remove FIPS mode support. people who require FIPS can buy something that

meets their needs, but dumping it in here only penalizes the rest of us.
ok beck deraadt

1 files changed, 0 insertions, 19 deletions

diff --git a/src/lib/libcrypto/ecdh/ech_lib.c b/src/lib/libcrypto/ecdh/ech_lib.c
index 0644431b75..ddf226b166 100644
--- a/src/lib/libcrypto/ecdh/ech_lib.c
+++ b/src/lib/libcrypto/ecdh/ech_lib.c
@@ -73,9 +73,6 @@
 #include <openssl/engine.h>
 #endif
 #include <openssl/err.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
 
 const char ECDH_version[]="ECDH" OPENSSL_VERSION_PTEXT;
 
@@ -94,14 +91,7 @@ const ECDH_METHOD *ECDH_get_default_method(void)
         {
         if(!default_ECDH_method) 
                 {
-#ifdef OPENSSL_FIPS
-                if (FIPS_mode())
-                        return FIPS_ecdh_openssl();
-                else
-                        return ECDH_OpenSSL();
-#else
                 default_ECDH_method = ECDH_OpenSSL();
-#endif
                 }
         return default_ECDH_method;
         }
@@ -234,15 +224,6 @@ ECDH_DATA *ecdh_check(EC_KEY *key)
         }
         else
                 ecdh_data = (ECDH_DATA *)data;
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode() && !(ecdh_data->flags & ECDH_FLAG_FIPS_METHOD)
-                        && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
-                {
-                ECDHerr(ECDH_F_ECDH_CHECK, ECDH_R_NON_FIPS_METHOD);
-                return NULL;
-                }
-#endif
-        
 
         return ecdh_data;
         }