The ECC key generator support the no-keytest, but this is no longer allowed by the FIPS. From ISO 19790:
- PCT shall be executed for every generated key pair.
This means in case of FIPS we need to either ignore this flag in the ECC code or forbid use of this flag altogether.
I tend to the first option, skipping the check directly in the ECC code:
From c7bc82f56d6ebd27111ac0607f4369e2875d7553 Mon Sep 17 00:00:00 2001 From: Jakub Jelen <jjelen@redhat.com> Date: Wed, 1 Mar 2023 15:42:29 +0100 Subject: [PATCH] ecc: Do not allow skipping tests in FIPS Mode The new FIPS specification requires to run the PCT without any exceptions. -- * cipher/ecc.c (ecc_generate): Do not allow skipping tests PCT tests in FIPS mode. Signed-off-by: Jakub Jelen <jjelen@redhat.com> --- cipher/ecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cipher/ecc.c b/cipher/ecc.c index 1e80200e..797f2368 100644 --- a/cipher/ecc.c +++ b/cipher/ecc.c @@ -677,7 +677,7 @@ ecc_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey) log_debug ("ecgen result using Ed25519+EdDSA\n"); } - if (!(flags & PUBKEY_FLAG_NO_KEYTEST) && fips_mode ()) + if (fips_mode ()) test_keys_fips (*r_skey); leave: -- 2.39.1