Skip to content

Fips changes#146

Open
vkanjur wants to merge 3 commits into
opencryptoki:masterfrom
vkanjur:fips_changes
Open

Fips changes#146
vkanjur wants to merge 3 commits into
opencryptoki:masterfrom
vkanjur:fips_changes

Conversation

@vkanjur

@vkanjur vkanjur commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

No description provided.

…0-3 mode

NIST SP 800-131A classifies mechanisms AES-ECB, SHA-224, SHA-512/224, SHA3-224 are non approved by end of 2030.
This commit classifies the above mentioned mechanisms as available and non approved in FIPS mode in libica.

Signed-off-by: Vishnudatha Kanjur <kanjur@ibm.com>
@vkanjur vkanjur requested a review from ifranzki June 12, 2026 09:43
Comment thread include/ica_api.h Outdated
Comment thread src/fips.c
vkanjur added 2 commits June 12, 2026 16:14
…h in FIPS140-3 mode

RSA_ME and RSA_CRT are already marked as available but not approved in the FIPS service indicator.
This commit disables RSA key generation for less than 128 bits of security strength,
ie, less than 3072 bits key size in FIPS mode.
Also mention RSA Keygen ME and RSA Keygen CRT as available but not approved.

Signed-off-by: Vishnudatha Kanjur <kanjur@ibm.com>
This commit contains changes to make sure the HMAC key used for the
FIPS integrity test is at least 128 bits.

Signed-off-by: Vishnudatha Kanjur <kanjur@ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants