Merge pull request #227 from ColtonWilley/wp_ecc_sign_check

padelsbach · web-flow · commit ae376b7743ad · 2025-07-24T16:03:14.000-07:00
Only restrict ECC signing with SHA1 if FIPS is enabled
diff --git a/src/wp_ecdsa_sig.c b/src/wp_ecdsa_sig.c
@@ -428,6 +428,8 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx *ctx, const char *mdName,
 {
     int ok = 1;
 
+    (void)op;
+
     if (mdProps == NULL) {
         mdProps = ctx->propQuery;
     }
@@ -447,6 +449,7 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx *ctx, const char *mdName,
         {
             ok = 0;
         }
+#ifdef HAVE_FIPS
 #if LIBWOLFSSL_VERSION_HEX >= 0x05007004
         if ((ctx->hash.type == WC_HASH_TYPE_SHA) && (op == EVP_PKEY_OP_SIGN))
 #else
@@ -455,6 +458,7 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx *ctx, const char *mdName,
         {
             ok = 0;
         }
+#endif
 
         if (ok) {
 #if LIBWOLFSSL_VERSION_HEX >= 0x05007004

Original file line number	Diff line number	Diff line change
`@@ -428,6 +428,8 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx ctx, const char mdName,`
`428`	`428`	`{`
`429`	`429`	`int ok = 1;`
`430`	`430`
	`431`	`+ (void)op;`
	`432`	`+`
`431`	`433`	`if (mdProps == NULL) {`
`432`	`434`	`mdProps = ctx->propQuery;`
`433`	`435`	`}`
`@@ -447,6 +449,7 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx ctx, const char mdName,`
`447`	`449`	`{`
`448`	`450`	`ok = 0;`
`449`	`451`	`}`
	`452`	`+#ifdef HAVE_FIPS`
`450`	`453`	`#if LIBWOLFSSL_VERSION_HEX >= 0x05007004`
`451`	`454`	`if ((ctx->hash.type == WC_HASH_TYPE_SHA) && (op == EVP_PKEY_OP_SIGN))`
`452`	`455`	`#else`
`@@ -455,6 +458,7 @@ static int wp_ecdsa_setup_md(wp_EcdsaSigCtx ctx, const char mdName,`
`455`	`458`	`{`
`456`	`459`	`ok = 0;`
`457`	`460`	`}`
	`461`	`+#endif`
`458`	`462`
`459`	`463`	`if (ok) {`
`460`	`464`	`#if LIBWOLFSSL_VERSION_HEX >= 0x05007004`