 +2.55.0 diff --git a/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch b/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch index 1172c04..6d874a8 100644 --- a/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch +++ b/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch @@ -1,4 +1,4 @@ -From 310346f65db4e3b6052cf165f890f13bfd645f5c Mon Sep 17 00:00:00 2001 +From e05d344de7e39e184823b99cfa641737c9d8f940 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 20/57] FIPS: INTEG-CHECK: Embed hmac in fips.so - NOTE @@ -20,10 +20,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce create mode 100644 test/fipsmodule.cnf diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c -index 008a4fac84..c72e2605c4 100644 +index aa5a8c7658..34eff75efd 100644 --- a/providers/fips/self_test.c +++ b/providers/fips/self_test.c -@@ -237,13 +237,137 @@ err: +@@ -239,13 +239,137 @@ err: return ok; } @@ -162,7 +162,7 @@ index 008a4fac84..c72e2605c4 100644 OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev, const char *event_type) { -@@ -255,6 +379,9 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex +@@ -257,6 +381,9 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex EVP_MAC_CTX *ctx = NULL; OSSL_PARAM params[2], *p = params; @@ -172,7 +172,7 @@ index 008a4fac84..c72e2605c4 100644 if (!integrity_self_test(ev, libctx)) goto err; -@@ -318,7 +445,8 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -320,7 +447,8 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) int ok = 0; long checksum_len; OSSL_CORE_BIO *bio_module = NULL; @@ -182,7 +182,7 @@ index 008a4fac84..c72e2605c4 100644 OSSL_SELF_TEST *ev = NULL; EVP_RAND *testrand = NULL; EVP_RAND_CTX *rng; -@@ -354,8 +482,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -356,8 +484,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) return 0; } @@ -192,7 +192,7 @@ index 008a4fac84..c72e2605c4 100644 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CONFIG_DATA); goto end; } -@@ -364,8 +491,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -366,8 +493,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) if (ev == NULL) goto end; @@ -210,7 +210,7 @@ index 008a4fac84..c72e2605c4 100644 if (module_checksum == NULL) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CONFIG_DATA); goto end; -@@ -373,14 +507,28 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -375,14 +509,28 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) bio_module = (*st->bio_new_file_cb)(st->module_filename, "rb"); /* Always check the integrity of the fips module */ @@ -243,7 +243,7 @@ index 008a4fac84..c72e2605c4 100644 if (!SELF_TEST_kats(ev, st->libctx)) { ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_KAT_FAILURE); goto end; -@@ -401,7 +549,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -403,7 +551,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) end: EVP_RAND_free(testrand); OSSL_SELF_TEST_free(ev); @@ -261,5 +261,5 @@ index 0000000000..f05d0dedbe +[fips_sect] +activate = 1 -- -2.52.0 +2.55.0 diff --git a/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch b/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch index c67b18c..67654b0 100644 --- a/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch +++ b/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch @@ -1,4 +1,4 @@ -From 7fb0257ff4158f41306b730e0b2851bcd6d22747 Mon Sep 17 00:00:00 2001 +From c98ce75030b35047955a8f531a02eb3efb220b65 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 20 Feb 2025 15:30:32 -0500 Subject: [PATCH 21/57] FIPS: INTEG-CHECK: Add script to hmac-ify fips.so @@ -28,5 +28,5 @@ index 0000000000..54ae60b07f +objcopy --update-section .rodata1=providers/fips.so.hmac providers/fips.so providers/fips.so.mac +mv providers/fips.so.mac providers/fips.so -- -2.52.0 +2.55.0 diff --git a/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch b/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch index 33aa3ef..557cce1 100644 --- a/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch +++ b/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch @@ -1,4 +1,4 @@ -From a155bf631d4d923ed08f554344c44d07571d6e02 Mon Sep 17 00:00:00 2001 +From f63a893a787ce689ac83803dbe7fdc6b3a12fc50 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 22/57] FIPS: INTEG-CHECK: Execute KATS before HMAC - REVIEW @@ -13,10 +13,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c -index c72e2605c4..470cf1fc28 100644 +index 34eff75efd..2fa1e5fe7e 100644 --- a/providers/fips/self_test.c +++ b/providers/fips/self_test.c -@@ -491,6 +491,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -493,6 +493,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) if (ev == NULL) goto end; @@ -32,7 +32,7 @@ index c72e2605c4..470cf1fc28 100644 if (st->module_checksum_data == NULL) { module_checksum = fips_hmac_container; checksum_len = sizeof(fips_hmac_container); -@@ -529,11 +538,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -531,11 +540,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) } } @@ -45,5 +45,5 @@ index c72e2605c4..470cf1fc28 100644 rng = ossl_rand_get0_private_noncreating(st->libctx); if (rng != NULL) -- -2.52.0 +2.55.0 diff --git a/0023-FIPS-RSA-encrypt-limits-REVIEW.patch b/0023-FIPS-RSA-encrypt-limits-REVIEW.patch index 0e42771..d697481 100644 --- a/0023-FIPS-RSA-encrypt-limits-REVIEW.patch +++ b/0023-FIPS-RSA-encrypt-limits-REVIEW.patch @@ -1,4 +1,4 @@ -From 97d32c648aa0ba85165f40a9b9fca194301420fa Mon Sep 17 00:00:00 2001 +From bcbaf975d5032243565c88d285418b710854942d Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 23/57] FIPS: RSA: encrypt limits - REVIEW @@ -911,7 +911,7 @@ index 18e11bdaa9..17ceb59148 100644 Ctrl = rsa_padding_mode:oaep Ctrl = rsa_mgf1_md:sha1 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index 279a498475..c278987186 100644 +index b27a03d601..b94f5389c0 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -267,7 +267,7 @@ my @smime_pkcs7_tests = ( @@ -923,7 +923,7 @@ index 279a498475..c278987186 100644 [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-aes256", "-stream", "-out", "{output}.cms", $smrsa1, -@@ -1284,6 +1284,9 @@ sub check_availability { +@@ -1363,6 +1363,9 @@ sub check_availability { return "$tnam: skipped, DSA disabled\n" if ($no_dsa && $tnam =~ / DSA/); @@ -981,5 +981,5 @@ index f7be2e1872..568a1ddba4 } next if $protocol eq "-tls1_3"; -- -2.52.0 +2.55.0 diff --git a/0024-FIPS-RSA-PCTs.patch b/0024-FIPS-RSA-PCTs.patch index 59913f1..2bee4b0 100644 --- a/0024-FIPS-RSA-PCTs.patch +++ b/0024-FIPS-RSA-PCTs.patch @@ -1,4 +1,4 @@ -From 034d02d047e4a4d84d5c8ca2b54557b1679e8610 Mon Sep 17 00:00:00 2001 +From bdb0ecbad71078d147cd3879f27468d53abb01fe Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 24 Mar 2025 10:50:37 -0400 Subject: [PATCH 24/57] FIPS: RSA: PCTs @@ -67,7 +67,7 @@ index 3582936d67..383c3071a9 100644 BN_clear_free(gctx->pub_exp); OPENSSL_free(gctx); diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index bbdd037728..4e0744eeba 100644 +index c92e7ca6ef..f5a04a32ed 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -37,7 +37,7 @@ @@ -97,7 +97,7 @@ index bbdd037728..4e0744eeba 100644 { PROV_RSA_CTX *prsactx = NULL; char *propq_copy = NULL; -@@ -1309,7 +1309,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig, +@@ -1334,7 +1334,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig, return ok; } @@ -106,7 +106,7 @@ index bbdd037728..4e0744eeba 100644 { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; -@@ -1861,6 +1861,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx) +@@ -1886,6 +1886,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx) return EVP_MD_settable_ctx_params(prsactx->md); } @@ -153,5 +153,5 @@ index bbdd037728..4e0744eeba 100644 { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))rsa_newctx }, { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))rsa_sign_init }, -- -2.52.0 +2.55.0 diff --git a/0025-FIPS-RSA-encapsulate-limits.patch b/0025-FIPS-RSA-encapsulate-limits.patch index 6a78869..1ef9891 100644 --- a/0025-FIPS-RSA-encapsulate-limits.patch +++ b/0025-FIPS-RSA-encapsulate-limits.patch @@ -1,4 +1,4 @@ -From ca999ba4305afdf6b8465708ecc1a472543bbad6 Mon Sep 17 00:00:00 2001 +From e062487edbdcf3fdb05de59f1926899dfe6997eb Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 25/57] FIPS: RSA: encapsulate limits @@ -14,10 +14,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 2 files changed, 15 insertions(+) diff --git a/providers/implementations/kem/rsa_kem.c b/providers/implementations/kem/rsa_kem.c -index f7bf368a0d..a05cf7c748 100644 +index 47f0c80c94..5bfe6896c8 100644 --- a/providers/implementations/kem/rsa_kem.c +++ b/providers/implementations/kem/rsa_kem.c -@@ -284,6 +284,13 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx, +@@ -297,6 +297,13 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx, /* Step (1): nlen = Ceil(len(n)/8) */ nlen = RSA_size(prsactx->rsa); @@ -31,7 +31,7 @@ index f7bf368a0d..a05cf7c748 100644 if (out == NULL) { if (nlen == 0) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY); -@@ -359,6 +366,13 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx, +@@ -374,6 +381,13 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx, /* Step (1): get the byte length of n */ nlen = RSA_size(prsactx->rsa); @@ -55,5 +55,5 @@ index ecab1454e7..8e5edd35fe 100644 Op = RSASVE +Result = TEST_ENCAPSULATE_LEN_ERROR -- -2.52.0 +2.55.0 diff --git a/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch b/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch index dafa253..546a1c5 100644 --- a/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch +++ b/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch @@ -1,4 +1,4 @@ -From 05d9c9154e199bb4a84e215f0b20bd06ac5081d8 Mon Sep 17 00:00:00 2001 +From 64c71ed5188c9e76e87cc79c8a8121df7f42be29 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 26/57] FIPS: RSA: Disallow SHAKE in OAEP and PSS @@ -93,5 +93,5 @@ index 98d6e70346..7fe78b9055 100644 if (hLen <= 0) goto err; -- -2.52.0 +2.55.0 diff --git a/0027-FIPS-RSA-size-mode-restrictions.patch b/0027-FIPS-RSA-size-mode-restrictions.patch index cc2ca96..4101b25 100644 --- a/0027-FIPS-RSA-size-mode-restrictions.patch +++ b/0027-FIPS-RSA-size-mode-restrictions.patch @@ -1,4 +1,4 @@ -From 4191527585ab1e8923249885cbf87d2f91b8804f Mon Sep 17 00:00:00 2001 +From c0509f78838b7dbf7d3d86045507aff39dc586b4 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:20:30 -0500 Subject: [PATCH 27/57] FIPS: RSA: size/mode restrictions @@ -12,7 +12,7 @@ Signed-off-by: Simo Sorce 4 files changed, 86 insertions(+), 4 deletions(-) diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index 4e0744eeba..f38431fd60 100644 +index f5a04a32ed..0c9cc8e04a 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -935,6 +935,19 @@ static int rsa_verify_recover(void *vprsactx, @@ -35,7 +35,7 @@ index 4e0744eeba..f38431fd60 100644 if (!ossl_prov_is_running()) return 0; -@@ -1027,6 +1040,19 @@ static int rsa_verify_directly(PROV_RSA_CTX *prsactx, +@@ -1052,6 +1065,19 @@ static int rsa_verify_directly(PROV_RSA_CTX *prsactx, const unsigned char *tbs, size_t tbslen) { size_t rslen; @@ -56,7 +56,7 @@ index 4e0744eeba..f38431fd60 100644 if (!ossl_prov_is_running()) return 0; diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c -index 15be7e8067..823ad48e02 100644 +index cce1dde0dc..d3712d5c43 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -350,6 +350,9 @@ int ssl_load_ciphers(SSL_CTX *ctx) @@ -437,5 +437,5 @@ index 17ceb59148..972e90f32f 100644 # Signing with SHA1 is not allowed in fips mode Availablein = fips -- -2.52.0 +2.55.0 diff --git a/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch b/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch index d472fd7..ff040bf 100644 --- a/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch +++ b/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch @@ -1,4 +1,4 @@ -From d72621c7c9fd09b4d6a917b3a721f0fd114b950d Mon Sep 17 00:00:00 2001 +From 965b25cd50def49f4b5160cb2dc39fe270df63c2 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 24 Mar 2025 11:03:45 -0400 Subject: [PATCH 28/57] FIPS: RSA: Mark x931 as not approved by default @@ -22,5 +22,5 @@ index 6bd783eb0a..c1b029de86 100644 OSSL_FIPS_PARAM(kbkdf_key_check, KBKDF_KEY_CHECK, 0) OSSL_FIPS_PARAM(tls13_kdf_key_check, TLS13_KDF_KEY_CHECK, 0) -- -2.52.0 +2.55.0 diff --git a/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch b/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch index e8eded5..a779ac2 100644 --- a/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch +++ b/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch @@ -1,4 +1,4 @@ -From 3618981a35438119a4027d1bf3cb3902431adaa4 Mon Sep 17 00:00:00 2001 +From a23530098276d2d330d9033ce00920b9b3f364cf Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:16 +0100 Subject: [PATCH 29/57] FIPS: RSA: Remove X9.31 padding signatures tests @@ -278,5 +278,5 @@ index 97ec1ff3e5..31fa0eafc6 100644 "pss", 4096, -- -2.52.0 +2.55.0 diff --git a/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch b/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch index 60a1401..cc428d9 100644 --- a/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch +++ b/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch @@ -1,4 +1,4 @@ -From 83b5a2e3a74780873c8831fd8e3cc6bde0006820 Mon Sep 17 00:00:00 2001 +From 350c611443c5242b4f1581c2b7744acc45a13223 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 12 Feb 2025 17:12:02 -0500 Subject: [PATCH 30/57] FIPS: RSA: NEEDS-REWORK: @@ -383,5 +383,5 @@ index 0000000000..2833a383c1 +-- + -- -2.52.0 +2.55.0 diff --git a/0031-FIPS-Deny-SHA-1-signature-verification.patch b/0031-FIPS-Deny-SHA-1-signature-verification.patch index df30692..3ad0b8d 100644 --- a/0031-FIPS-Deny-SHA-1-signature-verification.patch +++ b/0031-FIPS-Deny-SHA-1-signature-verification.patch @@ -1,4 +1,4 @@ -From 7061b3b659e0386efa58d9dfb94a4f84832884d0 Mon Sep 17 00:00:00 2001 +From 6b3ea44ada75e17aaefc45a5e219723939a05529 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 31/57] FIPS: Deny SHA-1 signature verification @@ -42,7 +42,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 8 files changed, 130 insertions(+), 30 deletions(-) diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c -index 31a89133a3..0de750c247 100644 +index 64e677015e..d8aee20f4a 100644 --- a/providers/implementations/signature/dsa_sig.c +++ b/providers/implementations/signature/dsa_sig.c @@ -187,10 +187,7 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx, @@ -58,7 +58,7 @@ index 31a89133a3..0de750c247 100644 if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx), OSSL_FIPS_IND_SETTABLE1, diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c -index 2a4faf4a71..f5c101005f 100644 +index 758b11210e..b65e7d58a0 100644 --- a/providers/implementations/signature/ecdsa_sig.c +++ b/providers/implementations/signature/ecdsa_sig.c @@ -214,10 +214,7 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, @@ -74,7 +74,7 @@ index 2a4faf4a71..f5c101005f 100644 if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx), OSSL_FIPS_IND_SETTABLE1, diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index f38431fd60..e90ce3c223 100644 +index 0c9cc8e04a..dc8bed5213 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -407,10 +407,7 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname, @@ -89,7 +89,7 @@ index f38431fd60..e90ce3c223 100644 if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx), OSSL_FIPS_IND_SETTABLE1, -@@ -1790,11 +1787,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) +@@ -1815,11 +1812,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) if (prsactx->md == NULL && pmdname == NULL && pad_mode == RSA_PKCS1_PSS_PADDING) { @@ -663,7 +663,7 @@ index 972e90f32f..61e2b4e3ac 100644 Availablein = fips FIPSversion = >=3.4.0 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index c278987186..91283c5e74 100644 +index b94f5389c0..985c08b9ae 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -183,7 +183,7 @@ my @smime_pkcs7_tests = ( @@ -707,5 +707,5 @@ index 568a1ddba4..6332aaec4b 100755 SKIP: { skip "No IPv4 available on this machine", 4 -- -2.52.0 +2.55.0 diff --git a/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch b/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch index 44d72df..b907756 100644 --- a/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch +++ b/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch @@ -1,4 +1,4 @@ -From 80a4d4da42db9711d06953f4dcd6e9f29c001292 Mon Sep 17 00:00:00 2001 +From a0493c058ee5d891f7d61b35b131f722c5d81d87 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:16 +0100 Subject: [PATCH 32/57] FIPS: RAND: FIPS-140-3 DRBG - NEEDS REVIEW @@ -68,7 +68,7 @@ index f9d90d5d43..6b23d55cf5 100644 if (reseed_required || prediction_resistance) { if (!ossl_prov_drbg_reseed_unlocked(drbg, prediction_resistance, NULL, diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c -index 80ae817313..1e73a1ec28 100644 +index 0b8a9ec341..5af3c76d64 100644 --- a/providers/implementations/rands/seeding/rand_unix.c +++ b/providers/implementations/rands/seeding/rand_unix.c @@ -47,12 +47,14 @@ @@ -147,7 +147,7 @@ index 80ae817313..1e73a1ec28 100644 - return getrandom(buf, buflen, 0); -#elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND) - return sysctl_random(buf, buflen); --#elif defined(__wasi__) +-#elif defined(__wasi__) || defined(__EMSCRIPTEN__) - if (getentropy(buf, buflen) == 0) - return (ssize_t)buflen; - return -1; @@ -161,5 +161,5 @@ index 80ae817313..1e73a1ec28 100644 #endif /* defined(OPENSSL_RAND_SEED_GETRANDOM) */ -- -2.52.0 +2.55.0 diff --git a/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch b/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch index 853bd50..2b027be 100644 --- a/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch +++ b/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch @@ -1,4 +1,4 @@ -From 2d385a2615dd7c6f33f824183ec6f65ef2c9327c Mon Sep 17 00:00:00 2001 +From bd52fecf953030fd8c706bbb1969cf3746ba42e9 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:16 +0100 Subject: [PATCH 33/57] FIPS: RAND: Forbid truncated hashes & SHA-3 @@ -30,10 +30,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 3 files changed, 187 insertions(+), 34 deletions(-) diff --git a/providers/implementations/rands/drbg_hash.c b/providers/implementations/rands/drbg_hash.c -index 92eb443c6e..a63b21eade 100644 +index 504af87d5e..f95226b6ff 100644 --- a/providers/implementations/rands/drbg_hash.c +++ b/providers/implementations/rands/drbg_hash.c -@@ -579,6 +579,18 @@ static int drbg_hash_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] +@@ -585,6 +585,18 @@ static int drbg_hash_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] if (!ossl_drbg_verify_digest(ctx, libctx, md)) return 0; /* Error already raised for us */ @@ -53,10 +53,10 @@ index 92eb443c6e..a63b21eade 100644 md_size = EVP_MD_get_size(md); if (md_size <= 0) diff --git a/providers/implementations/rands/drbg_hmac.c b/providers/implementations/rands/drbg_hmac.c -index ff8a6cd6f0..d041897bb8 100644 +index 87050764fe..55e9a7b5f7 100644 --- a/providers/implementations/rands/drbg_hmac.c +++ b/providers/implementations/rands/drbg_hmac.c -@@ -522,6 +522,18 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] +@@ -529,6 +529,18 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[] if (md != NULL && !ossl_drbg_verify_digest(ctx, libctx, md)) return 0; /* Error already raised for us */ @@ -76,10 +76,10 @@ index ff8a6cd6f0..d041897bb8 100644 /* These are taken from SP 800-90 10.1 Table 2 */ md_size = EVP_MD_get_size(md); diff --git a/test/recipes/30-test_evp_data/evprand.txt b/test/recipes/30-test_evp_data/evprand.txt -index 9756859c0e..9baecf6f31 100644 +index 6f12c73c26..2588ce57a3 100644 --- a/test/recipes/30-test_evp_data/evprand.txt +++ b/test/recipes/30-test_evp_data/evprand.txt -@@ -7388,6 +7388,7 @@ Nonce.14 = 7239f92b63fb3dbe +@@ -7435,6 +7435,7 @@ Nonce.14 = 7239f92b63fb3dbe PersonalisationString.14 = 8d2e2ca3985bd2538a71f02cc3eb5568 Output.14 = 0e4cb328c03faaedbec7215725851069bceae4332de6a70e3521dd065f2f7923485969571ebd7f24be460fd901c6b3e356da6ee5262ef2d76ad14eb0f697f8fb92af2f46630198c5f7018860886147b3 @@ -87,7 +87,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -8659,6 +8660,7 @@ AdditionalInputA.14 = e5c633ca50dcd83e0a34d397df53f6d7a6f7170a3f81f0e6 +@@ -8706,6 +8707,7 @@ AdditionalInputA.14 = e5c633ca50dcd83e0a34d397df53f6d7a6f7170a3f81f0e6 AdditionalInputB.14 = 5f0beb5a2d2968e83ba87c92bfa420fd6e8526fbbfdea128 Output.14 = 8bec11df1022aa50d95daeaf23d78d6ee45c43c5768b90181e106c7df8ff333d7cb87ca1ab83f8742370db1c8c0c0c22f141ff4de33ae8bdb14fee7e6c069819320629c66d94c7c97ff52930a3c1dcd501b60f0f84bda4720ee187ae858a6e068326eda5809716e366d1b608c61b0100 @@ -95,7 +95,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -8709,6 +8711,7 @@ Entropy.14 = 1194beb668839c47c73e7516f9ba09d23dec3553b3b5532f75b260106dcc2abf +@@ -8756,6 +8758,7 @@ Entropy.14 = 1194beb668839c47c73e7516f9ba09d23dec3553b3b5532f75b260106dcc2abf Nonce.14 = 3c8a77351e93065d584feeb08c8424a9 Output.14 = fabd48bfcdd07968239fe538c2d8c9bde2e257b9b244078f39287c7ee90de167fff56a693c4e64f45081635511b5fd031c0270a31b4a014e44c0516a55ae72345aa11dffcda4ccf8cda50f6948d5ae425d8d53ad5c74cef1364277990156796e1c5dfa1ef095c0d8983477eb24241135760b02c86c86d4ec3627edac8c1a7e32 @@ -103,7 +103,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -8789,6 +8792,7 @@ AdditionalInputA.14 = 626385595bef7103af0af700e1df048d7572286af709289b7894d2ab09 +@@ -8836,6 +8839,7 @@ AdditionalInputA.14 = 626385595bef7103af0af700e1df048d7572286af709289b7894d2ab09 AdditionalInputB.14 = bfe8946dbf27d3a2127ec600351c3920d2531eb9419408233e0a888059b5eb68 Output.14 = ee6d07661828213e6453d94faaf76345c70949eca4965714c350313b0bcd8e079e6a07f8b2f7a91bcb7ef39a61568fd1c40ab78f154b3582f830095d571de29f81f9565e46b560d34c32bff55341a991f8e863bd9242c7cdd366be12538bb6922f1abfa19e7998aac61d465fc46538ee9142acc66786f4516ef4105fe1d80372 @@ -111,7 +111,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -8854,6 +8858,7 @@ Nonce.14 = de2186bafa82b0d08a0b8215e3424512 +@@ -8901,6 +8905,7 @@ Nonce.14 = de2186bafa82b0d08a0b8215e3424512 PersonalisationString.14 = d96db27febe22db935b117dc3068374e39c5b2119b497e3c1d858ef649e01de5 Output.14 = d04435a8aab397cfcee5151f7aa24298ffc6eee4f577cda42d5e154b8d28cb2f0f945f11a15ed5b76486c88f03081cfd262d94a8e0b332e3c9c608461dcc8eba20d7db209810d25c226fda9fe218022a9b2c96876cb16c06c0553dd84ce57e20338c3d3e03c59ce22e668e25c2c50d5cc9afab91f50a28680964c2dacb9d2fb3 @@ -119,7 +119,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -8949,6 +8954,7 @@ AdditionalInputA.14 = 5d9446eff72d59529a90b498d8f40983b3b2904f63664fc0aa1de8700d +@@ -8996,6 +9001,7 @@ AdditionalInputA.14 = 5d9446eff72d59529a90b498d8f40983b3b2904f63664fc0aa1de8700d AdditionalInputB.14 = e19707aafa391e8622539d52a05d930292bd0f7c17825dbed5fb7a2f8734081b Output.14 = 6ce2ae37349cbef9ebd1f9b85485810a22d430d94abf66912dd7b6cc751400e777be2f1cebc19d65694a456b2c6429cefd95eb934030846708d50be3b274c2f7de299f3c311038491f271448c7d02ff51de048fa1184e8ee06b7b46a9f123daecbebae4a2183dc8eb6976abf0dae7cdbea6017cd1500f37dfadcce0c1956ea87 @@ -127,7 +127,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -8999,6 +9005,7 @@ Entropy.14 = a7a1dbf7f828555610197e71e0ad563b8691589c5289ced03e9ef83b6f9ff938 +@@ -9046,6 +9052,7 @@ Entropy.14 = a7a1dbf7f828555610197e71e0ad563b8691589c5289ced03e9ef83b6f9ff938 Nonce.14 = 4274788c5d80e26ec1ac3a57b9c7c0df Output.14 = 5a907a26c1ef588219d4c69fcf4c5c283ab148a77588a40b323bd24e6dfb29551c4b6116c4d61349f5f8bd9ed497f38b239c37283902beb3c9700c768fa289ee4573f92316efb860a5ca4267b328f03c13138b774b4b9f7516003a699f7a0854a0efb045a5932753a771c2cc6119202b33336f10edb715bcce1d20ff503dda01 @@ -135,7 +135,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9079,6 +9086,7 @@ AdditionalInputA.14 = de1bbca12357943b4489cc7209b3f063b51b91acc168ec5e0ad88048b6 +@@ -9126,6 +9133,7 @@ AdditionalInputA.14 = de1bbca12357943b4489cc7209b3f063b51b91acc168ec5e0ad88048b6 AdditionalInputB.14 = 6ddd9aba4f100ef902ba50adee53ef44a4f45564c13e774e69557e36a357e7cf Output.14 = 544ec80a966644454886fb97a0f05eb6a4a25fcbce795b5e5b27ee06ba14b7de18dbf54f80a670b87c76c336ac9af16c8958ad6c1bde9a97aa4c1ab5823d24a53c64f6766ce6eb9b7085cf7282499c37fc1e2e825f53bc357bf36d5901e0ae93cd3bd821fa18b5aa17548560f7ad6ef38124814fccf9b2b89de61cfc27c7269b @@ -143,7 +143,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9144,6 +9152,7 @@ Nonce.14 = ab7843b73ecb4858f2cc5e9dfca803ef +@@ -9191,6 +9199,7 @@ Nonce.14 = ab7843b73ecb4858f2cc5e9dfca803ef PersonalisationString.14 = dee559515084d8ac49c3803f09f3d5fed3b307946a2752c267677f22786a0125 Output.14 = a12f5e8ea3bb174934c15e5d114ba615da33210c98c38d7fde4b5aef9aecdeaef311d929d7fece7fee11db67134c3326b413b8dc17766ba4fb881105db68688b148fd95d812f6538b14f25afaae84d39025336136d270bd643f2a6c7164930372fb1c8f4f0dab60283e9d8d3440ce8dc66761c5d5c4c13cc3a367feb4869b559 @@ -151,7 +151,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9239,6 +9248,7 @@ AdditionalInputA.14 = ead8c0dcf4ddc909aab96eadab509a46908ee5f090983af609f08d8a8b +@@ -9286,6 +9295,7 @@ AdditionalInputA.14 = ead8c0dcf4ddc909aab96eadab509a46908ee5f090983af609f08d8a8b AdditionalInputB.14 = f357bda8f2048929a4e31969ec978cc333d58b4fc09a8aa1b73ec9bdfaa1a8f6 Output.14 = 901aabb3f065be08e2f8072d5d3ffcb28ab291420644e407e7a6a3346b75a5be535bdbdd5a8245998689450292df877233ef0783e0bd1765413193790995d884ffcb2c8dc35fe4cfc12def2f091866d735b1dcfc9d8d8c26903d50e9397b1bbd674bb81fc908361b2bddb68f02031d87588cc3e94210422674e93fea6a5329af @@ -159,7 +159,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9289,6 +9299,7 @@ Entropy.14 = dfa94c198483c5daa046f1dd1e4e83f854fd6c5cbc3465f671bdfd36837779ab +@@ -9336,6 +9346,7 @@ Entropy.14 = dfa94c198483c5daa046f1dd1e4e83f854fd6c5cbc3465f671bdfd36837779ab Nonce.14 = 298de64bbd817d009a71c1424ae839f9 Output.14 = bfb9a54ce31406a82608aebc826441f8f633813a0c3bad723b802f3e905a6ee3512ff3513062aea51f93be17aebf1cfcd81868e85db3db9aa98680f974001fda8fe6a644f5efbb9d6e52e99ff606ef1ed7cd3b17fa6c6844790ed58da6df61aba0c200d7dff943588f4520891798098bddc65797b2f99c05efa090c60dc48a4e @@ -167,7 +167,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9369,6 +9380,7 @@ AdditionalInputA.14 = 066b072d48f6cc6bb00273e0bc0ebc086235fe79af1fbdb46318f56c62 +@@ -9416,6 +9427,7 @@ AdditionalInputA.14 = 066b072d48f6cc6bb00273e0bc0ebc086235fe79af1fbdb46318f56c62 AdditionalInputB.14 = cfb58f59c6d56993b9f0b5ba1643554072cf4ae8013c236120044ae909083f5f Output.14 = d5dd7f55ffa7d53fc0f679cddadeb869f39b29a6d394c9f1185b11ebefbcb43419c6a26ae3c9ab9d456e2cdba1aead05e67eabd3596526ee431ba7cab7f94838062fcec2363cf0e19849ffef30064263b3a059ce38aa02c2729bff5af9450e035161816724163906112205196c642bfd70f36abb4639fd6e4f7f6a879ebbcc62 @@ -175,7 +175,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9434,6 +9446,7 @@ Nonce.14 = ea7d3c3b8f6da0667d7f0d543c68d7d1 +@@ -9481,6 +9493,7 @@ Nonce.14 = ea7d3c3b8f6da0667d7f0d543c68d7d1 PersonalisationString.14 = 86c20a7e794c887898d5bc00e98398276a4e3ad8d674fb808a63a44330490d2b Output.14 = ee8e21ff48af611a17d33e130f4e4224330efcc1402b6d55aaf1f514553b880f18df68c0e4279854eb2e9b904c552f69f0e1badc347ebe336b70456f221e07a2fc78df72551d99df3755997029ee1461e2b6e396370096d7e8c2dfceb73214a72ae2b25ccc60b92dd71988eda811ceac4b7c335528249aaf82826a14c142007c @@ -183,7 +183,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9529,6 +9542,7 @@ AdditionalInputA.14 = ea12ddcafa4f578b8b43337508dd8627844d185b10af7de7e907d113c6 +@@ -9576,6 +9589,7 @@ AdditionalInputA.14 = ea12ddcafa4f578b8b43337508dd8627844d185b10af7de7e907d113c6 AdditionalInputB.14 = 0cc670275cd2b0eac5df123eb1fd73c2f2b093b76806943918cf49930fa97515 Output.14 = 88dc727007c0e03c8d27d00c87876f8990b271964a5275f636ecd7f18cac9c869e5f9df5fb2d34e7f89c2e9819af562a706a03d9be9318896f5ab16573aebbfd94a681cbf27e7202b8674437667893246c267785d0deca5033de88a61bf5158177391c2e3232ea6f812c468d5629ed9f89ad0bec0f6c7a469f56331f9eba1cd2 @@ -191,7 +191,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9579,6 +9593,7 @@ Entropy.14 = 6b9f904ac4b16d36e06a1bddc501d7ef98d5685c1ceadd0a6e1622e0c1e73716 +@@ -9626,6 +9640,7 @@ Entropy.14 = 6b9f904ac4b16d36e06a1bddc501d7ef98d5685c1ceadd0a6e1622e0c1e73716 Nonce.14 = 4a42f39e5a241a2b96db29055159c91f Output.14 = 785014b0460831b7b67346c6997217b0f6c8e7313687ea6ff4d0b09a0786bd6ac362a0b1ddc6ab8c9c624625a379cbec7f11cf30ddab23cdec054b986175cdae0ca4ba4610e0711bc94e9ab706539d5fa2c1a4fd3cd49042696b58dce465f8e09a200e7d214cda357021c62248a01aeb95f8ffa8bd49d354fdccf4c71eec3491 @@ -199,7 +199,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -9659,6 +9674,7 @@ AdditionalInputA.14 = 147d51711ae8a420f165db0000d9d0cb9e9cd5447311eed43d7cc9217d +@@ -9706,6 +9721,7 @@ AdditionalInputA.14 = 147d51711ae8a420f165db0000d9d0cb9e9cd5447311eed43d7cc9217d AdditionalInputB.14 = 2910968bb1976a1b8ced116e673f408da6fc563695c918ac0a230b0bb800c707 Output.14 = 357a7269b30ca744e213d894f5c45d0db9fba897e0c863a56062f5018ad9be9f37b8d550014ed68f2c34bf5195c0b7460df171ff3bd4a590578670c92470d876c8de19d48a6d7fa15fc7996be78d3cc8a5c657439f4bb9865bd56e187d5df2531a405e3e0f4b87c611aa8e226b8b0266290f06f8062456a7a4bf0896e4ddd948 @@ -207,7 +207,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -10995,6 +11011,7 @@ AdditionalInputA.14 = 23e4e6b0e0c1b28a6f9731f8b09960ce7adac17527b3bbaca7c811daea +@@ -11042,6 +11058,7 @@ AdditionalInputA.14 = 23e4e6b0e0c1b28a6f9731f8b09960ce7adac17527b3bbaca7c811daea AdditionalInputB.14 = dc7fac6aeded9e17b5bb5e2bcad9424d42dc07e809da59d52caecba6e75ca457 Output.14 = 5a42b35cf1b72d2520d92719a94ef1a7ca5b6d6c7eef2de25c8ea44c1fc3a9a5ff2128f47bbe58084a0c7a3fc790626eff5666b4c1e68fb2f53de3370b29c398d5067b255f5f7f29fdb0f8bc256ee3afbe78a33981626837c55f981e56eb2e1bdd89ca081e48f6da7ce6576fbd37dbd57a3f41cf410cb375614af239f2e10218e777fb97a55d9cc73243882b8d8d2a2c812fbdeaaed90b5bd71a274b4b171cd7e661912c9b3de1714a3fe4931d8fc7cb1c9f64f4e37d4e5dbc31602d2f8699e0 @@ -215,7 +215,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11045,6 +11062,7 @@ Entropy.14 = 471746177fa3ebbc1f1e06fa42d61d5d491abc82eb7d66e749b87d562a7eff34 +@@ -11092,6 +11109,7 @@ Entropy.14 = 471746177fa3ebbc1f1e06fa42d61d5d491abc82eb7d66e749b87d562a7eff34 Nonce.14 = 42f8a1ee9b09940e9e1dc64f51a78b4b Output.14 = 238c9889284139945e657d2c4312ee3ca2013de69be10bdc8b90d54867889f2c15c6cc933913457d4f5a00bd52b0216d90c56bcb341dde7496218861b083f80d8c933627e19b7bd8b73d6dda1bb0b2b0f1f90e2b453cd063938cec3a08f34e5581c1322329d87709e552a97e8a8c8e8e598a5c5cd6623ad1eb9f7ddd12739b1d157b1020cb8cef19402938d31b74e490c0ce75a9f57a17476df1cffa55de73bb8151071edf396c3b9e4607b07c7e2b45c249f5a8194cca1e97af78be47cec0ab0096cf588f3d4432393a8f5423a165d585e2e5f98fe47510d9415418aba28aab1193261036214c35d8ba04650b4539be6b9f7377e3c75ed236d0e69cce004906 @@ -223,7 +223,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11125,6 +11143,7 @@ AdditionalInputA.14 = 4b69404b80b6f2fec36a7dff1b194a228761694129efa6c6b9a044f553 +@@ -11172,6 +11190,7 @@ AdditionalInputA.14 = 4b69404b80b6f2fec36a7dff1b194a228761694129efa6c6b9a044f553 AdditionalInputB.14 = 519c4cf1b30500f729e5426d76373c291e26cafceb594c10c96bdb9aef4b42fa Output.14 = 53568141a5c09b6b02ac4ab674d341aa6300f8be93c0f36a7376a6850abfce068927510a1b98301aaa29252cfadfe5a2f241abc677e9e70fbca287c579acd276c2eec5c8b508f2b119a40164c6a12c0e0ca1d3d53595bbebe32fda2eef2b613329a614a28d3b374a7b031b49dba74b465a7db60a8dbdcc9e952ea143e9d5a3a651c1b0d6dad79341a7c3fd5816933f2579cc005f3c5655eb8d3f9d1e4562a756ecca3fc1d688c9824391ec8444c6024774a295c44c17fe592694dcf41f305f50a16e07fc28e247bb3d9dd0c52c6fde79df84c8d521606cec9a55f909691f5cfd797b69304dff5b60ac816b0d5046a47c2434127da1fbaa86d2844f5164a9dbdd @@ -231,7 +231,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11190,6 +11209,7 @@ Nonce.14 = 8680d7b3f0a8ae576bb0f75364b463ea +@@ -11237,6 +11256,7 @@ Nonce.14 = 8680d7b3f0a8ae576bb0f75364b463ea PersonalisationString.14 = c0bf8f2ca4efb48b8dca73ca7148da3cd5981c5a459be32db5a14fc7762c68d6 Output.14 = 269b3b656e58f9aeed32c80700d9d1b863b0253b3b33155cc0849efbedfa51cff82262c9342cff7f1a7a58a5954fe66547baa1831fee55ae0d322674c6c784095f43b30c1887fb9fa5e7e7f1905da2808ab810ecd224ab403b6f562bac54e65cf7f0473991ce7d7cbc1a669a022fde3141a9880d974b7ede2fad24a3263570443cab0e8017d242fb4c2032dc8be56d8fc1e0e8f92254c7480e4941259ecc29ea47a1d11e074148b259ff95a94711d767f0655f1e0574dfdc4ae4f27b12015af86aefd36f6c10056c3d83e639e3641cdd8ba178f7779dcf502bab3d7588cffb72f6489981aaa7139c255df0e76bf6bba32e4f547327da4597745b15042869b2c2 @@ -239,7 +239,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11285,6 +11305,7 @@ AdditionalInputA.14 = 64278bb6b8224b93c0b5339726fb752f6d81e85b204d76376d99779ff1 +@@ -11332,6 +11352,7 @@ AdditionalInputA.14 = 64278bb6b8224b93c0b5339726fb752f6d81e85b204d76376d99779ff1 AdditionalInputB.14 = 4995815c060c80e9bead55dfe823b869862bd0e5b4357afe810a53c68d4b0e7b Output.14 = 9b4249e1e692153ecd20e968f86eb31bf9a22d3671d0ce9d3eea243bfc70890644a95d551cb9956cc3770e95c2f14ff154760cba1b24c51c41f7a961a4502aa053068751618eaaf743e0d37fd41ab4969444519c22c8fd96f9eb1be6ff3ae01a25abba84a259dad8bbc78f47dcab3ac2242e6974a56454999b4c59243102b731fc4bb4e01c92d36f232ca8cfe00fcbc0ac200c2e403d17d5d1dd3d6c2095ddd15ad58a070f18b69a5f5d3f240435d298bd48bd9be028ccaeb10997f88857a848882f51a193522bb0b979b37b5508775fe150cab8ce97c0760b7418b5bbe496562fe639540e77c1025c0e191fe000aa5d1e49bf02a5a3c6f46b40dd2c47786d45 @@ -247,7 +247,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11335,6 +11356,7 @@ Entropy.14 = 337373a24fe76f025575b3dbd7eeedd03d3459d6ef44cd53335a9c4963cc45de +@@ -11382,6 +11403,7 @@ Entropy.14 = 337373a24fe76f025575b3dbd7eeedd03d3459d6ef44cd53335a9c4963cc45de Nonce.14 = ebbea7e8e1a3a45c58044b65ab7688b9 Output.14 = 21ae4510a133fa0906c873eb73e00d777b68a45a1de8759b1497f5146f0c45cf612b02e972ec93ebccbb85c9adaf0f5942fcfbb3b808482f05497f2f4734dd6d42c8413e1bd1bad10463dd4b4cf29f1662c15efc6d24955b1e54a60508d9ed008c9d29f8a6bddfe564c21473271350137452f4601179af37e19d553ec738539cfd7a8df17f07e1f9db5df776256e3c00199997307de394a8ba41be2829defbd8105fcb3cda215219fecb607eb1e7137a29eef188ca7eb349d2d1fe27edc2526ccc6d8f1af7eec9c06910f3909907f966d5904b32577f2715cc32ac08f1b5e25a734716ffddf60c57d422b515ce817b605ead2f875db7a789e351b660704f0cbc @@ -255,7 +255,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11415,6 +11437,7 @@ AdditionalInputA.14 = 771e91743429c40a2e3ececc9a3d73a92336c9c988c5d9dde47563b631 +@@ -11462,6 +11484,7 @@ AdditionalInputA.14 = 771e91743429c40a2e3ececc9a3d73a92336c9c988c5d9dde47563b631 AdditionalInputB.14 = ae1a58611aa54df3c655a1f20985552ed9e3610e92170a0de1a4573a5a1f93d7 Output.14 = b2534bf690444513bdfecb35bd616b0de47b7cca7f8ab9c5e823b468da62855601b59c6bb75cf34fe3dbc7f795536b9619d243c0f6960895d6710130fbfda2a0bff803e856f1cf21a63e86e59be0d6da7516b697e9ff95c341913ff27c8abe10e6af1b7ad8dec9f7aab46b8d35c103f9bff3016b39ec24026a7b582f6e95261031f734e29a1b64c65639cf238381e5f7e31da624ad24290930501132c860118b6c59052aaa7cf982486219431311453a431a1cf50deaf068e2f9993c0ab851c9aec72be8f7c5c57ed03c488befe6ffc256efe6db52b7734c042b69a5ed74e2593c4788c5fa8a03a5017b927bb8f1c8262925d734c5604639a9b441187b0d95e3 @@ -263,7 +263,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11480,6 +11503,7 @@ Nonce.14 = 78e7f6e9e8e1511bc0ba7f230b65fe47 +@@ -11527,6 +11550,7 @@ Nonce.14 = 78e7f6e9e8e1511bc0ba7f230b65fe47 PersonalisationString.14 = 37544eb1992fc569ff259946d639a00230ec1196c5565b8f9da62d9ce552e09a Output.14 = 0ddbb84e21d4d7110b933bbeaddb35ad81dc1f331ac8293695b30924f2713eca6f93a13d520da4486f32a12412a927d00e3f27009a944056a5805b0e050f5bf6c6bd32c523c1d607d6e3e97b59fd059a610d664396f69961599ce7f0a0cbd1dcff15474ac267e36c0b871c559fd13b7ff0c3fcc11ff8dac26761a42697c3744981cc5c5ac10cd0f3b285c4ceb4a550ecead095f90fb6f53aa302218ede7ed5ae5deac91a83f957d15ee901746d11777b23c327ee811966690f5f253c7c314a2bf2bea73ca46c6c8cc332c3493f9d023029d762fc90e5dddbb838f2225c521f196332812570a17455b3db45306aa9100ca83185395435137a0b961531cbcafc03 @@ -271,7 +271,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11575,6 +11599,7 @@ AdditionalInputA.14 = 8dab17e96142c890eb16981b97364223e815130bdb0c0c284e50dd3349 +@@ -11622,6 +11646,7 @@ AdditionalInputA.14 = 8dab17e96142c890eb16981b97364223e815130bdb0c0c284e50dd3349 AdditionalInputB.14 = 1439e2d19a99703fc35607b5bde55331eca67b2b9a9f7587ddba0dd1fe690ab2 Output.14 = aa088ba4682bd2285e90c7967a7b8a518e0ec45afd490d367022893e3822c09d967d06ff28748b5de3fb33b071b73c581bd893b6641a72cd5db35540b904eae19765cc121ca4dc9404530114c3369fa80d20dd63c8c09559c4be48aa26ca77b47579dc52fdf0eb2f2db84ab688b87f63097140aef65410fcd7a81c2bddb2c92f9d67b2e46647aadd9b85c9e17ff8b579cd672708282981ba54d854e7c9a1de66621845ae2d337a90025ccbdd1b0d695790b1f977b1e944bbc04d16a9a399628bfb33f98b40e13567514d8ce0b23340803718ea3da44fa84c923f2a85ba21495c2f9541cbe8cadc0b230b1b942e934eb4fe95c3754a77a09641ad730a550fc24e @@ -279,7 +279,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11625,6 +11650,7 @@ Entropy.14 = 5f72e390aa960846a0004d266e3741b6fe0aaac98d9d87b4cbaaa7a2af0d0bdf +@@ -11672,6 +11697,7 @@ Entropy.14 = 5f72e390aa960846a0004d266e3741b6fe0aaac98d9d87b4cbaaa7a2af0d0bdf Nonce.14 = 2074991cf0c22cd34b2de48ea1f9ec66 Output.14 = 7bf54b69e455c7941e8e24ef59b5525dc1ed3b7f934333713b9dc305dcae2cd1b74648149e04bb4f4e00b110926a6bfead7adef954b6d7e180ff820192677efa3c0c8af6a3e201d8d555cc599cdd2626d8778ea2c7a2a8e0c99e719929ae9ac4fb9a7e5176da8987508d1152909f456a4ce9461188e264cda1c879af1a8cca6c182e73c164986cbf07f441756791fa1fae40b784800335d94b0b54135831044bf0cb5dbb5c0c71de6b6ae33d6b87782d34be3cbc2991ad109d6c0440916d91baf96c4375ecdc9f09dca79671a45309c408062cd08ee623c8de007cda3b3d110425d7e8fee13b2a14215033d9ea2397cc6b5c995f37273a00dbcdf9437bc77857 @@ -287,7 +287,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11705,6 +11731,7 @@ AdditionalInputA.14 = 97f8c1e98fd25289be846d80f667341a095dfbabd610c691ad6b2b901c +@@ -11752,6 +11778,7 @@ AdditionalInputA.14 = 97f8c1e98fd25289be846d80f667341a095dfbabd610c691ad6b2b901c AdditionalInputB.14 = 136912d2805ab8ffcb4e7d6a81e37e14b7f7bb65dd0241d56f11d7c72dd5de1d Output.14 = 2e1f4954107f3654f51024f032518ba91512c9d8005265ff35248487b8c87d8862b8caaae27898a22f9ba7a0297fc071ceb6a1612bb99c0f15210a11f5a0725158832996f15106a7c43a216f90501c0dfb36933be940a875d4f6b0e5c29edb01614a26cb3ff7b906762fd6435eb7cec8c88f5fd7c4d76fcb018c08987108117c95d4d35c1c59efc06358c7abe7a73012ae4440b2ec86c3664e5549b8b0a30d6c8538d6e5151f9c17f9ce026556508b8b3d926e4364839bb526a94c7d8abf4c1241cd844bc6227a01d024affaedd4701129fb0f9b5ae853c7085ca13ec78ffa3476ddb1c1e71942c351c3ce9a855ccfa4c3c7f92b59d5b67e8eab16b699b7ed5b @@ -295,7 +295,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11770,6 +11797,7 @@ Nonce.14 = fe9dfa1b683fa9cc70b7c7f8c81185b2 +@@ -11817,6 +11844,7 @@ Nonce.14 = fe9dfa1b683fa9cc70b7c7f8c81185b2 PersonalisationString.14 = 7e86cf4111fbea8fa9b180a1bd9ff3e9d233304b1d293adffa49ce8e77f400ab Output.14 = ca0a6268d034f6817edcb6875b4754b5e9b2061ce0bc2bcd27c28065d8258b40ae63bf6d1e15521196da0afea8139c10d7bf3b54694a82d24476c578991fce1371e40b78087d95b1117650af7134567513a017353bb4af85cdc98db757cec9f92df42b7323b1e5d05387debb02750683a5553bdfb5f9fa34e14d29e09ad18bc6ef2380c173a19631abde085369ff47fa8b4fdfebe13b95b90c6f5841fe5aa6334edcfae26c13cc5d14d17a02d684b64bd55841831bde4c75de7d49bdc1a405d4e3e0d327bec44644e972349a49cbd48a4d3b8e984f5847ffeba950fff55bba9b287d51d8475f7799752208da31d91853fe6d04d97ea2a33d53b07a4fc787be2a @@ -303,7 +303,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11865,6 +11893,7 @@ AdditionalInputA.14 = 91e14e178a033e26e6f6a0b0f3890fa46f83731a14cf31445c51a92166 +@@ -11912,6 +11940,7 @@ AdditionalInputA.14 = 91e14e178a033e26e6f6a0b0f3890fa46f83731a14cf31445c51a92166 AdditionalInputB.14 = 20299371a1de6f994260d1c59c1d3f731d8f70fea6e9389b3ede54d47594414d Output.14 = 1b4efcce136b40bdc792d1607d4ab4fadc10d5e2b22eacca6f412d3aa1c60320bf825778e7ff8296db9ea360e068350f90d7d4947dc9a2e2a4074653458784059ceebf2a97db0e4a29f7c6107783fa3683b6846b8c8ce7161082405643bb84d602c6c36ca79b2b6562417f0d15f46a4fbdc445d50935f49eedf01bb131d104385369fdf88d91518618134a37c5bf73140400cced73795910ad0d2a89db2d79355ecedbcdabf135219d2afd7ac28cd7e45c6fd4e913ce5d464fd6de6e4c62b76ff86c28b0ab27a3c2622cacec075c790a7ff2f57f99ccb89c590a1dfb5a1862200c9cdf97f94eef18ddc85cf9830be662cec1885a629a6603add9396fb26341d9 @@ -311,7 +311,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11915,6 +11944,7 @@ Entropy.14 = c5ebb2ae08a03815e496c2db1e2a650b40893ea78fbd7ca8434edcde4432a43e +@@ -11962,6 +11991,7 @@ Entropy.14 = c5ebb2ae08a03815e496c2db1e2a650b40893ea78fbd7ca8434edcde4432a43e Nonce.14 = 0cede46aca7d2a60f2e98eb3c7d1dba7 Output.14 = 6d8eeb5ba130de7dca993b44b46e08894fd84ab8c347992aeeac56ce5fb5f435bba92f1129aaf9b3035aa117301a1289acc222cdac043dac58b62567102dd5a57483d79fd703e188a0fe47254bb20b361281b5b8cedded86ba9b6d86deb30e539eb7ee007131ab2af99408f38ec7fd66bec4f1ed71251c149dbf8393b6dbe96cdeb9a3b5ee065ec8636444e72339ed2cb27fbbe5421f7f141940d6fa1cf570b8dd0393625ae16b10df2f1f6fe35dba15a732357dcdf4f56abcbb47a4640dcef618e27d049e27f2af7b8634faad00280e004cfe3f52d63185eccd6c4937a026830c38e1ed6aa9bfeaf739416706f63bb8b1475ac25d734db28e39163aa0c69c52 @@ -319,7 +319,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -11995,6 +12025,7 @@ AdditionalInputA.14 = def9d8f7b18023b69c6cd4121c0adbc2a89b3ca37333d4523261d5eb20 +@@ -12042,6 +12072,7 @@ AdditionalInputA.14 = def9d8f7b18023b69c6cd4121c0adbc2a89b3ca37333d4523261d5eb20 AdditionalInputB.14 = 06051dec796525094018b436605bd2ddd66359a2836a5996e8262bb7763fadc0 Output.14 = 29e8184e37a5c26670bdc95c842c602ed8b0cf102ca144133e8cc841e1dc32fd038a72c26b8be8a568db60a4cfbd52b0d8b74cdf180a4931d6dd19a255104db105b3366d75e8f6afd0e5fab4dc14f6deac82e7703eb6a61f22b79bdad8ac7fab95a58a71f80fa510542615c305f7cbf84790060f17e7d78ab5d4b0ca34fad47133a0627b803c1caee3b97fe47626a8590672e2211f39cbe1b79d1999fb772b884122c8e50c59fdd3de13a53e805f40f8aa35501571a4c4cce79a8f738e60a43a11afdbed94e26f474ba5cd6ff5cdaf00d0fb84109aeb3510f1ea576c70ae78cdd0415a0521f3ff4083f9160011dcd6e2802cfbbbdfe9c4a3b114dd47b3a6cddb @@ -327,7 +327,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -12060,6 +12091,7 @@ Nonce.14 = 7b9a876017e5e14bd6a19719c73035da +@@ -12107,6 +12138,7 @@ Nonce.14 = 7b9a876017e5e14bd6a19719c73035da PersonalisationString.14 = eb97028b093f820b182384baafa56ecf196dc11ebc515a405ac24f73e465ae9a Output.14 = 3791ee66e505257b0bebc4319897e80ea8a70577b8a85d809cc7e4c77a458e8517368e2eaa7c0623b91ab3ebc4de3240e00e5f0cd20524d73b8000f00a3cecf869bee26763db9689dfaad9b5f21e3975f750e0c6b694d7df35fea26b2ff3c2bc679b5ecaf129320dde8245677aab9fb54b8faa97d394adae687a35b00f026430ef29bc7226957dac5edbc4a70dc82fcac00bf89d97e11d2a3e6ecfc4af4536c329ed3f4dda201db47236b03f30daf71e6368a18ab6224a023fca2ead589d9ea165d66fbce2b37a630d18ef1c97a619cd8949f16f44a9bc0f5837737d7fa4355587af5ab452f53fb82dd8b8b4706cf04e77938d7e0c3a9744c353edd0c6931591 @@ -335,7 +335,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -31145,6 +31177,7 @@ Output.14 = 01f11971835819c1148aa079eea09fd5b1aa3ac6ba557ae3317b1a33f4505174cf9d +@@ -31240,6 +31272,7 @@ Output.14 = 01f11971835819c1148aa079eea09fd5b1aa3ac6ba557ae3317b1a33f4505174cf9d Title = Hash DRBG No Reseed Tests (from NIST test vectors) @@ -343,7 +343,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31195,6 +31228,7 @@ Entropy.14 = 6fe9597b59903b1af4012a15368af7b1 +@@ -31290,6 +31323,7 @@ Entropy.14 = 6fe9597b59903b1af4012a15368af7b1 Nonce.14 = fd3e84b3a96caaff Output.14 = 1eee4c786476d488e58d0e065bb025db548787fafbe757f29ee2bd4781cf69216091ba2b68919b54ad3070ac72a2342320eb1e697b9115acbe07e194d060562e4d0fd966ab29e2c5e560574b2dac04ce @@ -351,7 +351,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31275,6 +31309,7 @@ AdditionalInputA.14 = 93dc424bd0d266879601745a23317141 +@@ -31370,6 +31404,7 @@ AdditionalInputA.14 = 93dc424bd0d266879601745a23317141 AdditionalInputB.14 = a17321015d327c5dc0bc1e130aad81ee Output.14 = f682834b5b492e09ff8e0f2c80683b032a3b262d16bc609c550dc0e74a4b7d8ebc0e3b8f2c9970d90aec9a82497dded20422b17b9e3cc3bca771cbe717ddaed5a7a6ae2601c7f765eaa719b71624e83b @@ -359,7 +359,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31340,6 +31375,7 @@ Nonce.14 = fa9adae924417150 +@@ -31435,6 +31470,7 @@ Nonce.14 = fa9adae924417150 PersonalisationString.14 = dbad22c389c527715d21a5bdf38c1fad Output.14 = a18d57e672218956e6c8cb9901d02888f3587177c3e11e1a99ea72370347b953a9f122c9446dfa109723b27f36fbf15edf103a56741c24968592479cfe30bc0053fa7b9818e9debcc494db64d15d038b @@ -367,7 +367,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31435,6 +31471,7 @@ AdditionalInputA.14 = e488e16f48c61dd2152afe925eceee92 +@@ -31530,6 +31566,7 @@ AdditionalInputA.14 = e488e16f48c61dd2152afe925eceee92 AdditionalInputB.14 = 12c692abd90ab485f4d9499680a6893f Output.14 = 8ba04617a135d8abe0c3c0a170e7472e7ed750eac706e5c3ed8305d6f6f8a1a53e0c52d4853b21ab8951e80970b426008ae11952ff364817b6856ef0810860dc65faea487b5d7c3f3d63fd443756d2a8 @@ -375,7 +375,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31485,6 +31522,7 @@ Entropy.14 = ceb354444d1a29c0c3e8a1cc24d02846 +@@ -31580,6 +31617,7 @@ Entropy.14 = ceb354444d1a29c0c3e8a1cc24d02846 Nonce.14 = 86d3fd9fc51f8b19 Output.14 = 6f90ad611987a37bac54bea0782ac78215b7d17ecdd3991a81a36d0e263c6f0dda2c102cfba56b26c7b74b5dd2548be9bc81c7958e9d19821583c6f388132b9e19ae7609add9a296c1e92d66a2ef5464 @@ -383,7 +383,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31565,6 +31603,7 @@ AdditionalInputA.14 = 32d09b604a65dc8daa35cdc34141b751 +@@ -31660,6 +31698,7 @@ AdditionalInputA.14 = 32d09b604a65dc8daa35cdc34141b751 AdditionalInputB.14 = b8186a294c7824b7c550c1054badec00 Output.14 = ae9a091cfafbf0e74c2be8ad4b984e824a24e65ba7610b0f3ab1750e2f12de1620db6bb8c493b3d8b06ab78e69cf2dffd73d4322a67ee7725aad84fb458b8f26cf04846850202e53c874213221e761e5 @@ -391,7 +391,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31630,6 +31669,7 @@ Nonce.14 = 8368ee0e29d35c67 +@@ -31725,6 +31764,7 @@ Nonce.14 = 8368ee0e29d35c67 PersonalisationString.14 = f189a80d5619f53cce878ed57522a468 Output.14 = aeac5933065c33ce2ace2531a193e367f73c83fc328f61ee2627f6f3841914c6b8a3ff767f96b3c3b685bac931af9ec10c6f3efe25b5109bb647b120e3a3f6971a4ec41f4ef0c7a900fdb09d7ff3b247 @@ -399,7 +399,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31725,6 +31765,7 @@ AdditionalInputA.14 = af578fbbb8a830947e9b4e2c9e729336 +@@ -31820,6 +31860,7 @@ AdditionalInputA.14 = af578fbbb8a830947e9b4e2c9e729336 AdditionalInputB.14 = 5a69864ca39da1ba4719dfe1dc850a4a Output.14 = 8b846f03cb66f7e49fdddf7cc449a5f3f6ccdc17ae7e2265a5d0e39ea10fc3e6cffefc04147b773a1584e429fe99e885f278aff74a49d8c842e7ccd870f1330692fc9c4836dac5046c544be74652da26 @@ -407,7 +407,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31775,6 +31816,7 @@ Entropy.14 = b7ddb82f5664834b4fb17778d22e62f2 +@@ -31870,6 +31911,7 @@ Entropy.14 = b7ddb82f5664834b4fb17778d22e62f2 Nonce.14 = 52461924becab175 Output.14 = 8735d06e26814ee54b5daca4e1da3e321a5a19b062ec0c3afbe3b16f23332a687fadb29e65208130c3d667c075660ff70aea96430fee254c472686b8e82ca359a57bbdc3004bb3eb641c1f97e4b19e02 @@ -415,7 +415,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31855,6 +31897,7 @@ AdditionalInputA.14 = 7725ef70592c362d70b088ed639f9d9b +@@ -31950,6 +31992,7 @@ AdditionalInputA.14 = 7725ef70592c362d70b088ed639f9d9b AdditionalInputB.14 = 5ab2e0067c3b384e55a78492f0f6ed44 Output.14 = ca095da39d9c21d7da073d9c95d2e415503b33c327d739f1838bbea4fc6f0254fdaf8ef6152e9263f46b864f39c7104d1d337d99fee588061152e623d7e00a27e03b5d16fe6e543453a31d4dafeda3b5 @@ -423,7 +423,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -31920,6 +31963,7 @@ Nonce.14 = 4e838a124e4b53df +@@ -32015,6 +32058,7 @@ Nonce.14 = 4e838a124e4b53df PersonalisationString.14 = 163e393b290a4d390ab0beb392f52d26 Output.14 = 76234afc296ea36a44254f999ac31fca258a24427cf4bfe2c54495fc41478ec4a00b540659b3b9461cc6188bc1f57c19ae414bd18aa81eca7b9d765a784f0ef24335e46c2c77b8dc915f5d12c26bc653 @@ -431,7 +431,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -32015,6 +32059,7 @@ AdditionalInputA.14 = 27486f8dae1b36462639ff7eee869a29 +@@ -32110,6 +32154,7 @@ AdditionalInputA.14 = 27486f8dae1b36462639ff7eee869a29 AdditionalInputB.14 = d1bfc7eabd8eddf622297012169f351b Output.14 = 4c893c3d1ed3a190fa88e159d6c99f26a02fb5fccb98bdef9fe43f1f492f490109224ba6c317db9569f618984409f2fb3db0b1e2cd4b95746f159cca76f1204f6d2a4c455c547a39a5f79fec95c8f4cd @@ -439,7 +439,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -32065,6 +32110,7 @@ Entropy.14 = f484b922f492d19b58407c242ab90e76 +@@ -32160,6 +32205,7 @@ Entropy.14 = f484b922f492d19b58407c242ab90e76 Nonce.14 = 8952a0a4b666b0c8 Output.14 = 2d77235fa273cab3c1bb176d44817cc25300b3f0172a0b5aaa66b282c015d426edec5f1ebbfc0269956b85994167992a71002586923ea234be6c5df09f47d89132e440827b89f7ff97e032b3f74fe32f @@ -447,7 +447,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -32145,6 +32191,7 @@ AdditionalInputA.14 = 9e3ea6eac120d663e330d282ca9b9d7c +@@ -32240,6 +32286,7 @@ AdditionalInputA.14 = 9e3ea6eac120d663e330d282ca9b9d7c AdditionalInputB.14 = b8d71fce7779a9906b9790cd1d4e48d5 Output.14 = 63d28a300a329ca202b98498c9f46912620bc85c246f034dca4186cd9b0e0810a363785878effde90aec8cb584862524eebf940c44fed21cb580d4115f3e0dda07e0e4a66689c2ff3e9b87edfaa4d051 @@ -455,7 +455,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -32210,6 +32257,7 @@ Nonce.14 = 7239f92b63fb3dbe +@@ -32305,6 +32352,7 @@ Nonce.14 = 7239f92b63fb3dbe PersonalisationString.14 = 8d2e2ca3985bd2538a71f02cc3eb5568 Output.14 = 0e4cb328c03faaedbec7215725851069bceae4332de6a70e3521dd065f2f7923485969571ebd7f24be460fd901c6b3e356da6ee5262ef2d76ad14eb0f697f8fb92af2f46630198c5f7018860886147b3 @@ -463,7 +463,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -33481,6 +33529,7 @@ AdditionalInputA.14 = e5c633ca50dcd83e0a34d397df53f6d7a6f7170a3f81f0e6 +@@ -33576,6 +33624,7 @@ AdditionalInputA.14 = e5c633ca50dcd83e0a34d397df53f6d7a6f7170a3f81f0e6 AdditionalInputB.14 = 5f0beb5a2d2968e83ba87c92bfa420fd6e8526fbbfdea128 Output.14 = 8bec11df1022aa50d95daeaf23d78d6ee45c43c5768b90181e106c7df8ff333d7cb87ca1ab83f8742370db1c8c0c0c22f141ff4de33ae8bdb14fee7e6c069819320629c66d94c7c97ff52930a3c1dcd501b60f0f84bda4720ee187ae858a6e068326eda5809716e366d1b608c61b0100 @@ -471,7 +471,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33531,6 +33580,7 @@ Entropy.14 = 1194beb668839c47c73e7516f9ba09d23dec3553b3b5532f75b260106dcc2abf +@@ -33626,6 +33675,7 @@ Entropy.14 = 1194beb668839c47c73e7516f9ba09d23dec3553b3b5532f75b260106dcc2abf Nonce.14 = 3c8a77351e93065d584feeb08c8424a9 Output.14 = fabd48bfcdd07968239fe538c2d8c9bde2e257b9b244078f39287c7ee90de167fff56a693c4e64f45081635511b5fd031c0270a31b4a014e44c0516a55ae72345aa11dffcda4ccf8cda50f6948d5ae425d8d53ad5c74cef1364277990156796e1c5dfa1ef095c0d8983477eb24241135760b02c86c86d4ec3627edac8c1a7e32 @@ -479,7 +479,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33611,6 +33661,7 @@ AdditionalInputA.14 = 626385595bef7103af0af700e1df048d7572286af709289b7894d2ab09 +@@ -33706,6 +33756,7 @@ AdditionalInputA.14 = 626385595bef7103af0af700e1df048d7572286af709289b7894d2ab09 AdditionalInputB.14 = bfe8946dbf27d3a2127ec600351c3920d2531eb9419408233e0a888059b5eb68 Output.14 = ee6d07661828213e6453d94faaf76345c70949eca4965714c350313b0bcd8e079e6a07f8b2f7a91bcb7ef39a61568fd1c40ab78f154b3582f830095d571de29f81f9565e46b560d34c32bff55341a991f8e863bd9242c7cdd366be12538bb6922f1abfa19e7998aac61d465fc46538ee9142acc66786f4516ef4105fe1d80372 @@ -487,7 +487,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33676,6 +33727,7 @@ Nonce.14 = de2186bafa82b0d08a0b8215e3424512 +@@ -33771,6 +33822,7 @@ Nonce.14 = de2186bafa82b0d08a0b8215e3424512 PersonalisationString.14 = d96db27febe22db935b117dc3068374e39c5b2119b497e3c1d858ef649e01de5 Output.14 = d04435a8aab397cfcee5151f7aa24298ffc6eee4f577cda42d5e154b8d28cb2f0f945f11a15ed5b76486c88f03081cfd262d94a8e0b332e3c9c608461dcc8eba20d7db209810d25c226fda9fe218022a9b2c96876cb16c06c0553dd84ce57e20338c3d3e03c59ce22e668e25c2c50d5cc9afab91f50a28680964c2dacb9d2fb3 @@ -495,7 +495,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33771,6 +33823,7 @@ AdditionalInputA.14 = 5d9446eff72d59529a90b498d8f40983b3b2904f63664fc0aa1de8700d +@@ -33866,6 +33918,7 @@ AdditionalInputA.14 = 5d9446eff72d59529a90b498d8f40983b3b2904f63664fc0aa1de8700d AdditionalInputB.14 = e19707aafa391e8622539d52a05d930292bd0f7c17825dbed5fb7a2f8734081b Output.14 = 6ce2ae37349cbef9ebd1f9b85485810a22d430d94abf66912dd7b6cc751400e777be2f1cebc19d65694a456b2c6429cefd95eb934030846708d50be3b274c2f7de299f3c311038491f271448c7d02ff51de048fa1184e8ee06b7b46a9f123daecbebae4a2183dc8eb6976abf0dae7cdbea6017cd1500f37dfadcce0c1956ea87 @@ -503,7 +503,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33821,6 +33874,7 @@ Entropy.14 = a7a1dbf7f828555610197e71e0ad563b8691589c5289ced03e9ef83b6f9ff938 +@@ -33916,6 +33969,7 @@ Entropy.14 = a7a1dbf7f828555610197e71e0ad563b8691589c5289ced03e9ef83b6f9ff938 Nonce.14 = 4274788c5d80e26ec1ac3a57b9c7c0df Output.14 = 5a907a26c1ef588219d4c69fcf4c5c283ab148a77588a40b323bd24e6dfb29551c4b6116c4d61349f5f8bd9ed497f38b239c37283902beb3c9700c768fa289ee4573f92316efb860a5ca4267b328f03c13138b774b4b9f7516003a699f7a0854a0efb045a5932753a771c2cc6119202b33336f10edb715bcce1d20ff503dda01 @@ -511,7 +511,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33901,6 +33955,7 @@ AdditionalInputA.14 = de1bbca12357943b4489cc7209b3f063b51b91acc168ec5e0ad88048b6 +@@ -33996,6 +34050,7 @@ AdditionalInputA.14 = de1bbca12357943b4489cc7209b3f063b51b91acc168ec5e0ad88048b6 AdditionalInputB.14 = 6ddd9aba4f100ef902ba50adee53ef44a4f45564c13e774e69557e36a357e7cf Output.14 = 544ec80a966644454886fb97a0f05eb6a4a25fcbce795b5e5b27ee06ba14b7de18dbf54f80a670b87c76c336ac9af16c8958ad6c1bde9a97aa4c1ab5823d24a53c64f6766ce6eb9b7085cf7282499c37fc1e2e825f53bc357bf36d5901e0ae93cd3bd821fa18b5aa17548560f7ad6ef38124814fccf9b2b89de61cfc27c7269b @@ -519,7 +519,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -33966,6 +34021,7 @@ Nonce.14 = ab7843b73ecb4858f2cc5e9dfca803ef +@@ -34061,6 +34116,7 @@ Nonce.14 = ab7843b73ecb4858f2cc5e9dfca803ef PersonalisationString.14 = dee559515084d8ac49c3803f09f3d5fed3b307946a2752c267677f22786a0125 Output.14 = a12f5e8ea3bb174934c15e5d114ba615da33210c98c38d7fde4b5aef9aecdeaef311d929d7fece7fee11db67134c3326b413b8dc17766ba4fb881105db68688b148fd95d812f6538b14f25afaae84d39025336136d270bd643f2a6c7164930372fb1c8f4f0dab60283e9d8d3440ce8dc66761c5d5c4c13cc3a367feb4869b559 @@ -527,7 +527,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34061,6 +34117,7 @@ AdditionalInputA.14 = ead8c0dcf4ddc909aab96eadab509a46908ee5f090983af609f08d8a8b +@@ -34156,6 +34212,7 @@ AdditionalInputA.14 = ead8c0dcf4ddc909aab96eadab509a46908ee5f090983af609f08d8a8b AdditionalInputB.14 = f357bda8f2048929a4e31969ec978cc333d58b4fc09a8aa1b73ec9bdfaa1a8f6 Output.14 = 901aabb3f065be08e2f8072d5d3ffcb28ab291420644e407e7a6a3346b75a5be535bdbdd5a8245998689450292df877233ef0783e0bd1765413193790995d884ffcb2c8dc35fe4cfc12def2f091866d735b1dcfc9d8d8c26903d50e9397b1bbd674bb81fc908361b2bddb68f02031d87588cc3e94210422674e93fea6a5329af @@ -535,7 +535,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34111,6 +34168,7 @@ Entropy.14 = dfa94c198483c5daa046f1dd1e4e83f854fd6c5cbc3465f671bdfd36837779ab +@@ -34206,6 +34263,7 @@ Entropy.14 = dfa94c198483c5daa046f1dd1e4e83f854fd6c5cbc3465f671bdfd36837779ab Nonce.14 = 298de64bbd817d009a71c1424ae839f9 Output.14 = bfb9a54ce31406a82608aebc826441f8f633813a0c3bad723b802f3e905a6ee3512ff3513062aea51f93be17aebf1cfcd81868e85db3db9aa98680f974001fda8fe6a644f5efbb9d6e52e99ff606ef1ed7cd3b17fa6c6844790ed58da6df61aba0c200d7dff943588f4520891798098bddc65797b2f99c05efa090c60dc48a4e @@ -543,7 +543,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34191,6 +34249,7 @@ AdditionalInputA.14 = 066b072d48f6cc6bb00273e0bc0ebc086235fe79af1fbdb46318f56c62 +@@ -34286,6 +34344,7 @@ AdditionalInputA.14 = 066b072d48f6cc6bb00273e0bc0ebc086235fe79af1fbdb46318f56c62 AdditionalInputB.14 = cfb58f59c6d56993b9f0b5ba1643554072cf4ae8013c236120044ae909083f5f Output.14 = d5dd7f55ffa7d53fc0f679cddadeb869f39b29a6d394c9f1185b11ebefbcb43419c6a26ae3c9ab9d456e2cdba1aead05e67eabd3596526ee431ba7cab7f94838062fcec2363cf0e19849ffef30064263b3a059ce38aa02c2729bff5af9450e035161816724163906112205196c642bfd70f36abb4639fd6e4f7f6a879ebbcc62 @@ -551,7 +551,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34256,6 +34315,7 @@ Nonce.14 = ea7d3c3b8f6da0667d7f0d543c68d7d1 +@@ -34351,6 +34410,7 @@ Nonce.14 = ea7d3c3b8f6da0667d7f0d543c68d7d1 PersonalisationString.14 = 86c20a7e794c887898d5bc00e98398276a4e3ad8d674fb808a63a44330490d2b Output.14 = ee8e21ff48af611a17d33e130f4e4224330efcc1402b6d55aaf1f514553b880f18df68c0e4279854eb2e9b904c552f69f0e1badc347ebe336b70456f221e07a2fc78df72551d99df3755997029ee1461e2b6e396370096d7e8c2dfceb73214a72ae2b25ccc60b92dd71988eda811ceac4b7c335528249aaf82826a14c142007c @@ -559,7 +559,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34351,6 +34411,7 @@ AdditionalInputA.14 = ea12ddcafa4f578b8b43337508dd8627844d185b10af7de7e907d113c6 +@@ -34446,6 +34506,7 @@ AdditionalInputA.14 = ea12ddcafa4f578b8b43337508dd8627844d185b10af7de7e907d113c6 AdditionalInputB.14 = 0cc670275cd2b0eac5df123eb1fd73c2f2b093b76806943918cf49930fa97515 Output.14 = 88dc727007c0e03c8d27d00c87876f8990b271964a5275f636ecd7f18cac9c869e5f9df5fb2d34e7f89c2e9819af562a706a03d9be9318896f5ab16573aebbfd94a681cbf27e7202b8674437667893246c267785d0deca5033de88a61bf5158177391c2e3232ea6f812c468d5629ed9f89ad0bec0f6c7a469f56331f9eba1cd2 @@ -567,7 +567,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34401,6 +34462,7 @@ Entropy.14 = 6b9f904ac4b16d36e06a1bddc501d7ef98d5685c1ceadd0a6e1622e0c1e73716 +@@ -34496,6 +34557,7 @@ Entropy.14 = 6b9f904ac4b16d36e06a1bddc501d7ef98d5685c1ceadd0a6e1622e0c1e73716 Nonce.14 = 4a42f39e5a241a2b96db29055159c91f Output.14 = 785014b0460831b7b67346c6997217b0f6c8e7313687ea6ff4d0b09a0786bd6ac362a0b1ddc6ab8c9c624625a379cbec7f11cf30ddab23cdec054b986175cdae0ca4ba4610e0711bc94e9ab706539d5fa2c1a4fd3cd49042696b58dce465f8e09a200e7d214cda357021c62248a01aeb95f8ffa8bd49d354fdccf4c71eec3491 @@ -575,7 +575,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34481,6 +34543,7 @@ AdditionalInputA.14 = 147d51711ae8a420f165db0000d9d0cb9e9cd5447311eed43d7cc9217d +@@ -34576,6 +34638,7 @@ AdditionalInputA.14 = 147d51711ae8a420f165db0000d9d0cb9e9cd5447311eed43d7cc9217d AdditionalInputB.14 = 2910968bb1976a1b8ced116e673f408da6fc563695c918ac0a230b0bb800c707 Output.14 = 357a7269b30ca744e213d894f5c45d0db9fba897e0c863a56062f5018ad9be9f37b8d550014ed68f2c34bf5195c0b7460df171ff3bd4a590578670c92470d876c8de19d48a6d7fa15fc7996be78d3cc8a5c657439f4bb9865bd56e187d5df2531a405e3e0f4b87c611aa8e226b8b0266290f06f8062456a7a4bf0896e4ddd948 @@ -583,7 +583,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -34546,6 +34609,7 @@ Nonce.14 = 66ad2a0d5de624f3d709cc95e5c99220 +@@ -34641,6 +34704,7 @@ Nonce.14 = 66ad2a0d5de624f3d709cc95e5c99220 PersonalisationString.14 = 6f7f8f1ffdcf859adcf6020d5cffdd8e3e1bdcaef0b22e9e61384b888f1b3537 Output.14 = 1bc4cd76787f031df8e4f592f56a845f7d8aa200aca0b910e68f149cde112d0f1e127faa7fae25ca4299eacf9e49e132f3e4083f1c5fb0304b714f06cea122bc1392cbe18289d2411ae08642a9196b654a8b177c127b9215f9df815eceb254b8d9b4f632d25d123ceec686124e58b3606ff1ce51fce0752f42232c03694a1d8a @@ -591,7 +591,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HASH-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -39331,6 +39395,7 @@ Output.14 = c731cc7b21c42730bd3cca61fc5250b507ad08b24ac471d526f2217f15dc4d1fea85 +@@ -39426,6 +39490,7 @@ Output.14 = c731cc7b21c42730bd3cca61fc5250b507ad08b24ac471d526f2217f15dc4d1fea85 Title = HMAC DRBG No Reseed Tests (from NIST test vectors) @@ -599,7 +599,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39381,6 +39446,7 @@ Entropy.14 = 5d80883ce24feb3911fdeb8e730f9588 +@@ -39476,6 +39541,7 @@ Entropy.14 = 5d80883ce24feb3911fdeb8e730f9588 Nonce.14 = 6a63c01478ecd62b Output.14 = 9e351b853091add2047e9ea2da07d41fa4ace03db3d4a43217e802352f1c97382ed7afee5cb2cf5848a93ce0a25a28cdc8e96ccdf14875cb9f845790800d542bac81d0be53376385baa5e7cbe2c3b469 @@ -607,7 +607,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39461,6 +39527,7 @@ AdditionalInputA.14 = 7206a271499fb2ef9087fb8843b1ed64 +@@ -39556,6 +39622,7 @@ AdditionalInputA.14 = 7206a271499fb2ef9087fb8843b1ed64 AdditionalInputB.14 = f14b17febd813294b3c4b22b7bae71b0 Output.14 = 49c35814f44b54bf13f0db52bd8a7651d060ddae0b6dde8edbeb003dbc30a7ffea1ea5b08ebe1d50b52410b972bec51fd174190671eecae201568b73deb0454194ef5c7b57b13320a0ac4dd60c04ae3b @@ -615,7 +615,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39526,6 +39593,7 @@ Nonce.14 = 296bfe331b6578e6 +@@ -39621,6 +39688,7 @@ Nonce.14 = 296bfe331b6578e6 PersonalisationString.14 = 4fccbf2d3c73a8e1e92273a33e648eaa Output.14 = 90dc6e1532022a9fe2161604fc79536b4afd9af06ab8adbb77f7490b355d0db3368d102d723a0d0f70d10475f9e99771fb774f7ad0ba7b5fe22a50bfda89e0215a014dc1f1605939590aa783360eb52e @@ -623,7 +623,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39621,6 +39689,7 @@ AdditionalInputA.14 = 4de6c923346d7adc16bbe89b9a184a79 +@@ -39716,6 +39784,7 @@ AdditionalInputA.14 = 4de6c923346d7adc16bbe89b9a184a79 AdditionalInputB.14 = 9e9e3412635aec6fcfb9d00da0c49fb3 Output.14 = 48ac8646b334e7434e5f73d60a8f6741e472baabe525257b78151c20872f331c169abe25faf800991f3d0a45c65e71261be0c8e14a1a8a6df9c6a80834a4f2237e23abd750f845ccbb4a46250ab1bb63 @@ -631,7 +631,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39671,6 +39740,7 @@ Entropy.14 = f41d60edb7749acb68111045000ccef2 +@@ -39766,6 +39835,7 @@ Entropy.14 = f41d60edb7749acb68111045000ccef2 Nonce.14 = bb5fb8962ca3002f Output.14 = 262821119be1ee0bceedc1bcfd04f7fa2e199b2a7522c4a3a98c4174e0ac4ddcf7323dee2fcf9fbd2fe26c4fad347f7199be105730441f042865aeef50b89c00aa661361b6a1f20849bc7c70aa294543 @@ -639,7 +639,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39751,6 +39821,7 @@ AdditionalInputA.14 = b4894bbb6435ffeb710bf5ae440bd744 +@@ -39846,6 +39916,7 @@ AdditionalInputA.14 = b4894bbb6435ffeb710bf5ae440bd744 AdditionalInputB.14 = 689fb48c27983ededdd56d5a6b2c0345 Output.14 = dfe8a9e17b938a1782fc3dba4f234dd9c9e36b67b28e1d901ca6b3628689aa4d2ae6b005ae3ce97e0d1e645da2710162294606ce51638b91e9c46d8f7f4f1a217e44c36b560f78b0541fececcf49b9b9 @@ -647,7 +647,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39816,6 +39887,7 @@ Nonce.14 = 3c9434b7d7e18472 +@@ -39911,6 +39982,7 @@ Nonce.14 = 3c9434b7d7e18472 PersonalisationString.14 = 55bfc33da17f712877829b7f8a134e55 Output.14 = 705950e4790ada95b99ace57e31115610ebc65d755fe587eae8fb1aeae463bea8b50a278f45e61d3433272ec31b0d48afcf219f5f4a0adb20537be9c7cb65911df28976aed4b4278cc524639a1ca5f40 @@ -655,7 +655,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39911,6 +39983,7 @@ AdditionalInputA.14 = 7ee4f3670c4671f128cbd743c408bdd1 +@@ -40006,6 +40078,7 @@ AdditionalInputA.14 = 7ee4f3670c4671f128cbd743c408bdd1 AdditionalInputB.14 = 38f8003e8fb8c119534a2c3400a87f8d Output.14 = fedbb1636b83c5cc5379c9aa4d1319df6d30770e469c2f7bd65b4b74d9bc880d520e11b2c3642a7c4cb6d6138d1d92f716317dd762c0a841e56e7e0226971a7f470e918d44b4f374f9e7e3b5209516d3 @@ -663,7 +663,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -39961,6 +40034,7 @@ Entropy.14 = 5b6aaaf5c4e5acdacd2c0c14648eeb3f +@@ -40056,6 +40129,7 @@ Entropy.14 = 5b6aaaf5c4e5acdacd2c0c14648eeb3f Nonce.14 = 353cc1174da7f766 Output.14 = f7664dd99fb870dad1a45a4ddb870c9936fb42b3a063336e447f15703c5a95dd79eacd9f41cd0c1b4f2e1a45229aca140f463c1beab47aa0525e5bd6e1accf360bc8525430ba05fd14d1f008009fd586 @@ -671,7 +671,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40041,6 +40115,7 @@ AdditionalInputA.14 = 4eb5c1192fa86b355237b5a8bd43ebf9 +@@ -40136,6 +40210,7 @@ AdditionalInputA.14 = 4eb5c1192fa86b355237b5a8bd43ebf9 AdditionalInputB.14 = 7323d1a6f983b7d16df6b0aa9d14adb4 Output.14 = cd41a0d7371b2eeb790fa8335660385c418ba84507ba94d1d1015b3353cdcad556993c19388461fd2cce38cc9fbc00e707b18dea9d712ac0616b443b23aee8131c295a1a741ffde36b2032bdb8ae2f6f @@ -679,7 +679,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40106,6 +40181,7 @@ Nonce.14 = 9bee7502db25ae7f +@@ -40201,6 +40276,7 @@ Nonce.14 = 9bee7502db25ae7f PersonalisationString.14 = d0e8fa47aed6b67ca4e8e521f733921c Output.14 = 3c649d295fd9b98082706f3f841f5275834143698c202da4c881c7d0a3c9995329a54d440fc4d21ab596e95e5b6651c6e7138b332c97ef771bc6e3b0b3fa09090ffb402ed1116d8395e5f1cfea3eae6b @@ -687,7 +687,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40201,6 +40277,7 @@ AdditionalInputA.14 = d56ade0d74ea34577eb12a899d18d382 +@@ -40296,6 +40372,7 @@ AdditionalInputA.14 = d56ade0d74ea34577eb12a899d18d382 AdditionalInputB.14 = ea83bdba8490ffd136def5f7d9240c59 Output.14 = cd3d8174d8af97387ff02707d2757ce685ffb5d8dd91d95b8af4a3a757f9321b0e908096cd1321de0599640b7d81f43606b12e029ae158ed568ce1db429be75285c655e15f88da859f09b4cd843a0b61 @@ -695,7 +695,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40251,6 +40328,7 @@ Entropy.14 = 1c3fc8de26ddc78651c9c2e4ba874ee0 +@@ -40346,6 +40423,7 @@ Entropy.14 = 1c3fc8de26ddc78651c9c2e4ba874ee0 Nonce.14 = ca6a2d3cc5495dd0 Output.14 = d00ff8d3b8ca273cf7c3650e36c892018c0f765da45ab5b902c5accb30ffe01a99d3b86752195dc9aa1232fc852790ef51860fd114bdc78ae02acb5ab2021ec726829591d623b0b66329e641c1f915ce @@ -703,7 +703,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40331,6 +40409,7 @@ AdditionalInputA.14 = b180d77e0ef217268d2d4dc9d4a9532f +@@ -40426,6 +40504,7 @@ AdditionalInputA.14 = b180d77e0ef217268d2d4dc9d4a9532f AdditionalInputB.14 = b192957f3e98f7595768d00834eee1d9 Output.14 = 7d4791ccae7980ad19e5d8eb8932ea8ea1756710349ab8b771558cfe471a278dcc263b737486179a4ffad12d5311d23912c3a46f07152808d288be2dfd2b315fc4f6df6418029be52daed643dd3c6110 @@ -711,7 +711,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -40396,6 +40475,7 @@ Nonce.14 = 84f7310a7ab653e6 +@@ -40491,6 +40570,7 @@ Nonce.14 = 84f7310a7ab653e6 PersonalisationString.14 = 0fb2233c2cea27d17b6dd93bc4621285 Output.14 = a2f373a523ac9f2524b059d0c23bcaa905e15948c7ebf71b6e82150aef562dae4003c1a8a3748cfd553d9a51a8f9450b9d569d96d897fed50eee23978e49b364c64db63fac9dc0fe9e8b58836aa04a74 @@ -719,7 +719,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 0 -@@ -41667,6 +41747,7 @@ AdditionalInputA.14 = a58757b98280d90e84d6cf4e2fa89c01a9e6aad22d6cff0d +@@ -41762,6 +41842,7 @@ AdditionalInputA.14 = a58757b98280d90e84d6cf4e2fa89c01a9e6aad22d6cff0d AdditionalInputB.14 = a3f5de1ec6d0ccd39fa153899f0c1a414106a2aa182acf31 Output.14 = b1797707f1217d81c8463b44957df350dd139073b056c50d1c912fa111f9cb488bfb7d2ec6faebd078171cd6b71171ae33698ff96c7225d7fd36ddcfeb2630464974d12b3e03877bc73ce1a2f89aea7ff7ddc8ac85708b35dd94d3972875e2d3e7237ec33871e99301202b52e2ff89db @@ -727,7 +727,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -41717,6 +41798,7 @@ Entropy.14 = 451ed024bc4b95f1025b14ec3616f5e42e80824541dc795a2f07500f92adc665 +@@ -41812,6 +41893,7 @@ Entropy.14 = 451ed024bc4b95f1025b14ec3616f5e42e80824541dc795a2f07500f92adc665 Nonce.14 = 2f28e6ee8de5879db1eccd58c994e5f0 Output.14 = 3fb637085ab75f4e95655faae95885166a5fbb423bb03dbf0543be063bcd48799c4f05d4e522634d9275fe02e1edd920e26d9accd43709cb0d8f6e50aa54a5f3bdd618be23cf73ef736ed0ef7524b0d14d5bef8c8aec1cf1ed3e1c38a808b35e61a44078127c7cb3a8fd7addfa50fcf3ff3bc6d6bc355d5436fe9b71eb44f7fd @@ -735,7 +735,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -41797,6 +41879,7 @@ AdditionalInputA.14 = 4f53db89b9ba7fc00767bc751fb8f3c103fe0f76acd6d5c7891ab15b2b +@@ -41892,6 +41974,7 @@ AdditionalInputA.14 = 4f53db89b9ba7fc00767bc751fb8f3c103fe0f76acd6d5c7891ab15b2b AdditionalInputB.14 = 582c2a7d34679088cca6bd28723c99aac07db46c332dc0153d1673256903b446 Output.14 = 6311f4c0c4cd1f86bd48349abb9eb930d4f63df5e5f7217d1d1b91a71d8a6938b0ad2b3e897bd7e3d8703db125fab30e03464fad41e5ddf5bf9aeeb5161b244468cfb26a9d956931a5412c97d64188b0da1bd907819c686f39af82e91cfeef0cbffb5d1e229e383bed26d06412988640706815a6e820796876f416653e464961 @@ -743,7 +743,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -41862,6 +41945,7 @@ Nonce.14 = a59394e0af764e2f21cf751f623ffa6c +@@ -41957,6 +42040,7 @@ Nonce.14 = a59394e0af764e2f21cf751f623ffa6c PersonalisationString.14 = eb8164b3bf6c1750a8de8528af16cffdf400856d82260acd5958894a98afeed5 Output.14 = fc5701b508f0264f4fdb88414768e1afb0a5b445400dcfdeddd0eba67b4fea8c056d79a69fd050759fb3d626b29adb8438326fd583f1ba0475ce7707bd294ab01743d077605866425b1cbd0f6c7bba972b30fbe9fce0a719b044fcc1394354895a9f8304a2b5101909808ddfdf66df6237142b6566588e4e1e8949b90c27fc1f @@ -751,7 +751,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -41957,6 +42041,7 @@ AdditionalInputA.14 = 288e948a551284eb3cb23e26299955c2fb8f063c132a92683c1615ecae +@@ -42052,6 +42136,7 @@ AdditionalInputA.14 = 288e948a551284eb3cb23e26299955c2fb8f063c132a92683c1615ecae AdditionalInputB.14 = d975b22f79e34acf5db25a2a167ef60a10682dd9964e15533d75f7fa9efc5dcb Output.14 = ee8d707eea9bc7080d58768c8c64a991606bb808600cafab834db8bc884f866941b4a7eb8d0334d876c0f1151bccc7ce8970593dad0c1809075ce6dbca54c4d4667227331eeac97f83ccb76901762f153c5e8562a8ccf12c8a1f2f480ec6f1975ac097a49770219107d4edea54fb5ee23a8403874929d073d7ef0526a647011a @@ -759,7 +759,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42007,6 +42092,7 @@ Entropy.14 = 17da1efd3e5250dfde3ef1683bd9cf4d4432a2f223399664f7645763bebd5ebd +@@ -42102,6 +42187,7 @@ Entropy.14 = 17da1efd3e5250dfde3ef1683bd9cf4d4432a2f223399664f7645763bebd5ebd Nonce.14 = 0b160c67b97d5302972b5c517bed5a7c Output.14 = 859bab959dd16f2cddb05376b3d3e46cd13c191c18203bf3c0bbd5803cc559aacce48d88564166fd5f43c22d08cda1acd8004f36915739796a39ca96f8e7def14b58a8ee55ff72de7e2e2727389e027657447e32e47d4ea2f0fda48e86046d111cc334bebf4ee1019199c94fdb26169661cec0b0c47176cb5fb7aed8ad35afb1 @@ -767,7 +767,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42087,6 +42173,7 @@ AdditionalInputA.14 = 50687524beffed38fe27963340483886645153311dbd4d10d86e7d6b26 +@@ -42182,6 +42268,7 @@ AdditionalInputA.14 = 50687524beffed38fe27963340483886645153311dbd4d10d86e7d6b26 AdditionalInputB.14 = 1e3ebe4a54c3092d540ad2898ec3be1af84a1d515c013632402ffdeede7caa8b Output.14 = 007139a46072d9dbb6589b8ecf5f287d3aebb13b480ffcd6e95f0b2f916cd99e75f30a21971298257a80c17e9e41f8e0874dc9da8f6c18007a6e4cd5971df083ae62bb7b9f1bd4926f17e5574535f6009c0068b4ea3a50e2ba6c6aa6c7729fbe8ba58b4b795740ff6ae2f3d6fbe3e06828080cd1dcfb11771ec98ad9e0bac0b7 @@ -775,7 +775,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42152,6 +42239,7 @@ Nonce.14 = 2b653a89e549e3b1ee7817f5864fa684 +@@ -42247,6 +42334,7 @@ Nonce.14 = 2b653a89e549e3b1ee7817f5864fa684 PersonalisationString.14 = 814146b3b340e042557b0e8482fcc496a14c02d89195782679172e99654991ed Output.14 = 3ea100cf50c25d7b2ef286b5fa0720f344de2d568979e7349befa23589083e835205cdf6a4670722fff04260e54618c9c00af75cc26eee665b64e7e628ec4c56a8086dcd583681170f60d565bd97d0f416e4c231e281081b0fcd16c8db63ea9029abbfcb068bf57a36364aa9e27603f447adf337baa35f049a129abdc899f808 @@ -783,7 +783,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42247,6 +42335,7 @@ AdditionalInputA.14 = 95f6df9905b652de6d08399f61956acf943fe412bc71de60d6b69881f8 +@@ -42342,6 +42430,7 @@ AdditionalInputA.14 = 95f6df9905b652de6d08399f61956acf943fe412bc71de60d6b69881f8 AdditionalInputB.14 = 87b818568ed80f7c2e8f5b5d7be403f8badf9fa0e716aaf1d6409957b242aa07 Output.14 = 45b5182f313a26008bb4ab82f68a12e7c783c243ba1ac6d8bfaed44ddddb607f964ace9c3505d59ef5a3691143a4845491661a1dff8ac4de2e56b54e263ac3aef86966fd656b5a65d4f3b89731d50fa919663bd5691678ee5f8f499e84b1822bd0b91409b62cf98c176df7e812513f3252d25d15fe13ef9f253af477d16bcfcd @@ -791,7 +791,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42297,6 +42386,7 @@ Entropy.14 = 32695b2c55839eb3a048fabedcae1f23bf0c7206280ba4ba0d08b9bd9f119908 +@@ -42392,6 +42481,7 @@ Entropy.14 = 32695b2c55839eb3a048fabedcae1f23bf0c7206280ba4ba0d08b9bd9f119908 Nonce.14 = 01f2a4cf8a9311abe5ecf58d6661dc5a Output.14 = 4a4f44f418d585e03f508f2ff05345abffeafd75f610a957be7f3ccaae31ba28e69bf8ae441a405fdbc0ee761e39c76b69062f5a3866fc296be1ad306e6584ab2d250d717605c70a17c46a298f714e4e820c85a1fb84f4d61b9857a40c2902193ad703c78635a2791abe6abca6124229ed75827135c27f1a04d244e1d73ff059 @@ -799,7 +799,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42377,6 +42467,7 @@ AdditionalInputA.14 = 2e51dbbfda8c92f2c838bd85ca5dfd7f35504fae1ad438431b61c2f062 +@@ -42472,6 +42562,7 @@ AdditionalInputA.14 = 2e51dbbfda8c92f2c838bd85ca5dfd7f35504fae1ad438431b61c2f062 AdditionalInputB.14 = 00f507a359585778988b6bb6b91f23d4ab29d2adbe632e4cd4646c8cd5f1b76a Output.14 = b7adbbf07414551464711ad9a718315b0587db2782d34179b70b4c0e323a91ad9de40933023e3a6be71cd50dc58953ad1bf66354bc45dcd9ea23682d487b43903a8f426182536e170af8b04460c586d8ca56e4c307ab7116d8130634dc9a58e1c3077bbddd6bd58c8a0fb9b18c4b839aacf5fcd711c611db120e6a605745e86a @@ -807,7 +807,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42442,6 +42533,7 @@ Nonce.14 = 3f9e88b93a6e69d070328c2c570c3be9 +@@ -42537,6 +42628,7 @@ Nonce.14 = 3f9e88b93a6e69d070328c2c570c3be9 PersonalisationString.14 = bbe702bbd2265e73aa073f47ce55fb65902abbe51635b414df688c60868546e1 Output.14 = 0280555ba6b2379dce7cd56615d7d86feadb8ad995e2852a0607e663a34b1e0342c7bc649adcb204e271eeb87521591fad74b3bd841971cb100ae5f21599b732d8c5f9d578c1113da7034b580013720e62b1d013e28205d5024f8b1eb3219e6cf821792713354cf1349d32a64f32ecdbd7578c55e401fbea57f21ea3ebef0f9f @@ -815,7 +815,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42537,6 +42629,7 @@ AdditionalInputA.14 = 38684dfa6edbd61e464e49f7d01932802a5a5d824db6b1df6087e84a8e +@@ -42632,6 +42724,7 @@ AdditionalInputA.14 = 38684dfa6edbd61e464e49f7d01932802a5a5d824db6b1df6087e84a8e AdditionalInputB.14 = 4949b08a12656c497cc6760791982c0d4e674b0f8a14be730a91689ee77e981a Output.14 = fda39bf8dc1aa785422281dec946bad99d5ead17cac55d47bdb9bd0a80a72f3c611f92bcf29e3e45475426a7a9f139b755f332cf75035b047697f4131c9bbc9ee825ede9a743b14f02dea122194405864aa2b538ed5cdf40ecf81e02bed1556ce0e7974548f050b084b8f3626c0fb2c7272d42cdcb039af4c7d957e285b53b5b @@ -823,7 +823,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42587,6 +42680,7 @@ Entropy.14 = 1006646f977b83f4d90870f24b3b72d0b4947037f7671a64ce3b52829506a519 +@@ -42682,6 +42775,7 @@ Entropy.14 = 1006646f977b83f4d90870f24b3b72d0b4947037f7671a64ce3b52829506a519 Nonce.14 = 5698d50f59c42b26339d218fc985a41d Output.14 = 44ab1d22fd3a84f8847c33d0fb0aea66408d5181b8ea95416beddd9784d86d72d2851857b503253016036246cea11f2ad2bd18fe56508697a50b14e7c85bd9b002deadbce5ff9f72508b6ebce741dd7803a2d8633dbec235cccd37c089c9d747a52000ed4cc1dc8545ddb65e784a698bdc74a6ff4fd7b3dbed31a22f83b4fd8f @@ -831,7 +831,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42667,6 +42761,7 @@ AdditionalInputA.14 = 8d72118578abbd90ddbe6115ab10b499afa26c2360eaf6fa118ba590ac +@@ -42762,6 +42856,7 @@ AdditionalInputA.14 = 8d72118578abbd90ddbe6115ab10b499afa26c2360eaf6fa118ba590ac AdditionalInputB.14 = 6ca4d45fcbd0c7e964557b2bd7622a528b4722335b47383f7bca004b7cd5cf04 Output.14 = 360d9ff3111c6b713fc641b571b582770991885f2fea806a485006a1b4f41ece4ce83dcabfd403edde77780c044c96e85ce5d1f1a368ad881a64be8c41e87f0a682ab67170ae05a24b08b4a9178d13ac9928ecb3b5e23e745d93aaa5f111c335c77cb9a5c3da8163cb428fef60da737b884105ae57616637b0e40bad9594bd51 @@ -839,7 +839,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -42732,6 +42827,7 @@ Nonce.14 = 50f723edc4f658862758e149e7ae4f20 +@@ -42827,6 +42922,7 @@ Nonce.14 = 50f723edc4f658862758e149e7ae4f20 PersonalisationString.14 = 39d43e627ab7c7a6d12fce4cd8c001678bfadd9d07d4086674e5d8bdef4ac62e Output.14 = 02e68bf3f78812aa270619b307dc0e57b05b8310084ecd1914a67d93b77127e0b3ec40e359adc451eac8788ac708fde70575fc1b9bbfd291bf5b8d7bda7bcc23a0271ba0bb0e6d617132399bd6cedf5a9a683ea98b3b0dd3bc6d811e4f66c9ec751012992cf54e3ce474e09b31ba9c01ea231d4fa8f09441e204c4d3285c78d0 @@ -847,7 +847,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-256 PredictionResistance = 0 -@@ -44003,6 +44099,7 @@ AdditionalInputA.14 = 73cd5580972f69bb4b0d0cd8915a5b594c3a9fa40b82d6b37446dff4c0 +@@ -44098,6 +44194,7 @@ AdditionalInputA.14 = 73cd5580972f69bb4b0d0cd8915a5b594c3a9fa40b82d6b37446dff4c0 AdditionalInputB.14 = 304c2001d8bfb9f1b23f3b336db9f5da17752cbaba782d8932d2641aab4c34b8 Output.14 = 5771705c788e15fd5f656d4b5555d532ee4c48453be651a69c30fa706abe7719d9842028c667fab59aab97fe64a6140baa5d42dbfb7ecd58f2ce557a7b8b2c01669232e0b8bb0ddc6ef8dbe627ec5b370ec74553640982a14bd38ad9824b9651b717f8e90f539c42d04f7cff648c38b26abf38dd2a777348a4c2872f6551ef0f9e148bec810025779e7cbe1055cb0250a764fca5a1feba53bba64b7ea0c4dd3d56a7e6b4f8a157264e6666d356fe5a7a29fde7f4391662c4e69f471c21c6beeb @@ -855,7 +855,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44053,6 +44150,7 @@ Entropy.14 = 2c13e44674e89aa105fc11b05e8526769a53ab0b4688f3d0d9cf23af4c8469bb +@@ -44148,6 +44245,7 @@ Entropy.14 = 2c13e44674e89aa105fc11b05e8526769a53ab0b4688f3d0d9cf23af4c8469bb Nonce.14 = 700ac6a616c1d1bb7bd8ff7e96a4d250 Output.14 = f778161306fc5f1d9e649b2a26983f31266a84bc79dd1b0016c8de53706f9812c4cebdbde78a3592bc7752303154acd7f4d27c2d5751fc7b1fee62677a71fc90e259dfb4b6a9c372515fac6efe01958d199888c360504ffa4c7cf4517918c430f5640fedc738e0cc1fcec33945a34a62ca61a71a9067298d34ac4a93751ddcd9a0f142748a1f0a81a948c6c6a16179e70b6f13633fd03b838da20f81450b4fdc1752e98e71296f1941ca58e71b73ea93e99a98f58d0892fa16de6a16c602036ac857dd75f9ac2c9185932103db5430e80cde9131e814a0bf3f3e7a2200a7152424472fd27f791a854f29aecc448f8d3fca3f93290266df3193d9e13e08907ab2 @@ -863,7 +863,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44133,6 +44231,7 @@ AdditionalInputA.14 = 6cfccdd8253cc5b284701ef8d16f8888f79100373a7df50f43a122591b +@@ -44228,6 +44326,7 @@ AdditionalInputA.14 = 6cfccdd8253cc5b284701ef8d16f8888f79100373a7df50f43a122591b AdditionalInputB.14 = 5795ae5be47a7f793423820352505e3890bac3805c102020e48226deab70140a Output.14 = 4a398c114f2e0ac330893d103b585cadcf9cd3b2ac7e46cde15b2f32cc4b9a7c7172b1a73f86d6d12d02973e561fa7f615e30195f7715022df75157f41dc7f9a50029350e308e3345c9ab2029bdc0f1b72c195db098c26c1ab1864224504c72f48a64d722e41b00707c7f2f6cdfe8634d06abe838c85b419c02bf419b88cde35324b1bfdaddff8b7e95f6af0e55b5ff3f5475feb354f2a7a490597b36080322265b213541682572616f3d3276c713a978259d607c6d69eec26d524ba38163a329103e39e3b0a8ec989eca74f287d6d39c7ceda4df8558faeb9d25149963430f33b108dc136a4f9bfa416b3ceaa6632cd5505fe14fb0d78cf15f2acfa03b9c307 @@ -871,7 +871,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44198,6 +44297,7 @@ Nonce.14 = fff1f2e2ac117af8b2cb023f0dd6c6ea +@@ -44293,6 +44392,7 @@ Nonce.14 = fff1f2e2ac117af8b2cb023f0dd6c6ea PersonalisationString.14 = 0a4c2df69d6c69df0a9c58ab7c886ed9db294f5fe98eb066fde543b409ee91e0 Output.14 = ae35e947a538e7da73f944b4dea689c064b144b753fe597369e58ec4868099c0f000995949e82dc3e5c00555a2cfe48c8a87e87ae5e7402e2b1679e413cc556f08796269ef3ea83d6a49116349a31710964fb2f936cccf249472eab3267cc1ca0073ff4d964eefc82dd1559c3737661f8b206757a64c756680fb7ab6be8cb433b93f21a04c1e99c777ac26c1f34918794085ee593ca27ae991c53d141e52f90e7872bbb036dce78e6a33e2d638360f9c15d5746d6ff13c1bcdff1cd01749fa51c3c72e68c0ce57423d4915abe84c15cfb3301d0c3b8ffc6a1962c1fd981790fa2a3da60d70e8e8557e4b2e7458ad85f5141ad46e1db751893e8327c8197571e8 @@ -879,7 +879,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44293,6 +44393,7 @@ AdditionalInputA.14 = 2b2dbe3834d8be93f1396b19be83bd96823dd82740da71c5eeb7b21865 +@@ -44388,6 +44488,7 @@ AdditionalInputA.14 = 2b2dbe3834d8be93f1396b19be83bd96823dd82740da71c5eeb7b21865 AdditionalInputB.14 = 49c322fc1bec86d3e20628d9bdc1644e6f5e0237c7c694746bfee32a00145696 Output.14 = 9110cec7d07e6e32724bf043e73021b3ca0e4516b619d036ac9a00914e12f01ece71989f55c1caccd542c60a9cccffb91e203fd39dca2d92c8eb03ee7ee88abf21dc6891de326c3190f25ee9ab44ca72d178db0f846969465b25a07dcc83777e6b63a7f9f1a8246dd31ce50cd9eb70e6e383c9ad4dae19f7cec8bfe079b36d309c28b10161c28b8d66c357c7ee01f07403a596366725fd5bd3a5de3cb40dcf60aac10635615b866ae633fbdb7ece41695d533757d9d16c6d44fd170fae77c15b7426ed6ec8c9d6e9245cd5e19e8dc3c8c7e671007ce8454413bd07407e8a2248bee95a7669db6ee47377b4490a6251abb60cd4e2e404ab88aa4948e71ecec50c @@ -887,7 +887,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44343,6 +44444,7 @@ Entropy.14 = 1436be35237c34bac5b5b36b24c998380883fb52621daa420112cb57bc84745c +@@ -44438,6 +44539,7 @@ Entropy.14 = 1436be35237c34bac5b5b36b24c998380883fb52621daa420112cb57bc84745c Nonce.14 = ed884f91a94c1b0a51f316df776283af Output.14 = c74ce568f0c465e79ef3700857cc8857b74ec8c075cada3f2698ff69569318b130b5b079ac5b69814d057097b0a107a546b011db601b2f7aa1708effd6479f383d7d484a5df76b63f1419eb360991475b2cd97590a1887487a76cd6fde7764cba5f101e4614c635ba7b1e18724a0a8fb39ca0948bffc441b6aa0216cf3c28ae6c06a24ad1bbe68970e06884d3b68325a3d7c1dce9a2fe87d565dccdcee7c62ed32b577763f510f0029a99530209628359bedf4bbfed1a13c222692d8cae60ca736df834a6e316db27642ed5839d2e11716a5c06e8d067e8548d7ac0687da801d292e2a6f414d7470d2e72261188347878d18e00fab3d4c15cb4c4a73cf963437 @@ -895,7 +895,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44423,6 +44525,7 @@ AdditionalInputA.14 = 48e994654ab1d109511a3b34f5fa9f12b8da17da510d7a71e3839ba86b +@@ -44518,6 +44620,7 @@ AdditionalInputA.14 = 48e994654ab1d109511a3b34f5fa9f12b8da17da510d7a71e3839ba86b AdditionalInputB.14 = 949ee0617b277a3ddf4a51343104704775d91797be1826d78051496a87d9113d Output.14 = c4bce916b00a8583ebe1e85feaa1f076315ec9433e18afa1252061a62fc7558491678cb31048e4b4551b697e8dcb58dff951337f0fb7a41546d9a7838a1da149cb44558d324eab9e7ae147e8ead666e3d4eabc9978626efc8710ba8b5eb485d5693e5d6cac36ddd3a1a878ffbc77e9ec5d333cdae2b5803dcbba70d4e0dc60366dae5cf25990f3ae6147c99ec6c998397a1ac02b1b6ef6867aa897ca90b7fb938e3ddeef57e40897a644a4f08e37c995210e00f07145d5b3620ce673072525f9f74adf79ad703c4a09adc6eadcf77e76c6b032270d4c68f01672decf9aa0e941086188304fc33a28f53bf121df747b7dfdc00ddfe68f6d06ab7e82295f70652e @@ -903,7 +903,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44488,6 +44591,7 @@ Nonce.14 = 70916df78dd9ea799230435b3e48686b +@@ -44583,6 +44686,7 @@ Nonce.14 = 70916df78dd9ea799230435b3e48686b PersonalisationString.14 = bf755696adb9c92839798798f836b063cbbe987f0163ef3f4a97222c888f5da0 Output.14 = 411cd8e76e711447e8a93ca95aa3aac5e51f559d65a8385a15e71877ac8472a347d9d453bd6761655711ce2133900d28e41cfd1292d28848646e5cbdcac1e60e49e62aab169b1735e701e38d65ccc073f277972ca85444dea86c19c0c08317dbbeca4fbd5d4295c9da71b89623d0028cebf1ab68fd0aef5b37e76e2e0b3e7f72eee04c01b6afb180b1fa0c370975526b788ec4db076a16a798671451af3e20d323684e232a25d78aaa8ee43f734f1555bf0a324053c7c895dc3e098621e189962a914f486cd7a5ff330f39316afb762b1a06cf8b593ca00d7edf739e2e6827a7af662f33bb09fad09d6bdb3a565f2bd32512c79927d390c79a1cc6db968b13a0 @@ -911,7 +911,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44583,6 +44687,7 @@ AdditionalInputA.14 = 6f9f47857a60b6f3f9fe9a83ebcec5f16ca73e236d2af5b0daab45c0b9 +@@ -44678,6 +44782,7 @@ AdditionalInputA.14 = 6f9f47857a60b6f3f9fe9a83ebcec5f16ca73e236d2af5b0daab45c0b9 AdditionalInputB.14 = e6628fbe4a774bc5383218302b7c565da5a5bd9f19db6182b444af5ae5f62739 Output.14 = d701c1824a82ff1803c4b59f490c3f37850ce85b5905059ac4484f5049f31772ab8401bc9b8fc1fd6ca06d01f01caecb3cbd914ea9574f497df0316a0d56e2830c8a908ba78d1dbe243d0fbc560c407052ec02e9c77f7b12264a46316a777955ae87a71f2da9cef2811f6328ccb288343abb65a36359c07122cb4e6639397829c48dbf8a821ddf00ddec2f294e48d05adfd0f7a706bfc337387bb7923641d08c288d23ed5a2a20f34684549f9f6b3d74ac0f04e10c7dec04aceac369f505d7ccacdf30ea0662cbab001740922e9ac32b6968e0c5a640345d1132e883e07fc82858980489893d0e38960883e989c41e72ee967c00b9a943f0666d1f5e93e848ef @@ -919,7 +919,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44633,6 +44738,7 @@ Entropy.14 = f5ee32b61bd57a4a4d51309e846f636560a8bb2a576c65d37a3f715ff1878014 +@@ -44728,6 +44833,7 @@ Entropy.14 = f5ee32b61bd57a4a4d51309e846f636560a8bb2a576c65d37a3f715ff1878014 Nonce.14 = c638557dae4f9ab6e078c61d54d0f566 Output.14 = e929e6c5c4a629c49fbb8623aea903ea129bb6484ed542cf940dd97bedc292e8bce924ef0cc57fa9b50b17b82618a840375874735560aea57e4e9701e4ecd0e812d1bf9fdecf67f431e4d7f6f455dfe4bd3b9a1553c574b0bfbc933a31580319c97682dd990c7081b711c2fa67a4eb54472be39f634c5dd901848c012c309c43f34d189a72c219acf8ca393d3f2cb292d62bb4d5e88f2b6e5e0422dafeac17415af623473f26ec24e65082123db9b9c00dbce3ca1942269fdf66f14add6c486a00527a39b050c2f3a6bc461e750f6e33236de198742284998bff98b7b3f6566e66679b3d8a1e63561fb5f8228867b8ff92230a9f2a6b9427821b6d55a359994d @@ -927,7 +927,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44713,6 +44819,7 @@ AdditionalInputA.14 = db7b290176b65f826aac2190a912672f8a9c97815706af33732f68b1f7 +@@ -44808,6 +44914,7 @@ AdditionalInputA.14 = db7b290176b65f826aac2190a912672f8a9c97815706af33732f68b1f7 AdditionalInputB.14 = 13425f17d8fbcca3b4d7793a53507a85813f6f50d3365d680c0620d5fe1bfc33 Output.14 = 12d4cfe6574dddbf9de82b8a357bbd6e32a3addb7022c313ac401d0aecfbdfbc7229822f7db9012e8bb0e2907fd48d3eb435ef8368802e5eb948f1bd8d47569b694e23979652f6978b568d7e2288b596afbc67b6c1e0d662240356dc6257d9d273a9ca9f7dfc9bd4175a50ad5b328056c37046e734a76384d7418591a7604f332a457f2fbb277dce4fd2729fdd1319dc3a56b9901a50dc90feaf5969cd9e450bd8716e44253ca55c4e1dcf791658cc467cfba613c27a96f67bd68dd8ccf46bbca4294a0f548b919626d1712ed4290ec90c1098a082699450738d32a8c6516d83bd54a42413bc0ea0b37fe5d6b0663806df67f61d2c553aba3aed3f9aff111d2d @@ -935,7 +935,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44778,6 +44885,7 @@ Nonce.14 = c600da30d68cddd9b823433845111880 +@@ -44873,6 +44980,7 @@ Nonce.14 = c600da30d68cddd9b823433845111880 PersonalisationString.14 = 8896ff67866ff1f59c8e5074d91e6b9112410c9b6a1eefbcf05a1b8c7123dc89 Output.14 = ad8150de910a0bbdad0a674d032919ac3304d5977fc43ad5d5b1fa9be46f22e94f5c2747db228315b0d0505867fd97f9b1582f97b4693ed542c416df1847a85bcd4ad07d6348a4df78412e3df4e675def7f44b1895a8a2156c811040a46198a863c0107aebc3a426b4c2b9ac294b227d323879a70cdf7ceeee7f6f51f102c3ba4ae9a7343aff295b664c869f2c2d6e4396362fdae7d9b5eb0802f37ff7a3a7f1c944044b1bd9b21fbf23f191c6f538398164c2d1b67390e7b059b1c9f5bb031b89a23895ac65770182c8072fb0ad4a7be055d9a4653d08e6b22a61ebdfb66adec2629030f47aca70a06d68c9e1c041ceb2dc9bcd1ceaf61655ef7bbb1653f3d6 @@ -943,7 +943,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44873,6 +44981,7 @@ AdditionalInputA.14 = 4adc98c66aa72da2c63172aba2a6c59fb20aa7b195a0b79edc709bfa99 +@@ -44968,6 +45076,7 @@ AdditionalInputA.14 = 4adc98c66aa72da2c63172aba2a6c59fb20aa7b195a0b79edc709bfa99 AdditionalInputB.14 = 83485ecbf938b8035d047956a3a1bea5adb66c4a7a24b21dfce4269681c31bae Output.14 = 6c69a58a3b27c73ac396840a93ff914219fa80241d39d65890ea612017d7b92b12062fbc0e3c39508c86023f7d70e9b156b4a766465c01c554acd6b5d78568d2087834b3b14f3fdc4d4b959e78ae2fa5298c87321b777afaea4a5c271a584a23a262f8b679cc8198ccd116c88dcf529a6677ebf5189d287f56eb445ad7313acce013b3fe49fb5212cdc3cf8c5ed15aa26b1135d7d9e0570719c4230c104a652fb36ffc57e219e735c03346d18eb57bcba813965bcb39b6a81da624838ba7b9a65d3b684a021f4071c66ce705974f2bd0ce1ad6727136d77529e3b400db0d14ffeabbac877cdf6a38ca66d83492a90482343a5a427ae8b8f77a2f724aa30c11b9 @@ -951,7 +951,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -44923,6 +45032,7 @@ Entropy.14 = 60da58990a377a615436ef43b1199f88c7a4629653dde2350a4c5115c42e52f6 +@@ -45018,6 +45127,7 @@ Entropy.14 = 60da58990a377a615436ef43b1199f88c7a4629653dde2350a4c5115c42e52f6 Nonce.14 = 592033d0de138ae7082c03553e3bfdf9 Output.14 = 7a770dbe8e1d3af1dae5b93acd9e6f1748a4a6a88229a875d23b37665e0cc96d888dfdc428a32cab378a9ebe22409709cd9d11f0c751c08d98eeac13b6f76f0f51ccea254cae23177c3aa207c59b5ce221b93442d037256d553275a6c4b5c83c1fe555a630e37d8277e02c050c19e145a71ec98b96ae3ae44c9ff87c4501c1ff7fd5231510ac9df623b3fb178e147f07d1fe02b48e877cba89a822c91b5af56b71d60116c49f80d87656144854909a7d718b5aa8f071f18357c2c9f9b6c0fac3195040f26b86aa936fd35ff37287aa140cd01ca6c5e577d815790d6fcb1a57569d23e801e2eb2b669ae7cf17d87f9ee66e0b515bcab09087e111da199b6a15b2 @@ -959,7 +959,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -45003,6 +45113,7 @@ AdditionalInputA.14 = 967911f9412d40f2c62e43f48ff965bb1579a2ace388c781e125fe70f4 +@@ -45098,6 +45208,7 @@ AdditionalInputA.14 = 967911f9412d40f2c62e43f48ff965bb1579a2ace388c781e125fe70f4 AdditionalInputB.14 = 052c401de1053b8dea309196bb8e326d4b643371976d1ff6be0a6ea4ad27e5e9 Output.14 = f7e8cdc3f8d2796414b9c83486d746cb8b1675b37d0d7546392c59622c693045dbcb10e9343524a6e7a9cc757717af22ddb8127bcdfb29cb8da409bd69d42aed9708cb2f904dff562a695be004ab25d31b8485bdd677c96d156ce8037726519d1949cc15e91acfd1c7c0bd58058b72c7d340b2f0bb12115ef44af6d20ce5f429d681b614e06bcddbf8ba00b40732b4dd425d1a87b663afce0e9a87b942a543b055f00b2428de12464a1309fccd0a15d512691e3858666ea4dc6084283deb075877c0162dbaf8318c9cda01ca611d72fac0b386a753ef35f438757cdf732a61a1f6123d1de3f61eb072d022f56c679a86f7a05bd6fa420ba39ed2973d4007b9cc @@ -967,7 +967,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -45068,6 +45179,7 @@ Nonce.14 = 0a6bef6b736129740978e31c3fa279e8 +@@ -45163,6 +45274,7 @@ Nonce.14 = 0a6bef6b736129740978e31c3fa279e8 PersonalisationString.14 = a5ca2491479bda16341b2c14339a5307fc2e2f5df4fa625e0ea351a95a14f588 Output.14 = df587647f8d440a6c8034e757cd47f28d0e58f8aad9a047cdc8a70a8b1cd0d8185240d47bc5d2f4657205ed218ec38307e68efad94714630cd490b939719a4a07ab994793112c021969a8c69872903315c74b00b677648673e5883b5f46e075550092914cfeab05454226ee3d2154698f368bfda0b8b99eff5d111c1649a0f7e67ec0f637c6d3466994d655066a95732590e521ca055b048dbafd219be1a04fcd047c3722c4adf29ebd8486e7171359292e11ac6b740b4d51093383d64d2a45e51115c689ae29357366f2013eb9b420c6bd069d22c2110182e842eccadae81797a5f57d9ff47311f094ea0a25d7e329fcccb93c28b92ed85ccc2d690a84f2b2a @@ -975,7 +975,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 0 -@@ -68233,6 +68345,7 @@ Output.14 = 6af689cec62a633492f6e24b754d38dd6ab0b556e91802d72f14dc8c0e9ff50df728 +@@ -68376,6 +68488,7 @@ Output.14 = 6af689cec62a633492f6e24b754d38dd6ab0b556e91802d72f14dc8c0e9ff50df728 Title = HMAC DRBG Prediction Resistance Tests (from NIST test vectors) @@ -983,7 +983,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68313,6 +68426,7 @@ EntropyPredictionResistanceA.14 = ae706e740dda50209b20acf90dfa8cec +@@ -68456,6 +68569,7 @@ EntropyPredictionResistanceA.14 = ae706e740dda50209b20acf90dfa8cec EntropyPredictionResistanceB.14 = b4d4b4bc7cba4daa285ff88ce9e8d451 Output.14 = 74acba48f0216087f18042ff14101707c27d281e5ddbc19c722bec3f77bf17ca31239382f4fc1d4dd0f44c296bc2f10f74864951f7da19a23e3e598ac43fb8bbdd1fca8047b98689ef1c05bc81102bb5 @@ -991,7 +991,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68423,6 +68537,7 @@ AdditionalInputB.14 = ccdb3f7d7f6a4d169f5f2e24ec481fcb +@@ -68566,6 +68680,7 @@ AdditionalInputB.14 = ccdb3f7d7f6a4d169f5f2e24ec481fcb EntropyPredictionResistanceB.14 = be4a2c87c875be0e1be01aadf2efeef6 Output.14 = bfcc8f2ece23d22545ec2176aabd083855923ca9a673b54b66a3e2562212aad3cc74c4c8976de259cc95a2f09a85b7acd1f18c343eff0368a80e73a547efdcd954816b38df1c19556d714897e317d69f @@ -999,7 +999,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68518,6 +68633,7 @@ EntropyPredictionResistanceA.14 = f324c09f96434ceea7e756fc2f55a0b3 +@@ -68661,6 +68776,7 @@ EntropyPredictionResistanceA.14 = f324c09f96434ceea7e756fc2f55a0b3 EntropyPredictionResistanceB.14 = f043b6e11fc2f671ec00f4d478b791c6 Output.14 = 40e87b822b1000441884a38b8776baa69fbea99962571e8a20d8af012d50c8c211860ad579869ec880320ea8057d5cb0de9496ec57d8b594ca8be5b94219eaa800af7205f8a83b66c87e0fee9aa9732f @@ -1007,7 +1007,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68643,6 +68759,7 @@ AdditionalInputB.14 = 0d5a2183c9f9ca6941f6a617892f5e47 +@@ -68786,6 +68902,7 @@ AdditionalInputB.14 = 0d5a2183c9f9ca6941f6a617892f5e47 EntropyPredictionResistanceB.14 = 998f9cde45b1dc22db6d2d7bfd4f3930 Output.14 = 934fe82b0951b97dafc5ba16e87b0459691156b42ff2dbbbd8f6ed9b04be952af267c6a17fbfc86de91f9f07eed482a5362b176216a8963af485503ba93b2e82c03a3ee6225077d90cd961e24f6026f6 @@ -1015,7 +1015,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68723,6 +68840,7 @@ EntropyPredictionResistanceA.14 = 427b47ed008e489cfd06e1a6e0a9f07b +@@ -68866,6 +68983,7 @@ EntropyPredictionResistanceA.14 = 427b47ed008e489cfd06e1a6e0a9f07b EntropyPredictionResistanceB.14 = e5ee8df96c0e929446502a4bbd23ab22 Output.14 = a544ea7c3362570f48a42635f4b79f615d11a5d8a480d85ac71e4be90074fbd5e2d368d00755e95a262d79ed262003d3e2a26f82c37d091ae763a01fba08c87b3ec0ce817bbab8d1905f91f021b7d7d0 @@ -1023,7 +1023,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68833,6 +68951,7 @@ AdditionalInputB.14 = 3e95f86a7168410eac0c84995c187fd9 +@@ -68976,6 +69094,7 @@ AdditionalInputB.14 = 3e95f86a7168410eac0c84995c187fd9 EntropyPredictionResistanceB.14 = fd15dfdd8cfeeb7ce0c76f759dfd47df Output.14 = 480d9cbbfa6c923866179318b293c52c9ad86c2ee27faa745873a77d0242afe669d1773fd9c17284097ee8e644aa054deefbb9c73732ba6b5004623df15edeb49ef2e1bc8dbe023f7104ea1395d9fd38 @@ -1031,7 +1031,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -68928,6 +69047,7 @@ EntropyPredictionResistanceA.14 = 845decbe6e03e423b3660bfe7db383bf +@@ -69071,6 +69190,7 @@ EntropyPredictionResistanceA.14 = 845decbe6e03e423b3660bfe7db383bf EntropyPredictionResistanceB.14 = f4ee7409c076201255bc78ec82ca5530 Output.14 = ac57a08b77c528b834df2757069b6330f05a9196fbbb17300f9c31ef596f551ecc56fa3256c0ab1534df4955f2da1e8d98026b7c5e07290faa5131a95d0fa35a56b075752656ab61a74f889fbb735c58 @@ -1039,7 +1039,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69053,6 +69173,7 @@ AdditionalInputB.14 = 063e444dc2990f59e04839fd5e9eaeb6 +@@ -69196,6 +69316,7 @@ AdditionalInputB.14 = 063e444dc2990f59e04839fd5e9eaeb6 EntropyPredictionResistanceB.14 = e059229538a827fe9b7e5caa44fb1e3d Output.14 = 62efebd7730c6999fd052b98e2bf26eebc96b617a03fe2f1aa7ea3be1aea833f705a3ef3776adc7578f5bb6955a60853ef267fbc18aa3d57b8e0d9134c81e8ffadd0c66d385e5d535d74a615fa896757 @@ -1047,7 +1047,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69133,6 +69254,7 @@ EntropyPredictionResistanceA.14 = 74b72e7e1c5f16bf0389dafed9a86ae4 +@@ -69276,6 +69397,7 @@ EntropyPredictionResistanceA.14 = 74b72e7e1c5f16bf0389dafed9a86ae4 EntropyPredictionResistanceB.14 = adef9418a342b4717e93df6450429a38 Output.14 = eae51f34bfaa2970f41c3211ec228cfccc1d3c0fcc077d1d9ba159b3bac8685bc5783f61c67fdd4beca05dd4f14afcfc4d554ae75f73842637671102c3b81cabc9a0638cecad5a6615171be5265d5454 @@ -1055,7 +1055,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69243,6 +69365,7 @@ AdditionalInputB.14 = 696d9380b814b456ca59ed58ea765400 +@@ -69386,6 +69508,7 @@ AdditionalInputB.14 = 696d9380b814b456ca59ed58ea765400 EntropyPredictionResistanceB.14 = d57fb196a634da13ba8695098ed79f9c Output.14 = 069848aef419759b75896cd507a109f685228b5639470afeac0caa853f1c3dbe373f99db76bf06fe8bac356bedf6bf18787043970fb0a185c8a0a4d8482aa3059eeba0d244fc03c9b72857dc5188d44b @@ -1063,7 +1063,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69338,6 +69461,7 @@ EntropyPredictionResistanceA.14 = 015ef1f359f60a391b3720d578731070 +@@ -69481,6 +69604,7 @@ EntropyPredictionResistanceA.14 = 015ef1f359f60a391b3720d578731070 EntropyPredictionResistanceB.14 = 963736987090fe71e69b4a2480d9b314 Output.14 = c75a102bea830a8a58d9a9a43cb03b21aea75d8d2a08c37aaae9180a5e1c78e5700b20a5fe1c7ef0a7e3d2adcf539c4c1357946a328a057e719b97d802b586910f804c166d4884d8bbb3bbc03074c53a @@ -1071,7 +1071,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69463,6 +69587,7 @@ AdditionalInputB.14 = e0b7ad60c542e6c2b324652fd2d7cdc6 +@@ -69606,6 +69730,7 @@ AdditionalInputB.14 = e0b7ad60c542e6c2b324652fd2d7cdc6 EntropyPredictionResistanceB.14 = dc7ea852c3e5467977c7946e77223567 Output.14 = 0e2e5f47ca8ce1c7fdae1b49d6bc8594da1458eb8dfb35e0602d3812df7532cf6213eba8e75302444529565c40d23d0a336c4cadde37f0def2c3d412984360b65c668ef43263fada16b28860f6ee6ceb @@ -1079,7 +1079,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69543,6 +69668,7 @@ EntropyPredictionResistanceA.14 = 4912a46c447c2de26dbbaec01817d2a6 +@@ -69686,6 +69811,7 @@ EntropyPredictionResistanceA.14 = 4912a46c447c2de26dbbaec01817d2a6 EntropyPredictionResistanceB.14 = c182dc35363cd7e04394c28030e6d6b9 Output.14 = 976daafdf1dd5163e88a928d91933678cda9c8ef9a8251070ee8a6b42efda3c00a73303d0426da4a4af7c587174dce9936bfbb68a73979afee9f3a5b4fb4da2eb2b2f2f1c0948b63b45bf583412b2890 @@ -1087,7 +1087,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69653,6 +69779,7 @@ AdditionalInputB.14 = 8022a4985c745515682102a25b379301 +@@ -69796,6 +69922,7 @@ AdditionalInputB.14 = 8022a4985c745515682102a25b379301 EntropyPredictionResistanceB.14 = 8cc2d8a789d343547ee48869f57ae225 Output.14 = 5707c544445358767b1c4d6c319b6a8d9be38afbf945dd4e869e9136d63c9d74aa872139e8bdd374510ebcf8c36c39e45ff31596fa58721c2a089dea7b418b3f7a00d78c6ba531adbb59ae2ab44bb683 @@ -1095,7 +1095,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -69748,6 +69875,7 @@ EntropyPredictionResistanceA.14 = 701b8e70583effd1c4e901c50966127e +@@ -69891,6 +70018,7 @@ EntropyPredictionResistanceA.14 = 701b8e70583effd1c4e901c50966127e EntropyPredictionResistanceB.14 = 40e9ad701b63ee7bd6132d7f056a1f09 Output.14 = a76b3e058ed1a8ca5860b15abe08a607894207d3d3be5bf6c3dc99c01523c85bf18927bc6d3f66cfef63a238aaef1ee87998100faabeef0d2518f3ccc0423d776a440ec9a87c5601fdf45c309c264dcd @@ -1103,7 +1103,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-1 PredictionResistance = 1 -@@ -76340,6 +76468,7 @@ EntropyPredictionResistanceA.14 = a918ec35414b0bf1d9ba3b80ef838e75b9504fb6b77e40 +@@ -76483,6 +76611,7 @@ EntropyPredictionResistanceA.14 = a918ec35414b0bf1d9ba3b80ef838e75b9504fb6b77e40 EntropyPredictionResistanceB.14 = c25de5d8b1f17acb7303c4a652ea1bcf284bfdc08a12c40ece16e3125fc8757e Output.14 = a3072880e72e76ec1e467d7c4f4ab8013eca926c96f075a0a25f5550931f4d6b3aff2057ae6fc1382d579e8963ee24459d76d7414d250aaf5b302a539775862e26596176de2891589defa7aa66f763126c7fb7ced0fa80f3f5e1f0d15295e6025fad617e554838876c8c8efb4bef1e1227a1c967afe99540c1992328a70798167eaea5a768f1f4395178dc914cde01b8e6b98266a66c5c079e19e5d3b6599c6dec24e8e155b310164299d1b4d31ab2e0c3b917b0cb627a4cc19c86061c74c849aab764feacd33de7472b7c4e1403cb38f8f1c3062e75966b2e2c0b2d7d966271f3d180440aa2ed2194bbf7d8b9415a5c5bb7f3df7cf2d02740cd4366ee3781a9 @@ -1111,7 +1111,7 @@ index 9756859c0e..9baecf6f31 100644 RAND = HMAC-DRBG Digest = SHA-512 PredictionResistance = 1 -@@ -79795,29 +79924,29 @@ Result = EVP_RAND_CTX_set_params +@@ -79938,29 +80067,29 @@ Result = EVP_RAND_CTX_set_params Title = Test FIPS indicator callbacks for truncated digests @@ -1164,7 +1164,7 @@ index 9756859c0e..9baecf6f31 100644 Availablein = fips FIPSversion = >=3.4.0 -@@ -79831,14 +79960,14 @@ Output.0 = ee9f +@@ -79974,14 +80103,14 @@ Output.0 = ee9f Result = EVP_RAND_CTX_set_params Reason = digest not allowed @@ -1191,5 +1191,5 @@ index 9756859c0e..9baecf6f31 100644 +#Nonce.0 = 15e32abbae6b7433 +#Output.0 = ee9f -- -2.52.0 +2.55.0 diff --git a/0034-FIPS-PBKDF2-Set-minimum-password-length.patch b/0034-FIPS-PBKDF2-Set-minimum-password-length.patch index 36c7b19..69b2d4b 100644 --- a/0034-FIPS-PBKDF2-Set-minimum-password-length.patch +++ b/0034-FIPS-PBKDF2-Set-minimum-password-length.patch @@ -1,4 +1,4 @@ -From 0be17f1220667a7c7758e10dead4be80d521b3fc Mon Sep 17 00:00:00 2001 +From 8e0ea541a46dde7f41101cdb5e54fe686dfafe62 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 34/57] FIPS: PBKDF2: Set minimum password length @@ -117,5 +117,5 @@ index 581c8f8799..cc15db4c73 100644 if (!passed) { ERR_raise(ERR_LIB_PROV, error); -- -2.52.0 +2.55.0 diff --git a/0035-FIPS-DH-PCT.patch b/0035-FIPS-DH-PCT.patch index f8724b4..02c24aa 100644 --- a/0035-FIPS-DH-PCT.patch +++ b/0035-FIPS-DH-PCT.patch @@ -1,4 +1,4 @@ -From a1ee967fae9cb6f4a06d4ffbcd62c6efd9ac05f0 Mon Sep 17 00:00:00 2001 +From 1f1739fa82c67be565e4a7af691ca39224572eb2 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 24 Mar 2025 10:49:00 -0400 Subject: [PATCH 35/57] FIPS: DH: PCT @@ -69,5 +69,5 @@ index 2d9f7a8100..ae47dc2cd9 100644 ok = 1; err: -- -2.52.0 +2.55.0 diff --git a/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch b/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch index a5d6f55..7818997 100644 --- a/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch +++ b/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch @@ -1,4 +1,4 @@ -From a7ddcb6ceef64c92b5c21389900477bc3a38f46d Mon Sep 17 00:00:00 2001 +From 0f6a3214e4eecd4de0bac7b44e39f5293bc26f19 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 36/57] FIPS: DH: Disable FIPS 186-4 type parameters @@ -39,7 +39,7 @@ NOTE: Dropped changes in test/recipes/80-test_cms.t 11 files changed, 119 insertions(+), 21 deletions(-) diff --git a/crypto/dh/dh_backend.c b/crypto/dh/dh_backend.c -index f68429862c..00b229a295 100644 +index 77b0b3257f..911f602938 100644 --- a/crypto/dh/dh_backend.c +++ b/crypto/dh/dh_backend.c @@ -47,6 +47,16 @@ int ossl_dh_params_fromdata(DH *dh, const OSSL_PARAM params[]) @@ -60,7 +60,7 @@ index f68429862c..00b229a295 100644 if (param_priv_len != NULL && (!OSSL_PARAM_get_long(param_priv_len, &priv_len) diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c -index 3002609b68..2aabdd2908 100644 +index 8787945f8a..8122916f74 100644 --- a/crypto/dh/dh_check.c +++ b/crypto/dh/dh_check.c @@ -58,13 +58,15 @@ int DH_check_params(const DH *dh, int *ret) @@ -184,7 +184,7 @@ index dd36dce281..21ac48c1de 100644 DH_free(ret); return NULL; diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c -index 8a1afe7907..759ab77e1b 100644 +index eac99a4fed..46a8e8066d 100644 --- a/providers/implementations/keymgmt/dh_kmgmt.c +++ b/providers/implementations/keymgmt/dh_kmgmt.c @@ -420,6 +420,11 @@ static int dh_validate(const void *keydata, int selection, int checktype) @@ -200,10 +200,10 @@ index 8a1afe7907..759ab77e1b 100644 /* * Both of these functions check parameters. DH_check_params_ex() diff --git a/test/endecode_test.c b/test/endecode_test.c -index c3b55af3e7..b15bab217e 100644 +index 93347bed40..3dfb1cb56f 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c -@@ -85,10 +85,10 @@ static EVP_PKEY *make_template(const char *type, OSSL_PARAM *genparams) +@@ -87,10 +87,10 @@ static EVP_PKEY *make_template(const char *type, OSSL_PARAM *genparams) * for testing only. Use a minimum key size of 2048 for security purposes. */ if (strcmp(type, "DH") == 0) @@ -217,7 +217,7 @@ index c3b55af3e7..b15bab217e 100644 /* diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c -index 3786c567a7..773210fadb 100644 +index 0c96f735ad..57ca0e07b4 100644 --- a/test/evp_libctx_test.c +++ b/test/evp_libctx_test.c @@ -222,7 +222,7 @@ static int do_dh_param_keygen(int tstid, const BIGNUM **bn) @@ -230,10 +230,10 @@ index 3786c567a7..773210fadb 100644 if (expected) { diff --git a/test/helpers/predefined_dhparams.c b/test/helpers/predefined_dhparams.c -index 28070efdb6..4baeb673f3 100644 +index ef71b4498d..59c7776c38 100644 --- a/test/helpers/predefined_dhparams.c +++ b/test/helpers/predefined_dhparams.c -@@ -311,6 +311,68 @@ EVP_PKEY *get_dhx512(OSSL_LIB_CTX *libctx) +@@ -120,6 +120,68 @@ EVP_PKEY *get_dhx512(OSSL_LIB_CTX *libctx) dhx512_q, sizeof(dhx512_q)); } @@ -329,5 +329,5 @@ index 6332aaec4b..4d8c900c00 100755 'test sslv2/sslv3 with 1024bit DHE via BIO pair'); } -- -2.52.0 +2.55.0 diff --git a/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch b/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch index 15ec4f4..6573c35 100644 --- a/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch +++ b/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch @@ -1,4 +1,4 @@ -From 0f4b67897d87b6cb1bd1f65ca2aafbce1c3c6872 Mon Sep 17 00:00:00 2001 +From 8a8136eaa70356abf2ea095e10dfb4f0ed6ea2d6 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:17 +0100 Subject: [PATCH 37/57] FIPS: TLS: Enforce EMS in TLS 1.2 - NOTE @@ -25,10 +25,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 9 files changed, 47 insertions(+), 6 deletions(-) diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod -index 3e2de6e66b..ad9a2dc8bf 100644 +index e78a2231da..60ed79f410 100644 --- a/doc/man3/SSL_CONF_cmd.pod +++ b/doc/man3/SSL_CONF_cmd.pod -@@ -626,6 +626,9 @@ B: use extended master secret extension, enabled by +@@ -624,6 +624,9 @@ B: use extended master secret extension, enabled by default. Inverse of B: that is, B<-ExtendedMasterSecret> is the same as setting B. @@ -63,7 +63,7 @@ index 2505938c13..3887c54f0e 100644 Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in -index 82410670f4..1026a9b7b0 100644 +index 81f6a19ce7..fbe9f1dda3 100644 --- a/include/openssl/ssl.h.in +++ b/include/openssl/ssl.h.in @@ -432,6 +432,7 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg); @@ -98,7 +98,7 @@ index 0d93593880..4361edfa49 100644 SSL_FLAG_TBL("AllowNoDHEKEX", SSL_OP_ALLOW_NO_DHE_KEX), SSL_FLAG_TBL("PreferNoDHEKEX", SSL_OP_PREFER_NO_DHE_KEX), diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c -index cdb914daed..1bcc0fd902 100644 +index 5218547f59..d5c1b39d1f 100644 --- a/ssl/statem/extensions_srvr.c +++ b/ssl/statem/extensions_srvr.c @@ -12,6 +12,7 @@ @@ -109,7 +109,7 @@ index cdb914daed..1bcc0fd902 100644 #define COOKIE_STATE_FORMAT_VERSION 1 -@@ -1889,8 +1890,13 @@ EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt, +@@ -1898,8 +1899,13 @@ EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { @@ -177,7 +177,7 @@ index 50944328cb..edb2e81273 100644 KDF = TLS1-PRF Ctrl.digest = digest:SHA256 diff --git a/test/sslapitest.c b/test/sslapitest.c -index a94061d974..92a33f05db 100644 +index f0aeaf8b89..1873b4ab83 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -582,7 +582,7 @@ static int test_client_cert_verify_cb(void) @@ -190,5 +190,5 @@ index a94061d974..92a33f05db 100644 if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), TLS_client_method(), TLS1_VERSION, 0, -- -2.52.0 +2.55.0 diff --git a/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch b/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch index 1153832..f44ecbe 100644 --- a/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch +++ b/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch @@ -1,4 +1,4 @@ -From c91c7412ab54f8db8cac437e7308a9042c7a4732 Mon Sep 17 00:00:00 2001 +From c341480581a25da55196ba0b466ffad50d08ee34 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 13 Feb 2025 18:08:34 -0500 Subject: [PATCH 38/57] FIPS: CMS: Set default padding to OAEP @@ -22,7 +22,7 @@ index 214eea5bcb..c1fc70ef12 100644 static int save_certs(char *signerfile, STACK_OF(X509) *signers); static int cms_cb(int ok, X509_STORE_CTX *ctx); diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c -index 0828d157fa..e1200a37d4 100644 +index ee86ae71d3..a3b0856046 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -14,6 +14,7 @@ @@ -57,5 +57,5 @@ index 0828d157fa..e1200a37d4 100644 if (EVP_PKEY_encrypt(pctx, NULL, &eklen, ec->key, ec->keylen) <= 0) -- -2.52.0 +2.55.0 diff --git a/0039-FIPS-PKCS12-PBMAC1-defaults.patch b/0039-FIPS-PKCS12-PBMAC1-defaults.patch index 2609c2f..60edf46 100644 --- a/0039-FIPS-PKCS12-PBMAC1-defaults.patch +++ b/0039-FIPS-PKCS12-PBMAC1-defaults.patch @@ -1,4 +1,4 @@ -From 51fc5ce32bfe0fbe018934fa88252efe9073c649 Mon Sep 17 00:00:00 2001 +From 2bbf046d3610da70df48eafd372f7742b2f665e3 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 13 Feb 2025 18:16:29 -0500 Subject: [PATCH 39/57] FIPS: PKCS12: PBMAC1 defaults @@ -31,5 +31,5 @@ index 2c83e43845..20aad27c59 100644 if (!PKCS12_set_pbmac1_pbkdf2(p12, mpass, -1, NULL, macsaltlen, maciter, -- -2.52.0 +2.55.0 diff --git a/0040-FIPS-Fix-encoder-decoder-negative-test.patch b/0040-FIPS-Fix-encoder-decoder-negative-test.patch index 2eb94f5..d3094a3 100644 --- a/0040-FIPS-Fix-encoder-decoder-negative-test.patch +++ b/0040-FIPS-Fix-encoder-decoder-negative-test.patch @@ -1,4 +1,4 @@ -From 7b7ade7e1ee2f6b10b34bf7f9e7a0165474f5860 Mon Sep 17 00:00:00 2001 +From f63ddd633a81a05890989535016f0af692a0c919 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 5 Mar 2025 13:22:03 -0500 Subject: [PATCH 40/57] FIPS: Fix encoder/decoder negative test @@ -31,5 +31,5 @@ index 2acc980e90..660d4e1115 my $conf2 = srctop_file("test", "default-and-fips.cnf"); ok(run(test(['decoder_propq_test', '-config', $conf2, -- -2.52.0 +2.55.0 diff --git a/0041-FIPS-EC-DH-DSA-PCTs.patch b/0041-FIPS-EC-DH-DSA-PCTs.patch index 84dec4d..f9e21da 100644 --- a/0041-FIPS-EC-DH-DSA-PCTs.patch +++ b/0041-FIPS-EC-DH-DSA-PCTs.patch @@ -1,4 +1,4 @@ -From 17caabce423bbcfe0501ebaa11c2d4a8379aca92 Mon Sep 17 00:00:00 2001 +From 39add9b309bac2f393cf757be6d562def249a145 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 24 Mar 2025 10:50:06 -0400 Subject: [PATCH 41/57] FIPS: EC: DH/DSA PCTs @@ -41,7 +41,7 @@ index 43f3515878..0d35fc1590 100644 retlen = ECDH_compute_key(secret, size, ppubkey, privk, NULL); diff --git a/providers/implementations/keymgmt/ec_kmgmt.c b/providers/implementations/keymgmt/ec_kmgmt.c -index 305dc3a6b8..04e604c453 100644 +index 1d740307f6..80c13b3076 100644 --- a/providers/implementations/keymgmt/ec_kmgmt.c +++ b/providers/implementations/keymgmt/ec_kmgmt.c @@ -963,9 +963,18 @@ struct ec_gen_ctx { @@ -87,7 +87,7 @@ index 305dc3a6b8..04e604c453 100644 if (gctx->group_check != NULL) ret = ret && ossl_ec_set_check_group_type_from_name(ec, gctx->group_check); -@@ -1379,7 +1398,10 @@ static void ec_gen_cleanup(void *genctx) +@@ -1365,7 +1384,10 @@ static void ec_gen_cleanup(void *genctx) if (gctx == NULL) return; @@ -100,7 +100,7 @@ index 305dc3a6b8..04e604c453 100644 EC_GROUP_free(gctx->gen_group); BN_free(gctx->p); diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c -index f5c101005f..b1576977f7 100644 +index b65e7d58a0..65f294135f 100644 --- a/providers/implementations/signature/ecdsa_sig.c +++ b/providers/implementations/signature/ecdsa_sig.c @@ -33,7 +33,7 @@ @@ -139,7 +139,7 @@ index f5c101005f..b1576977f7 100644 { PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx; -@@ -854,6 +854,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx) +@@ -851,6 +851,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx) return EVP_MD_settable_ctx_params(ctx->md); } @@ -176,5 +176,5 @@ index f5c101005f..b1576977f7 100644 { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ecdsa_newctx }, { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))ecdsa_sign_init }, -- -2.52.0 +2.55.0 diff --git a/0042-FIPS-EC-disable-weak-curves.patch b/0042-FIPS-EC-disable-weak-curves.patch index 763df95..09e89ff 100644 --- a/0042-FIPS-EC-disable-weak-curves.patch +++ b/0042-FIPS-EC-disable-weak-curves.patch @@ -1,4 +1,4 @@ -From 2cda3e9adf5534d6be689cff5eeb81459061f52b Mon Sep 17 00:00:00 2001 +From fc9f1fdf78d78e2628e1a407a11dfdc4535e80f4 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:06:36 -0500 Subject: [PATCH 42/57] FIPS: EC: disable weak curves @@ -27,5 +27,5 @@ index 017dc7568d..596c31a925 100644 comment = "CURVE DESCRIPTION NOT AVAILABLE"; if (sname == NULL) -- -2.52.0 +2.55.0 diff --git a/0043-FIPS-NO-DSA-Support.patch b/0043-FIPS-NO-DSA-Support.patch index a7a1ffa..657e7f1 100644 --- a/0043-FIPS-NO-DSA-Support.patch +++ b/0043-FIPS-NO-DSA-Support.patch @@ -1,4 +1,4 @@ -From 9fca36a6c0712f3c11e6ba942e99039b17fc75b0 Mon Sep 17 00:00:00 2001 +From f56be05d41df23c0d87b4090730f9acbd12829db Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:10:52 -0500 Subject: [PATCH 43/57] FIPS: NO DSA Support @@ -18,10 +18,10 @@ Signed-off-by: Simo Sorce mode change 100644 => 100755 test/recipes/30-test_evp.t diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c -index 0f006301d7..f8f2822300 100644 +index 7928bd0e55..f16960b77b 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c -@@ -431,7 +431,8 @@ static const OSSL_ALGORITHM fips_keyexch[] = { +@@ -430,7 +430,8 @@ static const OSSL_ALGORITHM fips_keyexch[] = { }; static const OSSL_ALGORITHM fips_signature[] = { @@ -31,7 +31,7 @@ index 0f006301d7..f8f2822300 100644 { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions }, { PROV_NAMES_DSA_SHA1, FIPS_DEFAULT_PROPERTIES, ossl_dsa_sha1_signature_functions }, { PROV_NAMES_DSA_SHA224, FIPS_DEFAULT_PROPERTIES, ossl_dsa_sha224_signature_functions }, -@@ -559,8 +560,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { +@@ -558,8 +559,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { PROV_DESCS_DHX }, #endif #ifndef OPENSSL_NO_DSA @@ -44,10 +44,10 @@ index 0f006301d7..f8f2822300 100644 { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_keymgmt_functions, PROV_DESCS_RSA }, diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc -index 6abab0a7a1..a7d7684d96 100644 +index 4a0ce24cbb..84b0b1c5c1 100644 --- a/providers/fips/self_test_data.inc +++ b/providers/fips/self_test_data.inc -@@ -1547,8 +1547,9 @@ static const unsigned char ed448_expected_sig[] = { +@@ -1546,8 +1546,9 @@ static const unsigned char ed448_expected_sig[] = { # endif /* OPENSSL_NO_ECX */ #endif /* OPENSSL_NO_EC */ @@ -58,7 +58,7 @@ index 6abab0a7a1..a7d7684d96 100644 static const unsigned char dsa_p[] = { 0xa2, 0x9b, 0x88, 0x72, 0xce, 0x8b, 0x84, 0x23, 0xb7, 0xd5, 0xd2, 0x1d, 0x4b, 0x02, 0xf5, 0x7e, -@@ -1676,6 +1677,7 @@ static const ST_KAT_PARAM dsa_key[] = { +@@ -1675,6 +1676,7 @@ static const ST_KAT_PARAM dsa_key[] = { ST_KAT_PARAM_END() }; #endif /* OPENSSL_NO_DSA */ @@ -66,7 +66,7 @@ index 6abab0a7a1..a7d7684d96 100644 #ifndef OPENSSL_NO_ML_DSA static const unsigned char ml_dsa_65_pub_key[] = { -@@ -3038,6 +3040,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { +@@ -3037,6 +3039,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { }, # endif /* OPENSSL_NO_ECX */ #endif /* OPENSSL_NO_EC */ @@ -74,7 +74,7 @@ index 6abab0a7a1..a7d7684d96 100644 #ifndef OPENSSL_NO_DSA { OSSL_SELF_TEST_DESC_SIGN_DSA, -@@ -3050,6 +3053,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { +@@ -3049,6 +3052,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { ITM(dsa_expected_sig) }, #endif /* OPENSSL_NO_DSA */ @@ -103,10 +103,10 @@ index 15c87c57a7..e3321874c2 100644 #ifndef OPENSSL_NO_EC ec_cofactors = fips_provider_version_ge(libctx, 3, 4, 0); diff --git a/test/endecode_test.c b/test/endecode_test.c -index b15bab217e..acfb5ef36d 100644 +index 3dfb1cb56f..634072de68 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c -@@ -1549,6 +1549,7 @@ int setup_tests(void) +@@ -1952,6 +1952,7 @@ int setup_tests(void) * so no legacy tests. */ #endif @@ -114,7 +114,7 @@ index b15bab217e..acfb5ef36d 100644 #ifndef OPENSSL_NO_DSA ADD_TEST_SUITE(DSA); ADD_TEST_SUITE_PARAMS(DSA); -@@ -1559,6 +1560,7 @@ int setup_tests(void) +@@ -1962,6 +1963,7 @@ int setup_tests(void) ADD_TEST_SUITE_PROTECTED_PVK(DSA); #endif #endif @@ -136,10 +136,10 @@ index cd331c4cfc..e21d6acda4 100644 plan tests => ($no_fips ? 0 : 2) # FIPS related tests diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t -index 2abc4d2434..9a6875b3ec 100644 +index fd8842b867..64935ca824 100644 --- a/test/recipes/20-test_cli_fips.t +++ b/test/recipes/20-test_cli_fips.t -@@ -283,8 +283,7 @@ SKIP: { +@@ -321,8 +321,7 @@ SKIP: { } SKIP : { @@ -302,7 +302,7 @@ index 5e5315a5b9..660d1db149 100644 Key = DSA-2048-160 Input = "Hello" diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index 91283c5e74..beadb43cf4 100644 +index 985c08b9ae..d1462a75c9 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -116,7 +116,7 @@ my @smime_pkcs7_tests = ( @@ -396,5 +396,5 @@ index 91283c5e74..beadb43cf4 100644 "-signer", $smrsa1, "-signer", catfile($smdir, "smrsa2.pem"), -- -2.52.0 +2.55.0 diff --git a/0044-FIPS-NO-DES-support.patch b/0044-FIPS-NO-DES-support.patch index edebf7f..8874f57 100644 --- a/0044-FIPS-NO-DES-support.patch +++ b/0044-FIPS-NO-DES-support.patch @@ -1,4 +1,4 @@ -From 62748c233ae3afb8b0797a7d1ce2f391721d2971 Mon Sep 17 00:00:00 2001 +From 25a7a2d914f588d87885e4cff06bb693f5d4b994 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:15:13 -0500 Subject: [PATCH 44/57] FIPS: NO DES support @@ -14,10 +14,10 @@ Signed-off-by: Simo Sorce 6 files changed, 10 insertions(+), 25 deletions(-) diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c -index f8f2822300..33e1a179cf 100644 +index f16960b77b..16ed6a4a0c 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c -@@ -355,10 +355,6 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = { +@@ -354,10 +354,6 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = { ossl_cipher_capable_aes_cbc_hmac_sha256), ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA256, ossl_aes256cbc_hmac_sha256_functions, ossl_cipher_capable_aes_cbc_hmac_sha256), @@ -29,7 +29,7 @@ index f8f2822300..33e1a179cf 100644 }; static OSSL_ALGORITHM exported_fips_ciphers[OSSL_NELEM(fips_ciphers)]; diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc -index a7d7684d96..d8d23e6f90 100644 +index 84b0b1c5c1..c92e8541a9 100644 --- a/providers/fips/self_test_data.inc +++ b/providers/fips/self_test_data.inc @@ -305,6 +305,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = { @@ -49,10 +49,10 @@ index a7d7684d96..d8d23e6f90 100644 static const char hkdf_digest[] = "SHA256"; diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c -index 773210fadb..e0b4efe3f4 100644 +index 57ca0e07b4..d4da35ae2d 100644 --- a/test/evp_libctx_test.c +++ b/test/evp_libctx_test.c -@@ -984,7 +984,9 @@ int setup_tests(void) +@@ -842,7 +842,9 @@ int setup_tests(void) ADD_TEST(kem_invalid_keytype); #endif #ifndef OPENSSL_NO_DES @@ -141,7 +141,7 @@ index a11e5ffe54..e4a7cbe75e 100644 -Input = FA620C1BBE97319E9A0CF0492121F7A20EB08A6A709DCBD00AAF38E4F99E754E -Output = 8F49A1B7D6AA2258 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index beadb43cf4..71ab4a3910 100644 +index d1462a75c9..8fd99909a5 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -415,7 +415,7 @@ my @smime_cms_tests = ( @@ -154,5 +154,5 @@ index beadb43cf4..71ab4a3910 100644 "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617", "-stream", "-out", "{output}.cms" ], -- -2.52.0 +2.55.0 diff --git a/0045-FIPS-NO-Kmac.patch b/0045-FIPS-NO-Kmac.patch index 97c5cb7..2b53fe9 100644 --- a/0045-FIPS-NO-Kmac.patch +++ b/0045-FIPS-NO-Kmac.patch @@ -1,4 +1,4 @@ -From 7afd41a086ff9d3c39ff592e26d006c769e2a6d7 Mon Sep 17 00:00:00 2001 +From 75ca2b0c1829684e2ecb486d3bef0ac5a6443b47 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Mar 2025 18:22:07 -0500 Subject: [PATCH 45/57] FIPS: NO Kmac @@ -15,10 +15,10 @@ Signed-off-by: Simo Sorce 7 files changed, 39 insertions(+), 86 deletions(-) diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c -index 33e1a179cf..7930cf3241 100644 +index 16ed6a4a0c..f2d11326c1 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c -@@ -294,10 +294,10 @@ static const OSSL_ALGORITHM fips_digests[] = { +@@ -293,10 +293,10 @@ static const OSSL_ALGORITHM fips_digests[] = { * KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for * KMAC128 and KMAC256. */ @@ -31,7 +31,7 @@ index 33e1a179cf..7930cf3241 100644 { NULL, NULL, NULL } }; -@@ -365,8 +365,9 @@ static const OSSL_ALGORITHM fips_macs[] = { +@@ -364,8 +364,9 @@ static const OSSL_ALGORITHM fips_macs[] = { #endif { PROV_NAMES_GMAC, FIPS_DEFAULT_PROPERTIES, ossl_gmac_functions }, { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, ossl_hmac_functions }, @@ -44,7 +44,7 @@ index 33e1a179cf..7930cf3241 100644 }; diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc -index d8d23e6f90..43f7c89fd6 100644 +index c92e8541a9..675789a87d 100644 --- a/providers/fips/self_test_data.inc +++ b/providers/fips/self_test_data.inc @@ -533,6 +533,7 @@ static const ST_KAT_PARAM kbkdf_params[] = { @@ -421,5 +421,5 @@ index 831eecbac9..af92ceea98 100644 -Custom = "" -Output = 75358CF39E41494E949707927CEE0AF20A3FF553904C86B08F21CC414BCFD691589D27CF5E15369CBBFF8B9A4C2EB17800855D0235FF635DA82533EC6B759B69 -- -2.52.0 +2.55.0 diff --git a/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch b/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch index 5081a1e..9ee9e5b 100644 --- a/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch +++ b/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch @@ -1,4 +1,4 @@ -From d6a6afdc614ce0e6273554f50c18cd70000cff01 Mon Sep 17 00:00:00 2001 +From 5e3401812508f7595b5864770bad94644cbba496 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 10 Mar 2025 13:52:50 -0400 Subject: [PATCH 46/57] FIPS: Fix some tests due to our versioning change @@ -102,5 +102,5 @@ index af47842fd8..21c75033e8 100644 my @tests_mldsa_tls_1_3 = ( -- -2.52.0 +2.55.0 diff --git a/0047-Current-Rebase-status.patch b/0047-Current-Rebase-status.patch index 8dff33d..2ae98a5 100644 --- a/0047-Current-Rebase-status.patch +++ b/0047-Current-Rebase-status.patch @@ -1,4 +1,4 @@ -From 607a195b374a6072c87a500713cea78347b7d252 Mon Sep 17 00:00:00 2001 +From d9465a1a9b641340f624bfa63c2785274f88cd66 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 12 Feb 2025 17:25:47 -0500 Subject: [PATCH 47/57] Current Rebase status @@ -102,5 +102,5 @@ index 2833a383c1..c8f6c992a8 100644 +./Configure --prefix=$HOME/tmp/openssl-rebase --openssldir=$HOME/tmp/openssl-rebase/etc/pki/tls enable-ec_nistp_64_gcc_128 --system-ciphers-file=$HOME/tmp/openssl-rebase/etc/crypto-policies/back-ends/opensslcnf.config zlib enable-camellia enable-seed enable-rfc3779 enable-sctp enable-cms enable-md2 enable-rc5 enable-ktls enable-fips no-mdc2 no-ec2m no-sm2 no-sm4 no-atexit enable-buildtest-c++ shared linux-x86_64 $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DOPENSSL_PEDANTIC_ZEROIZATION -DREDHAT_FIPS_VENDOR="\"Red Hat Enterprise Linux OpenSSL FIPS Provider\"" -DREDHAT_FIPS_VERSION="\"3.5.0-4c714d97fd77d1a8\""' -Wl,--allow-multiple-definition + -- -2.52.0 +2.55.0 diff --git a/0048-FIPS-KDF-key-lenght-errors.patch b/0048-FIPS-KDF-key-lenght-errors.patch index a0e76bb..5d4320f 100644 --- a/0048-FIPS-KDF-key-lenght-errors.patch +++ b/0048-FIPS-KDF-key-lenght-errors.patch @@ -1,4 +1,4 @@ -From be07c8ed65b9657227d03b905b9a490bd14bd173 Mon Sep 17 00:00:00 2001 +From 4284e37eb278449637fd7a524d663fddb4d55415 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 14 Apr 2025 15:25:40 -0400 Subject: [PATCH 48/57] FIPS: KDF key lenght errors @@ -171,5 +171,5 @@ index 1fb2472001..93c07ede7c 100644 # Test that the key whose length is shorter than 112 bits is reported as -- -2.52.0 +2.55.0 diff --git a/0049-FIPS-fix-disallowed-digests-tests.patch b/0049-FIPS-fix-disallowed-digests-tests.patch index 0ddd1b7..558508e 100644 --- a/0049-FIPS-fix-disallowed-digests-tests.patch +++ b/0049-FIPS-fix-disallowed-digests-tests.patch @@ -1,4 +1,4 @@ -From 53462749e29bd8f96e52f3f31cf1de2114e896c3 Mon Sep 17 00:00:00 2001 +From 54d48627806bd48d94e06b37917c415921b110f8 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Tue, 15 Apr 2025 13:41:42 -0400 Subject: [PATCH 49/57] FIPS: fix disallowed digests tests @@ -47,5 +47,5 @@ index 6688c217aa..8347f773e6 100644 # Test that the key whose length is shorter than 112 bits is reported as # unapproved -- -2.52.0 +2.55.0 diff --git a/0050-Make-openssl-speed-run-in-FIPS-mode.patch b/0050-Make-openssl-speed-run-in-FIPS-mode.patch index 7766996..3c5aee3 100644 --- a/0050-Make-openssl-speed-run-in-FIPS-mode.patch +++ b/0050-Make-openssl-speed-run-in-FIPS-mode.patch @@ -1,4 +1,4 @@ -From ed9fd546659e691f51df032d6e364cee45c3bf0b Mon Sep 17 00:00:00 2001 +From ac6d6209d562fe7f4845b8d685336fc027635bb6 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Fri, 9 May 2025 15:09:46 +0200 Subject: [PATCH 50/57] Make `openssl speed` run in FIPS mode @@ -8,10 +8,10 @@ Subject: [PATCH 50/57] Make `openssl speed` run in FIPS mode 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/apps/speed.c b/apps/speed.c -index 13c8505ed9..c31e30f235 100644 +index a36faa686d..5b2fe33b59 100644 --- a/apps/speed.c +++ b/apps/speed.c -@@ -3231,18 +3231,18 @@ int speed_main(int argc, char **argv) +@@ -3232,18 +3232,18 @@ int speed_main(int argc, char **argv) (void *)key32, 16); params[1] = OSSL_PARAM_construct_end(); @@ -41,7 +41,7 @@ index 13c8505ed9..c31e30f235 100644 } if (doit[D_KMAC256]) { -@@ -3252,18 +3252,18 @@ int speed_main(int argc, char **argv) +@@ -3253,18 +3253,18 @@ int speed_main(int argc, char **argv) (void *)key32, 32); params[1] = OSSL_PARAM_construct_end(); @@ -72,5 +72,5 @@ index 13c8505ed9..c31e30f235 100644 for (i = 0; i < loopargs_len; i++) -- -2.52.0 +2.55.0 diff --git a/0051-Backport-upstream-27483-for-PKCS11-needs.patch b/0051-Backport-upstream-27483-for-PKCS11-needs.patch index bfcd0bd..17f6dfb 100644 --- a/0051-Backport-upstream-27483-for-PKCS11-needs.patch +++ b/0051-Backport-upstream-27483-for-PKCS11-needs.patch @@ -1,4 +1,4 @@ -From b03deba991f7f0677127f6030fde0011ab30430b Mon Sep 17 00:00:00 2001 +From f5f2478cf04960619344dcbe647fb699ed621a6c Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Mon, 12 May 2025 14:34:39 +0200 Subject: [PATCH 51/57] Backport upstream #27483 for PKCS11 needs @@ -63,10 +63,10 @@ index c75776cce4..7e35b2cc9e 100644 #endif diff --git a/test/evp_skey_test.c b/test/evp_skey_test.c -index 7fd70ca732..dddf92f9da 100644 +index 11b1a4e1cd..37d9c0f578 100644 --- a/test/evp_skey_test.c +++ b/test/evp_skey_test.c -@@ -107,6 +107,66 @@ end: +@@ -93,6 +93,66 @@ end: return ret; } @@ -133,7 +133,7 @@ index 7fd70ca732..dddf92f9da 100644 #define IV_SIZE 16 #define DATA_SIZE 32 static int test_aes_raw_skey(void) -@@ -267,6 +327,7 @@ int setup_tests(void) +@@ -253,6 +313,7 @@ int setup_tests(void) return 0; ADD_TEST(test_skey_cipher); @@ -142,5 +142,5 @@ index 7fd70ca732..dddf92f9da 100644 ADD_TEST(test_aes_raw_skey); #ifndef OPENSSL_NO_DES -- -2.52.0 +2.55.0 diff --git a/0052-Red-Hat-9-FIPS-indicator-defines.patch b/0052-Red-Hat-9-FIPS-indicator-defines.patch index b0095ea..6ab7a55 100644 --- a/0052-Red-Hat-9-FIPS-indicator-defines.patch +++ b/0052-Red-Hat-9-FIPS-indicator-defines.patch @@ -1,4 +1,4 @@ -From 4a6768577382850dd3f3580f232a2a2ac7ed09c2 Mon Sep 17 00:00:00 2001 +From 434784f897cdd5927ffc109599542723a5eb8fd7 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Mon, 12 May 2025 16:21:23 +0200 Subject: [PATCH 52/57] Red Hat 9 FIPS indicator defines @@ -125,5 +125,5 @@ index 262c184ca2..6009253440 100644 'KEM_PARAM_FIPS_KEY_CHECK' => '*PKEY_PARAM_FIPS_KEY_CHECK', 'KEM_PARAM_FIPS_APPROVED_INDICATOR' => '*ALG_PARAM_FIPS_APPROVED_INDICATOR', -- -2.52.0 +2.55.0 diff --git a/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch b/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch index 6632b9f..8291593 100644 --- a/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch +++ b/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch @@ -1,4 +1,4 @@ -From 1b1a5447386cf8a149c4cd603c893a691eb210b5 Mon Sep 17 00:00:00 2001 +From 6bd63b3a1c5267c5c14f57ffecbe7771295dc464 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Fri, 30 May 2025 16:17:37 +0200 Subject: [PATCH 53/57] Allow hybrid MLKEM in FIPS mode @@ -12,10 +12,10 @@ Subject: [PATCH 53/57] Allow hybrid MLKEM in FIPS mode 5 files changed, 105 insertions(+), 15 deletions(-) diff --git a/crypto/ml_kem/ml_kem.c b/crypto/ml_kem/ml_kem.c -index dd8a39197a..833abf9f1d 100644 +index 6c3141ca2d..5a71926c47 100644 --- a/crypto/ml_kem/ml_kem.c +++ b/crypto/ml_kem/ml_kem.c -@@ -1924,6 +1924,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties, +@@ -1965,6 +1965,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties, { const ML_KEM_VINFO *vinfo = ossl_ml_kem_get_vinfo(evp_type); ML_KEM_KEY *key; @@ -23,7 +23,7 @@ index dd8a39197a..833abf9f1d 100644 if (vinfo == NULL) { ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT, -@@ -1934,15 +1935,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties, +@@ -1975,15 +1976,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties, if ((key = OPENSSL_malloc(sizeof(*key))) == NULL) return NULL; @@ -56,7 +56,7 @@ index dbe9192364..35dcbbf32c 100644 +char *get_adjusted_propq(const char *propq); #endif /* OPENSSL_HEADER_ML_KEM_H */ diff --git a/providers/defltprov.c b/providers/defltprov.c -index 90655395c1..f74b160d6f 100644 +index de2a46515e..76bba34b79 100644 --- a/providers/defltprov.c +++ b/providers/defltprov.c @@ -517,8 +517,8 @@ static const OSSL_ALGORITHM deflt_asym_kem[] = { @@ -70,7 +70,7 @@ index 90655395c1..f74b160d6f 100644 #endif #endif { NULL, NULL, NULL } -@@ -594,13 +594,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = { +@@ -598,13 +598,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = { { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_x25519_kem_kmgmt_functions, PROV_DESCS_X25519MLKEM768 }, { PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_x448_kem_kmgmt_functions, @@ -90,7 +90,7 @@ index 90655395c1..f74b160d6f 100644 #endif #ifndef OPENSSL_NO_SLH_DSA diff --git a/providers/implementations/kem/mlx_kem.c b/providers/implementations/kem/mlx_kem.c -index 376b3342dd..09fa003612 100644 +index a917fa93d5..04429e0926 100644 --- a/providers/implementations/kem/mlx_kem.c +++ b/providers/implementations/kem/mlx_kem.c @@ -19,6 +19,7 @@ @@ -148,15 +148,15 @@ index 376b3342dd..09fa003612 100644 if (ctx == NULL || EVP_PKEY_encapsulate_init(ctx, NULL) <= 0 || EVP_PKEY_encapsulate(ctx, cbuf, &encap_clen, sbuf, &encap_slen) <= 0) -@@ -238,6 +263,7 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen, - end: +@@ -242,6 +267,7 @@ end: + ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes); EVP_PKEY_free(xkey); EVP_PKEY_CTX_free(ctx); + OPENSSL_free(adjusted_propq); return ret; } -@@ -253,6 +279,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, +@@ -257,6 +283,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, size_t decap_clen = key->minfo->ctext_bytes + key->xinfo->pubkey_bytes; int ml_kem_slot = key->xinfo->ml_kem_slot; int ret = 0; @@ -164,7 +164,7 @@ index 376b3342dd..09fa003612 100644 if (!mlx_kem_have_prvkey(key)) { ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY); -@@ -288,7 +315,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, +@@ -292,7 +319,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, decap_slen = ML_KEM_SHARED_SECRET_BYTES; cbuf = ctext + ml_kem_slot * key->xinfo->pubkey_bytes; sbuf = shsec + ml_kem_slot * key->xinfo->shsec_bytes; @@ -174,8 +174,8 @@ index 376b3342dd..09fa003612 100644 if (ctx == NULL || EVP_PKEY_decapsulate_init(ctx, NULL) <= 0 || EVP_PKEY_decapsulate(ctx, sbuf, &decap_slen, cbuf, decap_clen) <= 0) -@@ -326,6 +354,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen, - end: +@@ -334,6 +362,7 @@ end: + ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes); EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(xkey); + OPENSSL_free(adjusted_propq); @@ -183,7 +183,7 @@ index 376b3342dd..09fa003612 100644 } diff --git a/providers/implementations/keymgmt/mlx_kmgmt.c b/providers/implementations/keymgmt/mlx_kmgmt.c -index 46ed63039e..6ce9aa3c9a 100644 +index 75267f88e7..7beea2c2f0 100644 --- a/providers/implementations/keymgmt/mlx_kmgmt.c +++ b/providers/implementations/keymgmt/mlx_kmgmt.c @@ -155,6 +155,52 @@ typedef struct export_cb_arg_st { @@ -250,7 +250,7 @@ index 46ed63039e..6ce9aa3c9a 100644 if (len != sub_arg->publen) { ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR, "Unexpected %s public key length %lu != %lu", -@@ -343,12 +393,14 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, +@@ -349,12 +399,14 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, void *val; int ml_kem_slot = key->xinfo->ml_kem_slot; int ret = 0; @@ -265,7 +265,7 @@ index 46ed63039e..6ce9aa3c9a 100644 } else { alg = key->xinfo->algorithm_name; group = (char *)key->xinfo->group_name; -@@ -358,7 +410,8 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, +@@ -364,7 +416,8 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, } val = (void *)(in + off); @@ -275,7 +275,7 @@ index 46ed63039e..6ce9aa3c9a 100644 || EVP_PKEY_fromdata_init(ctx) <= 0) goto err; parr[0] = OSSL_PARAM_construct_octet_string(pname, val, len); -@@ -369,6 +422,7 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, +@@ -375,6 +428,7 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname, ret = 1; err: @@ -283,7 +283,7 @@ index 46ed63039e..6ce9aa3c9a 100644 EVP_PKEY_CTX_free(ctx); return ret; } -@@ -685,6 +739,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) +@@ -697,6 +751,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) PROV_ML_KEM_GEN_CTX *gctx = vgctx; MLX_KEY *key; char *propq; @@ -291,7 +291,7 @@ index 46ed63039e..6ce9aa3c9a 100644 if (gctx == NULL || (gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_PUBLIC_KEY) -@@ -700,8 +755,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) +@@ -712,8 +767,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg) return key; /* For now, using the same "propq" for all components */ @@ -304,5 +304,5 @@ index 46ed63039e..6ce9aa3c9a 100644 key->xinfo->algorithm_name, key->xinfo->group_name); -- -2.52.0 +2.55.0 diff --git a/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch b/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch index 658a8f0..e49d59e 100644 --- a/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch +++ b/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch @@ -1,4 +1,4 @@ -From 3f73722b8e546a3f8f4e8bc7d74527f4fe7c4413 Mon Sep 17 00:00:00 2001 +From 6f965e9d16680ebe78fc855f91a0019878bbba0c Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Tue, 15 Jul 2025 12:32:14 -0400 Subject: [PATCH 54/57] Temporarily disable SLH-DSA FIPS self-tests @@ -9,10 +9,10 @@ Signed-off-by: Simo Sorce 1 file changed, 6 insertions(+) diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc -index 43f7c89fd6..7b03aad775 100644 +index 675789a87d..b83528a7f3 100644 --- a/providers/fips/self_test_data.inc +++ b/providers/fips/self_test_data.inc -@@ -2886,6 +2886,7 @@ static const ST_KAT_PARAM ml_dsa_sig_init[] = { +@@ -2885,6 +2885,7 @@ static const ST_KAT_PARAM ml_dsa_sig_init[] = { }; #endif /* OPENSSL_NO_ML_DSA */ @@ -20,7 +20,7 @@ index 43f7c89fd6..7b03aad775 100644 #ifndef OPENSSL_NO_SLH_DSA /* * Deterministic SLH_DSA key generation supplies the private key elements and -@@ -2976,6 +2977,7 @@ static const unsigned char slh_dsa_shake_128f_sig_digest[] = { +@@ -2975,6 +2976,7 @@ static const unsigned char slh_dsa_shake_128f_sig_digest[] = { 0x89, 0x77, 0x00, 0x72, 0x03, 0x92, 0xd1, 0xa6, }; #endif /* OPENSSL_NO_SLH_DSA */ @@ -28,7 +28,7 @@ index 43f7c89fd6..7b03aad775 100644 /* Hash DRBG inputs for signature KATs */ static const unsigned char sig_kat_entropyin[] = { -@@ -3075,6 +3077,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { +@@ -3074,6 +3076,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { ml_dsa_sig_init }, #endif /* OPENSSL_NO_ML_DSA */ @@ -36,7 +36,7 @@ index 43f7c89fd6..7b03aad775 100644 #ifndef OPENSSL_NO_SLH_DSA /* * FIPS 140-3 IG 10.3.A.16 Note 29 says: -@@ -3105,6 +3108,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { +@@ -3104,6 +3107,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = { slh_dsa_sig_params, slh_dsa_sig_params }, #endif /* OPENSSL_NO_SLH_DSA */ @@ -44,7 +44,7 @@ index 43f7c89fd6..7b03aad775 100644 }; #if !defined(OPENSSL_NO_ML_DSA) -@@ -3509,6 +3513,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = { +@@ -3508,6 +3512,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = { ml_dsa_key }, # endif @@ -52,7 +52,7 @@ index 43f7c89fd6..7b03aad775 100644 # if !defined(OPENSSL_NO_SLH_DSA) { OSSL_SELF_TEST_DESC_KEYGEN_SLH_DSA, -@@ -3517,6 +3522,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = { +@@ -3516,6 +3521,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = { slh_dsa_128f_keygen_expected_params }, # endif @@ -61,5 +61,5 @@ index 43f7c89fd6..7b03aad775 100644 #endif /* !OPENSSL_NO_ML_DSA || !OPENSSL_NO_SLH_DSA */ -- -2.52.0 +2.55.0 diff --git a/0055-Add-a-define-to-disable-symver-attributes.patch b/0055-Add-a-define-to-disable-symver-attributes.patch index 24e7d60..7f6a764 100644 --- a/0055-Add-a-define-to-disable-symver-attributes.patch +++ b/0055-Add-a-define-to-disable-symver-attributes.patch @@ -1,4 +1,4 @@ -From 24875d5f4486540cc7baf23c3f94234ee9800862 Mon Sep 17 00:00:00 2001 +From d6b81a69dfbf084b4dcb1405eb109caaee18569d Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 17 Jul 2025 09:40:34 -0400 Subject: [PATCH 55/57] Add a define to disable symver attributes @@ -14,7 +14,7 @@ Signed-off-by: Simo Sorce 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c -index 638dac8844..5b1b54c195 100644 +index 101f49862c..dbf9bbba7a 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -573,7 +573,7 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size) @@ -27,10 +27,10 @@ index 638dac8844..5b1b54c195 100644 symver ("EVP_MD_CTX_dup@OPENSSL_3.2.0"))) #endif diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c -index b4edd825cd..e7b124a79b 100644 +index 30c2ec56dc..4117fafdfa 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c -@@ -1757,7 +1757,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) +@@ -1767,7 +1767,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) } EVP_CIPHER_CTX @@ -40,10 +40,10 @@ index b4edd825cd..e7b124a79b 100644 symver ("EVP_CIPHER_CTX_dup@OPENSSL_3.2.0"))) #endif diff --git a/crypto/o_str.c b/crypto/o_str.c -index fde43421ea..807e070827 100644 +index b221ba789e..ca583d9ce6 100644 --- a/crypto/o_str.c +++ b/crypto/o_str.c -@@ -407,7 +407,7 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen) +@@ -418,7 +418,7 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen) } int @@ -52,7 +52,7 @@ index fde43421ea..807e070827 100644 __attribute__ ((symver ("OPENSSL_strcasecmp@@OPENSSL_3.0.3"), symver ("OPENSSL_strcasecmp@OPENSSL_3.0.1"))) #endif -@@ -422,7 +422,7 @@ OPENSSL_strcasecmp(const char *s1, const char *s2) +@@ -433,7 +433,7 @@ OPENSSL_strcasecmp(const char *s1, const char *s2) } int @@ -62,5 +62,5 @@ index fde43421ea..807e070827 100644 symver ("OPENSSL_strncasecmp@OPENSSL_3.0.1"))) #endif -- -2.52.0 +2.55.0 diff --git a/0056-Add-targets-to-skip-build-of-non-installable-program.patch b/0056-Add-targets-to-skip-build-of-non-installable-program.patch index af91d35..f1255a1 100644 --- a/0056-Add-targets-to-skip-build-of-non-installable-program.patch +++ b/0056-Add-targets-to-skip-build-of-non-installable-program.patch @@ -1,4 +1,4 @@ -From 4b634bdcc4dedc8516529d39062adc1305c7bf9b Mon Sep 17 00:00:00 2001 +From df6335c8de7d4a81ac2a6d3c721d6236f11eb300 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Tue, 19 Aug 2025 14:26:07 +0200 Subject: [PATCH 56/57] Add targets to skip build of non-installable programs @@ -60,10 +60,10 @@ index db6a1b1799..bc7fc36b46 100644 @ ! Install the main program - CREATE/DIR ossl_installroot:[EXE.'arch'] diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index 1920d38655..bfede44ce4 100644 +index dc5811f639..f905313d7d 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -547,7 +547,9 @@ LANG=C +@@ -548,7 +548,9 @@ LANG=C {- dependmagic('build_sw', 'Build all the software (default target)'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils {- dependmagic('build_libs', 'Build the libraries libssl and libcrypto'); -}: build_libs_nodep {- dependmagic('build_modules', 'Build the modules (i.e. providers and engines)'); -}: build_modules_nodep @@ -74,7 +74,7 @@ index 1920d38655..bfede44ce4 100644 all: build_sw {- "build_docs" if !$disabled{docs}; -} ## Build software and documentation debuginfo: $(SHLIBS) -@@ -566,6 +568,7 @@ build_generated: $(GENERATED_MANDATORY) +@@ -567,6 +569,7 @@ build_generated: $(GENERATED_MANDATORY) build_libs_nodep: $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -} build_modules_nodep: $(MODULES) build_programs_nodep: $(PROGRAMS) $(SCRIPTS) @@ -82,7 +82,7 @@ index 1920d38655..bfede44ce4 100644 # Kept around for backward compatibility build_apps build_tests: build_programs -@@ -680,7 +683,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and +@@ -681,7 +684,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and $(RM) -r "$(DESTDIR)$(DOCDIR)" {- output_off() if $disabled{fips}; "" -} @@ -91,7 +91,7 @@ index 1920d38655..bfede44ce4 100644 @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(MODULESDIR)" @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(OPENSSLDIR)" -@@ -966,7 +969,7 @@ install_runtime_libs: build_libs +@@ -967,7 +970,7 @@ install_runtime_libs: build_libs : {- output_on() if windowsdll(); "" -}; \ done @@ -101,10 +101,10 @@ index 1920d38655..bfede44ce4 100644 @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(bindir)" @$(ECHO) "*** Installing runtime programs" diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl -index 894834cfb7..b5872124de 100644 +index e553e8f9fe..f5ec2a726b 100644 --- a/Configurations/windows-makefile.tmpl +++ b/Configurations/windows-makefile.tmpl -@@ -418,6 +418,8 @@ PROCESSOR= {- $config{processor} -} +@@ -419,6 +419,8 @@ PROCESSOR= {- $config{processor} -} {- dependmagic('build_libs'); -}: build_libs_nodep {- dependmagic('build_modules'); -}: build_modules_nodep {- dependmagic('build_programs'); -}: build_programs_nodep @@ -113,7 +113,7 @@ index 894834cfb7..b5872124de 100644 build_docs: build_html_docs build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7) -@@ -430,6 +432,8 @@ build_modules_nodep: $(MODULES) +@@ -431,6 +433,8 @@ build_modules_nodep: $(MODULES) @ build_programs_nodep: $(PROGRAMS) $(SCRIPTS) @ @@ -122,7 +122,7 @@ index 894834cfb7..b5872124de 100644 # Kept around for backward compatibility build_apps build_tests: build_programs -@@ -507,7 +511,7 @@ install_docs: install_html_docs +@@ -508,7 +512,7 @@ install_docs: install_html_docs uninstall_docs: uninstall_html_docs {- output_off() if $disabled{fips}; "" -} @@ -131,7 +131,7 @@ index 894834cfb7..b5872124de 100644 # @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) @"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(MODULESDIR)" @"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)" -@@ -607,7 +611,7 @@ install_runtime_libs: build_libs +@@ -608,7 +612,7 @@ install_runtime_libs: build_libs "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \ "$(INSTALLTOP)\bin" @@ -154,5 +154,5 @@ index a1614fe8a9..e88ff4bae1 100755 if (/^##@/) { printf "\n\033[1m%s\033[0m\n", substr($Fld[$_], (5)-1); -- -2.52.0 +2.55.0 diff --git a/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch b/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch index c02fb9f..27b0682 100644 --- a/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch +++ b/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch @@ -1,4 +1,4 @@ -From 3ffdc68f16d6b326ff0854053fc9206be3dabcc2 Mon Sep 17 00:00:00 2001 +From 9c744fee11aee9290b471b671f1205331928bc33 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Wed, 21 Jan 2026 18:13:43 +0100 Subject: [PATCH 57/57] Disable RSA-PKCS1.5 FIPS POST, not relevant for RHEL @@ -8,10 +8,10 @@ Subject: [PATCH 57/57] Disable RSA-PKCS1.5 FIPS POST, not relevant for RHEL 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c -index f453b2f2fb..5b37387d83 100644 +index 0559a30cd6..496c5eaa39 100644 --- a/providers/fips/self_test_kats.c +++ b/providers/fips/self_test_kats.c -@@ -1190,8 +1190,8 @@ int SELF_TEST_kats(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx) +@@ -1197,8 +1197,8 @@ int SELF_TEST_kats(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx) ret = 0; if (!self_test_kems(st, libctx)) ret = 0; @@ -23,5 +23,5 @@ index f453b2f2fb..5b37387d83 100644 RAND_set0_private(libctx, saved_rand); return ret; -- -2.52.0 +2.55.0 diff --git a/0058-asn1_d2i_read_bio_EOF.patch b/0058-asn1_d2i_read_bio_EOF.patch deleted file mode 100644 index b305d6e..0000000 --- a/0058-asn1_d2i_read_bio_EOF.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 836406633204bccb6d7a8718e15de8c3c2213a8e Mon Sep 17 00:00:00 2001 -From: icanhasmath -Date: Tue, 30 Jun 2026 16:55:40 -0500 -Subject: [PATCH 1/2] Don't raise NOT_ENOUGH_DATA on a clean EOF at an object - boundary - -asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers -commonly loop, decoding concatenated DER values until the call fails, and -rely on a failure with no queued error to recognise a clean end of input. -CPython's ssl module does this in _add_ca_certs() when loading the Windows -certificate store via SSLContext.load_verify_locations(cadata=...); it -re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as -fatal. - -Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the -BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read() -returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now -raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue. -The rewrite in commit 35852da1d9 carried this behaviour forward. As a -result Python 3 on Windows fails to initialise an SSLContext with: - - ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data - -Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, or when EOF is -reached in the middle of an object (diff != 0), which is genuine truncation. -A clean EOF on an object boundary again fails without queuing an error, -restoring the long-standing behaviour that looping callers depend on. - -Add regression tests for both the clean-EOF and truncated cases, and a -CHANGES.md entry. - -Fixes #31807 - -Assisted-by: Claude:claude-opus-4-8 ---- - crypto/asn1/a_d2i_fp.c | 15 ++++- - test/asn1_decode_test.c | 130 ++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 144 insertions(+), 1 deletion(-) - -diff --git a/crypto/asn1/a_d2i_fp.c b/crypto/asn1/a_d2i_fp.c -index a23dea8ebd..19595683ef 100644 ---- a/crypto/asn1/a_d2i_fp.c -+++ b/crypto/asn1/a_d2i_fp.c -@@ -139,7 +139,20 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb) - } - i = BIO_read(in, &(b->data[len]), want); - if (i <= 0) { -- ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA); -+ /* -+ * A read error (i < 0), an EOF in the middle of an object -+ * (diff != 0, some bytes already buffered), or an EOF while -+ * still inside an indefinite-length constructed value awaiting -+ * its end-of-contents octets (eos != 0) all mean the input is -+ * truncated. Only a clean EOF at a top-level object boundary -+ * (i == 0, diff == 0, eos == 0) is the normal end of input: -+ * fail without queuing an error so that callers looping over -+ * concatenated DER values (e.g. the libcrypto d2i_*_bio() -+ * consumers in CPython's ssl module) terminate cleanly instead -+ * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA. -+ */ -+ if (i < 0 || diff != 0 || eos != 0) -+ ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA); - goto err; - } - if (i > 0) { -diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c -index 6e00d40896..ec20d6ebbc 100644 ---- a/test/asn1_decode_test.c -+++ b/test/asn1_decode_test.c -@@ -14,7 +14,11 @@ - #include - #include - #include -+#include -+#include -+#include - #include "internal/numbers.h" -+#include "internal/asn1.h" - #include "testutil.h" - - #ifdef __GNUC__ -@@ -266,6 +270,129 @@ err: - return ret; - } - -+/* -+ * A minimal, complete DER object: SEQUENCE { INTEGER 0 }. -+ * asn1_d2i_read_bio() should consume exactly these bytes. -+ */ -+static const unsigned char one_obj[] = { -+ 0x30, 0x03, /* SEQUENCE, length 3 */ -+ 0x02, 0x01, 0x00 /* INTEGER 0 */ -+}; -+ -+/* -+ * Reading concatenated DER objects from a BIO must stop cleanly at EOF: -+ * once the input is exhausted on an object boundary, asn1_d2i_read_bio() -+ * returns < 0 and must NOT leave an error on the queue. Callers that loop -+ * over concatenated values (e.g. CPython's ssl module loading the Windows -+ * certificate store via d2i_X509_bio()) rely on this to detect end-of-input; -+ * a spurious ASN1_R_NOT_ENOUGH_DATA there is reported as a fatal error. -+ */ -+static int test_d2i_read_bio_clean_eof(void) -+{ -+ unsigned char two_objs[sizeof(one_obj) * 2]; -+ BIO *bio = NULL; -+ BUF_MEM *buf = NULL; -+ int ret = 0; -+ -+ memcpy(two_objs, one_obj, sizeof(one_obj)); -+ memcpy(two_objs + sizeof(one_obj), one_obj, sizeof(one_obj)); -+ -+ if (!TEST_ptr(bio = BIO_new_mem_buf(two_objs, sizeof(two_objs)))) -+ goto err; -+ ERR_clear_error(); -+ -+ /* Both complete objects are read, one per call. */ -+ if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj))) -+ goto err; -+ BUF_MEM_free(buf); -+ buf = NULL; -+ if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj))) -+ goto err; -+ BUF_MEM_free(buf); -+ buf = NULL; -+ -+ /* Clean EOF: failure return, but no error must be queued. */ -+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0)) -+ goto err; -+ if (!TEST_ulong_eq(ERR_peek_error(), 0)) -+ goto err; -+ -+ ret = 1; -+err: -+ BUF_MEM_free(buf); -+ BIO_free(bio); -+ return ret; -+} -+ -+/* -+ * In contrast, hitting EOF in the middle of an object is genuine truncation -+ * and must still be reported as ASN1_R_NOT_ENOUGH_DATA. -+ */ -+static int test_d2i_read_bio_truncated(void) -+{ -+ static const unsigned char truncated[] = { -+ 0x30, 0x05, /* SEQUENCE claims 5 content bytes ... */ -+ 0x02, 0x01 /* ... but only 2 are present */ -+ }; -+ BIO *bio = NULL; -+ BUF_MEM *buf = NULL; -+ unsigned long e; -+ int ret = 0; -+ -+ if (!TEST_ptr(bio = BIO_new_mem_buf(truncated, sizeof(truncated)))) -+ goto err; -+ ERR_clear_error(); -+ -+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0)) -+ goto err; -+ e = ERR_peek_last_error(); -+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1) -+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA)) -+ goto err; -+ -+ ret = 1; -+err: -+ BUF_MEM_free(buf); -+ BIO_free(bio); -+ return ret; -+} -+ -+/* -+ * An EOF reached while still inside an indefinite-length constructed value, -+ * before its end-of-contents octets, is truncation too (not a clean boundary), -+ * so it must also report ASN1_R_NOT_ENOUGH_DATA rather than an empty queue. -+ */ -+static int test_d2i_read_bio_indefinite_truncated(void) -+{ -+ /* SEQUENCE (indefinite) { INTEGER 0 } with the 00 00 EOC missing */ -+ static const unsigned char truncated_indefinite[] = { -+ 0x30, 0x80, /* SEQUENCE, indefinite length */ -+ 0x02, 0x01, 0x00 /* INTEGER 0; no end-of-contents octets follow */ -+ }; -+ BIO *bio = NULL; -+ BUF_MEM *buf = NULL; -+ unsigned long e; -+ int ret = 0; -+ -+ if (!TEST_ptr(bio = BIO_new_mem_buf(truncated_indefinite, -+ sizeof(truncated_indefinite)))) -+ goto err; -+ ERR_clear_error(); -+ -+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0)) -+ goto err; -+ e = ERR_peek_last_error(); -+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1) -+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA)) -+ goto err; -+ -+ ret = 1; -+err: -+ BUF_MEM_free(buf); -+ BIO_free(bio); -+ return ret; -+} -+ - int setup_tests(void) - { - #ifndef OPENSSL_NO_DEPRECATED_3_0 -@@ -279,5 +406,8 @@ int setup_tests(void) - ADD_TEST(test_utctime); - ADD_TEST(test_invalid_template); - ADD_TEST(test_reuse_asn1_object); -+ ADD_TEST(test_d2i_read_bio_clean_eof); -+ ADD_TEST(test_d2i_read_bio_truncated); -+ ADD_TEST(test_d2i_read_bio_indefinite_truncated); - return 1; - } --- -2.54.0 - - -From a7272fcb339ec8e11578a23fcd667167b6dbab49 Mon Sep 17 00:00:00 2001 -From: icanhasmath -Date: Fri, 3 Jul 2026 09:32:10 -0500 -Subject: [PATCH 2/2] test: cover the partial-header EOF case in - asn1_d2i_read_bio - -The existing asn1_d2i_read_bio tests cover a clean EOF at an object -boundary, an EOF in the middle of an object body, and an EOF inside an -unterminated indefinite-length value. None exercised an EOF reached -part-way through an object header, with header bytes already buffered, -which is the "diff != 0" arm of the header-read truncation check. - -Add test_d2i_read_bio_partial_header feeding a SEQUENCE whose 2-byte -long-form length is truncated after the first byte, and assert it reports -ASN1_R_NOT_ENOUGH_DATA. - -Assisted-by: Claude:claude-opus-4-8 ---- - test/asn1_decode_test.c | 39 +++++++++++++++++++++++++++++++++++++-- - 1 file changed, 37 insertions(+), 2 deletions(-) - -diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c -index ec20d6ebbc..8a9629c21d 100644 ---- a/test/asn1_decode_test.c -+++ b/test/asn1_decode_test.c -@@ -374,8 +374,42 @@ static int test_d2i_read_bio_indefinite_truncated(void) - unsigned long e; - int ret = 0; - -- if (!TEST_ptr(bio = BIO_new_mem_buf(truncated_indefinite, -- sizeof(truncated_indefinite)))) -+ bio = BIO_new_mem_buf(truncated_indefinite, sizeof(truncated_indefinite)); -+ if (!TEST_ptr(bio)) -+ goto err; -+ ERR_clear_error(); -+ -+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0)) -+ goto err; -+ e = ERR_peek_last_error(); -+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1) -+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA)) -+ goto err; -+ -+ ret = 1; -+err: -+ BUF_MEM_free(buf); -+ BIO_free(bio); -+ return ret; -+} -+ -+/* -+ * An EOF reached part-way through an object's header, with some header bytes -+ * already buffered, is truncation as well. This exercises the "diff != 0" arm -+ * of the header-read check (distinct from the body read handled elsewhere). -+ */ -+static int test_d2i_read_bio_partial_header(void) -+{ -+ /* SEQUENCE with a 2-byte long-form length, but only one length byte given */ -+ static const unsigned char partial_header[] = { -+ 0x30, 0x82, 0x01 /* SEQUENCE, length declared as 2 bytes, 1 present */ -+ }; -+ BIO *bio = NULL; -+ BUF_MEM *buf = NULL; -+ unsigned long e; -+ int ret = 0; -+ -+ if (!TEST_ptr(bio = BIO_new_mem_buf(partial_header, sizeof(partial_header)))) - goto err; - ERR_clear_error(); - -@@ -409,5 +443,6 @@ int setup_tests(void) - ADD_TEST(test_d2i_read_bio_clean_eof); - ADD_TEST(test_d2i_read_bio_truncated); - ADD_TEST(test_d2i_read_bio_indefinite_truncated); -+ ADD_TEST(test_d2i_read_bio_partial_header); - return 1; - } --- -2.54.0 - diff --git a/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch b/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch index 740e708..83a5384 100644 --- a/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch +++ b/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch @@ -120,41 +120,6 @@ index 4b74ee1a34..5f089de107 100644 /* Finally see if security callback allows it */ secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu); sigalgstr[0] = (lu->sigalg >> 8) & 0xff; -@@ -2977,6 +2994,8 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op) - { - /* Lookup signature algorithm digest */ - int secbits, nid, pknid; -+ OSSL_LIB_CTX *libctx = NULL; -+ - - /* Don't check signature if self signed */ - if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0) -@@ -2985,6 +3004,25 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op) - /* If digest NID not defined use signature NID */ - if (nid == NID_undef) - nid = pknid; -+ -+ if (x && x->libctx) -+ libctx = x->libctx; -+ else if (ctx && ctx->libctx) -+ libctx = ctx->libctx; -+ else if (s && s->session_ctx && s->session_ctx->libctx) -+ libctx = s->session_ctx->libctx; -+ else -+ libctx = OSSL_LIB_CTX_get0_global_default(); -+ -+ if (nid == NID_sha1 -+ && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0) -+ && ((s != NULL && SSL_get_security_level(SSL_CONNECTION_GET_SSL(s)) < 3) -+ || (ctx != NULL && SSL_CTX_get_security_level(ctx) < 3) -+ )) -+ /* When rh-allow-sha1-signatures = yes and security level <= 2, -+ * explicitly allow SHA1 for backwards compatibility. */ -+ return 1; -+ - if (s != NULL) - return ssl_security(s, op, secbits, nid, x); - else diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t index ab8cdff..84421cc 100644 --- a/test/recipes/25-test_verify.t @@ -163,8 +128,8 @@ index ab8cdff..84421cc 100644 run(app([@args])); } --plan tests => 204; -+plan tests => 203; +-plan tests => 206; ++plan tests => 205; # Canonical success ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]), diff --git a/openssl.spec b/openssl.spec index f9a33de..5c6ce69 100644 --- a/openssl.spec +++ b/openssl.spec @@ -28,8 +28,8 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl -Version: 3.5.7 -Release: 3%{?dist} +Version: 3.5.8 +Release: 1%{?dist} Epoch: 1 Source0: openssl-%{version}.tar.gz Source1: fips-hmacify.sh @@ -98,7 +98,6 @@ Patch0054: 0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch Patch0055: 0055-Add-a-define-to-disable-symver-attributes.patch Patch0056: 0056-Add-targets-to-skip-build-of-non-installable-program.patch Patch0057: 0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch -Patch0058: 0058-asn1_d2i_read_bio_EOF.patch #The patches that are different for RHEL9 and 10 start here Patch0100: 0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch @@ -457,6 +456,18 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco %ldconfig_scriptlets libs %changelog +* Tue Aug 25 2026 Dmitry Belyavskiy - 1:3.5.8-1 +- Rebase to OpenSSL 3.5.8 + Resolves: RHEL-242942 + Resolves: RHEL-246259 + Resolves: RHEL-246288 + Resolves: RHEL-246320 + Resolves: RHEL-246440 + Resolves: RHEL-246444 + Resolves: RHEL-246448 + Resolves: RHEL-246452 + Resolves: RHEL-246456 + * Thu Aug 13 2026 Dmitry Belyavskiy - 1:3.5.7-3 - In FIPS mode when neither FIPS provider nor FIPS provider configuration is present, OpenSSL silently falls back to the default provider. diff --git a/sources b/sources index 1fa392a..6c1e69d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openssl-3.5.7.tar.gz) = de5351d2d532e1a3908a738f7d8aae448d32bc60bdb24808c556a24bc37a3f53daedf12b5d432eeb8c235e16939d842f908332ede8a447ca103ad1c493c820d7 +SHA512 (openssl-3.5.8.tar.gz) = 62a1dbed0fad75245b332e41b85a1f7c2379189525e7628a7cf68947d115e90a47f179e3f87d27641e5b2d357c357292179fc0e64eccecdebc81c083f7a8ebe4