I'm hoping someone can help me understand the fact that I enabled FIPS but
the MD5 hash functionality is still working.

I built the FIPS object module using openssl-fips-1.2 on a linux system
        ./config fipscanisterbuild no-asm
        make
        make install

then built the FIPS capable OpenSSL using openssl-0.9.8k
        ./config fips
        make
        make install

In my application my first call is to the following code

#ifdef OPENSSL_FIPS
   if(FIPS_mode_set(1))
   {
      printf("FIPS mode enabled\n");
   }
   else
   {
      printf("FIPS mode failed to enable\n");
      ERR_load_crypto_strings();
      ERR_print_errors_fp(stderr);
      exit(1);
   }

   printf("FIPS mode=%d\n", FIPS_mode());
#else
   printf("FIPS mode disabled\n");
#endif

which outputs
FIPS mode enabled
FIPS mode=1

which indicates that OpenSSL is in FIPS mode, but when I call the following
code

void md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8
*mac)
{
MD5_CTX ctx;
size_t i;
int success1 = 22;
int success2 = 22;
int success3 = 22;

success1 = MD5_Init(&ctx);

for(int i = 0; i < num_elem; i++)
{
   success2 = MD5_Update(&ctx, addr[i], len[i]);
}

success3 = MD5_Final(mac, &ctx);

printf("md5_vector:success=%d,%d,%d\n", success1, success2, success3);
}

I get the output
md5_vector:success=1,1,1

and the operation I expected to fail works. I'm I missing something or is
FIPS not really enabled?

Reply via email to