remove FIPS mode support. people who require FIPS can buy something that

meets their needs, but dumping it in here only penalizes the rest of us.
ok miod

1 files changed, 0 insertions, 51 deletions

diff --git a/src/lib/libssl/s3_cbc.c b/src/lib/libssl/s3_cbc.c
index d6cc9b4771..964266e5b2 100644
--- a/src/lib/libssl/s3_cbc.c
+++ b/src/lib/libssl/s3_cbc.c
@@ -386,10 +386,6 @@ tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
 char
 ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
 {
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode())
-                return 0;
-#endif
         switch (EVP_MD_CTX_type(ctx)) {
         case NID_md5:
         case NID_sha1:
@@ -710,50 +706,3 @@ void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
                 *md_out_size = md_out_size_u;
         EVP_MD_CTX_cleanup(&md_ctx);
 }
-
-#ifdef OPENSSL_FIPS
-
-/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
- * we can ensure the number of blocks processed is equal for all cases
- * by digesting additional data.
- */
-
-void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
-    EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
-    size_t orig_len)
-{
-        size_t block_size, digest_pad, blocks_data, blocks_orig;
-        if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
-                return;
-        block_size = EVP_MD_CTX_block_size(mac_ctx);
-        /* We are in FIPS mode if we get this far so we know we have only SHA*
-         * digests and TLS to deal with.
-         * Minimum digest padding length is 17 for SHA384/SHA512 and 9
-         * otherwise.
-         * Additional header is 13 bytes. To get the number of digest blocks
-         * processed round up the amount of data plus padding to the nearest
-         * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
-         * So we have:
-         * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
-         * equivalently:
-         * blocks = (payload_len + digest_pad + 12)/block_size + 1
-         * HMAC adds a constant overhead.
-         * We're ultimately only interested in differences so this becomes
-         * blocks = (payload_len + 29)/128
-         * for SHA384/SHA512 and
-         * blocks = (payload_len + 21)/64
-         * otherwise.
-         */
-        digest_pad = block_size == 64 ? 21 : 29;
-        blocks_orig = (orig_len + digest_pad)/block_size;
-        blocks_data = (data_len + digest_pad)/block_size;
-        /* MAC enough blocks to make up the difference between the original
-         * and actual lengths plus one extra block to ensure this is never a
-         * no op. The "data" pointer should always have enough space to
-         * perform this operation as it is large enough for a maximum
-         * length TLS buffer. 
-         */
-        EVP_DigestSignUpdate(mac_ctx, data,
-        (blocks_orig - blocks_data + 1) * block_size);
-}
-#endif