From: Mauri de Souza Meneguzzo <mauri870@gmail.com>
Date: Wed, 18 Dec 2024 16:19:24 +0000 (+0000)
Subject: crypto/ecdsa: fix condition for fips140=only check
X-Git-Tag: go1.24rc2~6^2~67
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=f4e3ec3dbe3b8e04a058d266adf8e048bab563f2;p=gostls13.git

crypto/ecdsa: fix condition for fips140=only check

Fixes #70894

Change-Id: I78c9f2e46006ffc5f1d2886218f8aaaf3f1b59eb
GitHub-Last-Rev: 11f0b452f57aacc40139eab557a8bed1386ad07b
GitHub-Pull-Request: golang/go#70904
Reviewed-on: https://go-review.googlesource.com/c/go/+/637455
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: David Chase <drchase@google.com>
---

diff --git a/src/crypto/ecdsa/ecdsa.go b/src/crypto/ecdsa/ecdsa.go
index 77727aaf96..0f9749975f 100644
--- a/src/crypto/ecdsa/ecdsa.go
+++ b/src/crypto/ecdsa/ecdsa.go
@@ -183,7 +183,7 @@ func GenerateKey(c elliptic.Curve, rand io.Reader) (*PrivateKey, error) {
 }
 
 func generateFIPS[P ecdsa.Point[P]](curve elliptic.Curve, c *ecdsa.Curve[P], rand io.Reader) (*PrivateKey, error) {
-	if fips140only.Enabled && fips140only.ApprovedRandomReader(rand) {
+	if fips140only.Enabled && !fips140only.ApprovedRandomReader(rand) {
 		return nil, errors.New("crypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
 	}
 	privateKey, err := ecdsa.GenerateKey(c, rand)