Commit 3d8b51d277 for openssl.org

commit 3d8b51d27714921c74bdebc0b39e4b387c442a63
Author: Neil Horman <nhorman@openssl.org>
Date:   Thu Jul 30 09:27:01 2026 -0400

    Fix FIPS to require a derivation function

    FIPS-140-3 requires that if a CTR-DRBG is allocated from the fips
    provider that either:

    a) The entropy source must be NIST validated and exist within the FIPS
    boundary

    or

    b) The CTR-DRBG must use a derivation function with an entropy source
    outside the FIPS boundary

    Given that we have no approved noise source inside the FIPS boundary, we
    need to enforce the fact that FIPS allocated CTR-DRBGS only allocate
    instances in which a derivation function is requested (i.e. the USE_DF
    parameter is asserted and set to one)

    Follow path b, and ensure that FIPS CTR-DRBG allocations assert the use
    of USE_DF or fail if an allocation does not

    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Mon Aug 10 12:01:38 2026
    (Merged from https://github.com/openssl/openssl/pull/32235)

diff --git a/providers/implementations/rands/drbg_ctr.c b/providers/implementations/rands/drbg_ctr.c
index f99f8f198f..44237c0f1f 100644
--- a/providers/implementations/rands/drbg_ctr.c
+++ b/providers/implementations/rands/drbg_ctr.c
@@ -599,6 +599,18 @@ static int drbg_ctr_init(PROV_DRBG *drbg)
     drbg->strength = (unsigned int)(keylen * 8);
     drbg->seedlen = keylen + 16;

+#ifdef FIPS_MODULE
+    /*
+     * FIPS requires that we use a derivation function since our
+     * entropy source is outside the fips boundary
+     */
+    if (ctr->use_df == 0) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_DERIVATION_FUNCTION_INIT_FAILED,
+            "FIPS requires the use of a derivation function");
+        goto err;
+    }
+#endif
+
     if (ctr->use_df) {
         /* df initialisation */
         static const unsigned char df_key[32] = {