20260904-configure-all-nonfips-crypto-etc - #11383
Open
douzzer wants to merge 1 commit into
Open
Conversation
…-crypto, gathering the non-FIPS and legacy algs formerly enabled piecemeal by --enable-all-crypto: * all-crypto now implies both bundles iff !FIPS, so FIPS all-crypto builds get no non-FIPS or legacy algs from the bundle (FIPS <v5 builds still get DES3, from the flavor setup rather than all-crypto). * either bundle can be explicitly enabled in FIPS builds, and explicitly disabling one alongside all-crypto allows subtractive selection, e.g. --enable-all-crypto --disable-all-legacy-crypto. * all-nonfips-crypto initially comprises siphash, blake2b, blake2s, poly1305, chacha, xchacha, curve25519, curve448, pkcs7, nullcipher, aessiv, aeseax, sakke, atomicuser, cryptocb, pkcallbacks, scrypt and argon2 (excluded from kernel-mode builds as before), eccsi, and, gated on !sp-math, ecccustcurves, brainpool, and srp. * all-legacy-crypto initially comprises camellia, ripemd, arc4, md2, md4, md5, dsa (gated on !sp-math), and des3. * also move EdDSA out from the !ENABLED_FIPS gate to the FIPS>=v6 gate (Ed25519/Ed448 are FIPS 186-5 algs, in the v6+ boundary), * recast the rsapss gate from FIPS_VERSION!=v1 to the equivalent !FIPS||FIPS>=v2, * keep SHA-1 in all-crypto with a note anticipating its move to legacy, and * annotate why anon remains enabled even in FIPS builds (OSP dependents: WPAS, NGINX, HAPROXY, RSYSLOG).
douzzer
requested review from
kaleb-himes,
wolfSSL-Bot and
wolfSSL-Fenrir-bot
September 4, 2026 19:22
kaleb-himes
approved these changes
Sep 4, 2026
Contributor
|
retest this please |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
configure.ac: add--enable-all-nonfips-cryptoand--enable-all-legacy-crypto, gathering the non-FIPS and legacy algs formerly enabled piecemeal by--enable-all-crypto:all-cryptonow implies both bundles iff !FIPS, so FIPSall-cryptobuilds get no non-FIPS or legacy algs from the bundle (FIPS <v5 builds still get DES3, from the flavor setup rather than all-crypto).either bundle can be explicitly enabled in FIPS builds, and explicitly disabling one alongside
all-cryptoallows subtractive selection, e.g.--enable-all-crypto--disable-all-legacy-crypto.all-nonfips-cryptoinitially comprises siphash, blake2b, blake2s, poly1305, chacha, xchacha, curve25519, curve448, pkcs7, nullcipher, aessiv, aeseax, sakke, atomicuser, cryptocb, pkcallbacks, scrypt and argon2 (excluded from kernel-mode builds as before), eccsi, and, gated on !sp-math, ecccustcurves, brainpool, and srp.all-legacy-cryptoinitially comprises camellia, ripemd, arc4, md2, md4, md5, dsa (gated on !sp-math), and des3.also move EdDSA out from the !
ENABLED_FIPSgate to the FIPS>=v6 gate (Ed25519/Ed448 are FIPS 186-5 algs, in the v6+ boundary),recast the rsapss gate from
FIPS_VERSION!=v1 to the equivalent !FIPS||FIPS>=v2,keep SHA-1 in
all-cryptowith a note anticipating its move to legacy, andannotate why anon remains enabled even in FIPS builds (OSP dependents: WPAS, NGINX, HAPROXY, RSYSLOG).