[openssl/openssl] 6127c5: FIPS: Change EC_GROUP_check() so that it fails for...

[Shane]

Branch: refs/heads/openssl-3.3
Home: https://github.com/openssl/openssl
Commit: 6127c568d357c51b1e4120f212250b26fe5b9710
https://github.com/openssl/openssl/commit/6127c568d357c51b1e4120f212250b26fe5b9710
Author: slontis <shane....@oracle.com>
Date: 2026-03-02 (Mon, 02 Mar 2026)

Changed paths:
M crypto/ec/ec_check.c

Log Message:
-----------
FIPS: Change EC_GROUP_check() so that it fails for explicit curves.

Reported by Luigino Camastra (Aisle Research).

Explicit curves returned a NID of NID_undef (which has a value of 0)
which resulted in the check >= 0 passing.
Changing the result to > addresses the issue.
Note that this is a NON issue in master since explicit curves are
now disabled by default. Note also that for any EC operation that
tries to use a loaded EC key, checks that the curve and security
strength are valid.

Reviewed-by: Tim Hudson <t...@openssl.org>
Reviewed-by: Paul Dale <paul...@oracle.com>
Reviewed-by: Tomas Mraz <to...@openssl.org>
MergeDate: Mon Mar 2 19:37:04 2026
(Merged from https://github.com/openssl/openssl/pull/30138)

(cherry picked from commit 5e632723296e65689146280e4e2a90a42c513305)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications