Commit 78e812c9a1 for openssl.org

commit 78e812c9a1ab9d072273d2b93ec7225993a6e031
Author: Samuel Sapalski <samuel.sapalski@nokia.com>
Date:   Wed Jan 14 08:55:47 2026 +0100

    FIPS: Disable time/request based reseeding for ECDSA KAT DRBG

    The ECDSA KAT_Signature selftest can fail if the system time changes
    after KAT DRBG initialization, this may trigger a time-based reseed
    and break KAT determinism.

    Disable time-based reseeding for the KAT DRBG to avoid spurious
    selftest failures during e.g. fipsinstall.

    In order to make this fix future proof we disable request based
    reseeding as well to guarantee determinism during the selftest.

    Reviewed-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    MergeDate: Wed Mar  4 16:55:09 2026
    (Merged from https://github.com/openssl/openssl/pull/29633)

diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c
index cb8e17af3c..06a7301ff6 100644
--- a/providers/fips/self_test_kats.c
+++ b/providers/fips/self_test_kats.c
@@ -987,6 +987,8 @@ static int set_kat_drbg(OSSL_LIB_CTX *ctx,
     EVP_RAND *rand;
     unsigned int strength = 256;
     EVP_RAND_CTX *parent_rand = NULL;
+    int reseed_time_interval = 0;
+    unsigned int reseed_requests = 0;
     OSSL_PARAM drbg_params[3] = {
         OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END
     };
@@ -1033,7 +1035,12 @@ static int set_kat_drbg(OSSL_LIB_CTX *ctx,
     EVP_RAND_CTX_free(parent_rand);
     parent_rand = NULL;

-    if (!EVP_RAND_instantiate(kat_rand, strength, 0, persstr, persstr_len, NULL))
+    /* Disable time/request based reseeding to make selftests deterministic */
+    drbg_params[0] = OSSL_PARAM_construct_int(OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL,
+        &reseed_time_interval);
+    drbg_params[1] = OSSL_PARAM_construct_uint(OSSL_DRBG_PARAM_RESEED_REQUESTS,
+        &reseed_requests);
+    if (!EVP_RAND_instantiate(kat_rand, strength, 0, persstr, persstr_len, drbg_params))
         goto err;

     /* When we set the new private generator this one is freed, so upref it */