You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The fips module in the boring crate has the following method:
/// Moves the library into or out of the FIPS 140-2 mode of operation. ////// This corresponds to `FIPS_mode_set`.pubfnenable(enabled:bool) -> Result<(),ErrorStack>{unsafe{cvt(ffi::FIPS_mode_set(enabled as_)).map(|_| ())} op:}
However this is not what FIPS_mode_set promises to do. From include/openssl/crypto.h in build-sys/deps/boringssl-fips:
// FIPS_mode_set returns one if |on| matches whether BoringSSL was built with // |BORINGSSL_FIPS| and zero otherwise.OPENSSL_EXPORTintFIPS_mode_set(inton);
In boringssl, FIPS_mode_set is more or less useless, and
it doesn't even set an error stack at all on failure,
so there is no point using it instead of FIPS_mode.
nox
added a commit
to nox/boring
that referenced
this issue
Oct 9, 2023
In boringssl, FIPS_mode_set is more or less useless, and
it doesn't even set an error stack at all on failure,
so there is no point using it instead of FIPS_mode.
The
fips
module in theboring
crate has the following method:However this is not what
FIPS_mode_set
promises to do. Frominclude/openssl/crypto.h
inbuild-sys/deps/boringssl-fips
:Indeed, here is the implementation:
The text was updated successfully, but these errors were encountered: