Disable EdDSA signature schemes in FIPS mode
waiting for FIPS.186-5 and SP.800-52 update
@@ -98,7 +98,8 @@ private static void addSignatureSchemeLegacy(JcaTlsCrypto crypto, Map<Integer, S
addSignatureScheme(crypto, ss, signatureScheme, jcaSignatureAlgorithm, keyAlgorithm);
}
- private static Map<Integer, SignatureSchemeInfo> createSignatureSchemesMap(JcaTlsCrypto crypto)
+ private static Map<Integer, SignatureSchemeInfo> createSignatureSchemesMap(ProvSSLContextSpi context,
+ JcaTlsCrypto crypto)
{
Map<Integer, SignatureSchemeInfo> ss = new TreeMap<Integer, SignatureSchemeInfo>();
@@ -116,8 +117,12 @@ private static void addSignatureSchemeLegacy(JcaTlsCrypto crypto, Map<Integer, S
// addSignatureScheme(crypto, ss, SignatureScheme.rsa_pss_rsae_sha384, "SHA384withRSAandMGF1", "RSA");
// addSignatureScheme(crypto, ss, SignatureScheme.rsa_pss_rsae_sha512, "SHA512withRSAandMGF1", "RSA");
+ // TODO[jsse] Preferably add FipsUtils.removeNonFipsSignatureSchemes or similar
+ if (!context.isFips())
+ {
addSignatureScheme(crypto, ss, SignatureScheme.ed25519, "Ed25519", "Ed25519");
addSignatureScheme(crypto, ss, SignatureScheme.ed448, "Ed448", "Ed448");
+ }
// NOTE: SunJSSE is using "RSASSA-PSS" as 'jcaSignatureAlgorithm' for all these
// addSignatureScheme(crypto, ss, SignatureScheme.rsa_pss_pss_sha256, "SHA256withRSAandMGF1", "RSASSA-PSS");
@@ -173,7 +178,7 @@ private static void addSignatureSchemeLegacy(JcaTlsCrypto crypto, Map<Integer, S
this.clientSessionContext = new ProvSSLSessionContext(this);
this.serverSessionContext = new ProvSSLSessionContext(this);
- this.signatureSchemesMap = createSignatureSchemesMap(crypto);
+ this.signatureSchemesMap = createSignatureSchemesMap(context, crypto);
}
List<SignatureSchemeInfo> getActiveSignatureSchemes(ProvSSLParameters sslParameters,
