From 5ae200d5268aa8a2d56a0ba9885466c9b72e79b4 Mon Sep 17 00:00:00 2001 From: Watson Ladd Date: Fri, 20 Aug 2021 15:52:08 -0700 Subject: [PATCH] [dev.boringcrypto] crypto/tls: permit P-521 in FIPS mode While BoringCrypto has a certification for P-521, the go code disallows certificates with it. This change permits those certificates to be used. Change-Id: I451c91a845f22ff0e4c3e922eaf8bf82466e80ae Reviewed-on: https://go-review.googlesource.com/c/go/+/343880 Reviewed-by: Filippo Valsorda Run-TryBot: Filippo Valsorda TryBot-Result: Go Bot Trust: Dmitri Shuralyov --- src/crypto/tls/boring.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/crypto/tls/boring.go b/src/crypto/tls/boring.go index 09f71c1691..dabc67423d 100644 --- a/src/crypto/tls/boring.go +++ b/src/crypto/tls/boring.go @@ -6,6 +6,7 @@ package tls import ( "crypto/ecdsa" + "crypto/elliptic" "crypto/internal/boring/fipstls" "crypto/rsa" "crypto/x509" @@ -85,7 +86,7 @@ func isBoringCertificate(c *x509.Certificate) bool { return true } - // Otherwise the key must be RSA 2048, RSA 3072, or ECDSA P-256. + // Otherwise the key must be RSA 2048, RSA 3072, or ECDSA P-256, P-384, or P-521. switch k := c.PublicKey.(type) { default: return false @@ -94,7 +95,7 @@ func isBoringCertificate(c *x509.Certificate) bool { return false } case *ecdsa.PublicKey: - if name := k.Curve.Params().Name; name != "P-256" && name != "P-384" { + if k.Curve != elliptic.P256() && k.Curve != elliptic.P384() && k.Curve != elliptic.P521() { return false } } -- 2.48.1