Crypto: Hide forbidden algorithms when FIPS enabled #10312

kvakvs · 2025-10-21T11:43:06Z

Problem

crypto:supports/0 is currently undocumented but i will add a doc string to it.
Crypto returns some algorithms which are indirectly forbidden under FIPS (i.e. listed as available but not working).

The Expectation

Expected: All algorithms returned by crypto:supports/0 will be available at least in one way.
Bonus points for returning forbidden algorithm names separately so that the users will not complain that something "has disappeared" and will see the reason.

Solution

The call to crypto:supports/0 under FIPS build with fips=enabled in crypto app settings, will filter the algorithms by their availability in a much more strict way (by actually trying to initialize each algorithm and recording the failures as a sign of unavailability) and will return an additional section in the results containing disabled algorithms:

[{hashs,[...
 {ciphers, ...
 {kems,[]},
 {public_keys, ...
 {macs, ...
 {curves, ...
 {rsa_opts, ...
 {fips_forbidden,[{hashs,[blake2s,blake2b,sm3,ripemd160,md5,
                          md4]},
                  {ciphers,[chacha20,sm4_ctr,sm4_ofb,sm4_cfb,sm4_ecb,sm4_cbc,
                            blowfish_ecb,blowfish_ofb64,blowfish_cfb64,blowfish_cbc,
                            des_ede3_cfb,des_ecb,des_cfb,des_cbc,rc4|...]},
                  {kems,[mlkem1024,mlkem768,mlkem512]},
                  {public_keys,[srp,eddh,eddsa,ecdh,ecdsa,ec_gf2m,dss]},
                  {macs,[hmac,poly1305]},
                  {curves,[secp256r1]},
                  {rsa_opts,[]}]}]

Note this will only appear if FIPS is enabled. And this will only appear if SSL API is 3.0 or later.
The behaviour with FIPS disabled or older SSL will remain unchanged.

TO DO

github-actions · 2025-10-21T11:44:05Z

CT Test Results

2 files 14 suites 4m 43s ⏱️
190 tests 155 ✅ 18 💤 17 ❌
478 runs 252 ✅ 143 💤 83 ❌

For more details on these failures, see this check.

Results for commit 0f9b884.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

sverker

I did some testing, and it seems like
EVP_MD_fetch(NULL, p->str_v3, "fips=yes") // if supported with FIPS enabled
EVP_MD_fetch(NULL, p->str_v3, "fips=no") // if supported with FIPS disabled
EVP_MD_fetch(NULL, p->str_v3, "") // if supported in current mode set by EVP_default_properties_enable_fips()

sverker · 2025-10-22T11:24:32Z

lib/crypto/c_src/algorithms.c

+static bool IS_PUBKEY_FORBIDDEN_IN_FIPS(const struct pkey_availability_t* p) {
+    return p->flags == FIPS_FORBIDDEN_PKEY_ALL
+            || p->flags == FIPS_PKEY_NOT_AVAIL;
+}


Is there a difference between FIPS_PKEY_NOT_AVAIL and FIPS_FORBIDDEN_PKEY_ALL?

sverker · 2025-10-29T10:59:16Z

lib/crypto/c_src/algorithms.c

+    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, str_v3, "fips=yes");
+    /* failed: algorithm not available, do not add */
+    if (ctx) {
+        if (EVP_PKEY_keygen_init(ctx) <= 0) { /* can't generate keys */
+            unavailable |= FIPS_FORBIDDEN_PKEY_KEYGEN;
+        }
+        EVP_PKEY_CTX_free(ctx);
+
+        ctx = EVP_PKEY_CTX_new_from_name(NULL, str_v3, NULL);


Why "fips=yes" in one place but not the other.

sverker · 2025-10-29T11:53:43Z

lib/crypto/c_src/algorithms.c

+static size_t curves_lazy_init(ErlNifEnv* env, const bool fips_enabled) {
+    size_t result = 0;
+    if (algo_curve.count >= 0) return algo_curve.count;
+
+    enif_mutex_lock(algo_curve.mtx_init_curve_types);
+    if (algo_curve.count < 0) {
+        init_curves(env, fips_enabled); /* also updates algo_curve.count[0] or [1] */


Why pass fips_enabled to init_curves? We only have one array of curves initialized once here. And fips mode can be switched on/off in runtime with crypto:enable_fips_mode/1 (discouraged but used by our tests).

sverker · 2025-11-17T18:01:38Z

lib/crypto/c_src/algorithms_collection.cpp

+        enif_make_existing_atom(env, atom_name, &atom, ERL_NIF_UTF8);
+        if (!atom) {
+            atom = enif_make_atom(env, atom_name);
+        }


enif_make_atom already does this optimization.

Confused. In erl_nif.c: enif_make_atom calls enif_make_atom_len, which calls enif_make_new_atom_len, which calls erts_atom_put. That doesn't look like its checking for existence.

... which calls erts_atom_put_index, which takes the atom table read lock and does a lookup.

atom_read_lock(); aix = index_get(&erts_atom_table, (void*) &a); atom_read_unlock(); if (aix >= 0) { /* Already in table no need to verify it */ return aix; }

sverker · 2025-11-17T19:20:41Z

lib/crypto/c_src/algorithms_kem.cpp

+        return; // failed to find the algorithm, do not add
+    }
+#endif // FIPS_SUPPORT && HAS_3_0_API
+    return output.push_back(algo);


Function return type is void ?

I knew this is allowed, but now i dug into the actual C++ standard to prove it. Not allowed in C.

I think it's just confusing.

sverker · 2025-11-17T19:41:13Z

lib/crypto/src/crypto.erl

+Do not use this function in your code, it is designed to only be used by the crypto
+library or by Erlang self-tests. This function is called automatically on first load
+of the crypto NIF with the value `fips_mode :: true | false` from crypto app environment.
+
+This operation is not thread-safe, it should only be called once (by the Erlang crypto
+library) and user code calling it, while there are SSL operations running, might get
+undesired consequences, because the attached OpenSSL library structures will switch
+on the fly. Unintended non-FIPS algorithms might become enabled in your FIPS-only code.


I think you can skip the fact that enable_fips_mode is called once by the crypto app itself. That's an irrelevant implementation detail.

sverker · 2025-11-17T19:48:30Z

lib/crypto/c_src/fips.c

+        bool result = FIPS_mode_set(fips_mode) ? atom_true : atom_false;
+        if (result && previous_setting != fips_mode) {
+            /* Reinitialize the algorithms which may disappear or reappear when FIPS mode changes */
+            algorithms_reset_cache();
+        }
+        return result;


Return type is ERL_NIF_TERM which cannot be treated as a bool.

The testing for FIPS mode is not done yet. I now have tested only under non-FIPS, so those code blocks remain disabled with #ifdef, will find it out soon! Fixed this one, thanks for noticing.

kvakvs · 2025-12-04T02:32:54Z

Still WIP cleaning up the CI build errors, tests, under varied OpenSSL versions, but the main work is done

FIPS doc page updated, for enable_fips_mode discourage its manual invocation New store module for algorithms Porting changes from maint Merge in crypto.erl and test SUITE

kvakvs added the team:PS Assigned to OTP team PS label Oct 21, 2025

IngelaAndin requested review from IngelaAndin and sverker October 21, 2025 12:41

IngelaAndin assigned kvakvs Oct 21, 2025

kvakvs force-pushed the 9520-fips-hide-algorithms branch 3 times, most recently from 4fd908c to 65f3f3d Compare October 23, 2025 13:26

kvakvs changed the base branch from master to maint October 23, 2025 13:55

kvakvs force-pushed the 9520-fips-hide-algorithms branch 2 times, most recently from 0c6bd7f to aa72b5e Compare October 23, 2025 13:58

sverker reviewed Oct 29, 2025

View reviewed changes

kvakvs marked this pull request as draft November 9, 2025 15:11

sverker reviewed Nov 17, 2025

View reviewed changes

kvakvs force-pushed the 9520-fips-hide-algorithms branch from f707bd4 to ce79ee2 Compare December 3, 2025 16:20

kvakvs marked this pull request as ready for review December 3, 2025 16:30

kvakvs force-pushed the 9520-fips-hide-algorithms branch 2 times, most recently from 6a32681 to a713a5e Compare December 3, 2025 16:45

kvakvs requested a review from sverker December 4, 2025 02:31

kvakvs force-pushed the 9520-fips-hide-algorithms branch from a713a5e to aeb8c84 Compare December 4, 2025 03:02

Infrastructure for returning additional fields in crypto:supports/0, /1

0f9b884

FIPS doc page updated, for enable_fips_mode discourage its manual invocation New store module for algorithms Porting changes from maint Merge in crypto.erl and test SUITE

kvakvs force-pushed the 9520-fips-hide-algorithms branch from aeb8c84 to 0f9b884 Compare December 4, 2025 04:06

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Are you sure you want to change the base?

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Conversation

kvakvs commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

The Expectation

Solution

TO DO

Uh oh!

github-actions bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CT Test Results

Artifacts

Uh oh!

sverker left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sverker Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kvakvs Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kvakvs commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kvakvs commented Oct 21, 2025 •

edited

Loading

github-actions bot commented Oct 21, 2025 •

edited

Loading

sverker Nov 18, 2025 •

edited

Loading

kvakvs Nov 18, 2025 •

edited

Loading