Commit b64f68a94e for openssl.org

commit b64f68a94e61fa2363c598c75444482b48056697
Author: Neil Horman <nhorman@openssl.org>
Date:   Thu Aug 20 09:09:29 2026 -0400

    Allow X448MLKEM1024 to be fips approved

    According to lightship, we can allow X448MLKEM1024 to be an approved
    hybrid kem, we just can't allow it for use in TLS1.3 (which isn't
    currently possible anyway, given that there is no code point for it).
    So set FIPS_DEFAULT_PROPERTIES on this alg rather than
    FIPS_UNAPPROVED_PROPERTIES.

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Merge-date: Fri Aug 21 14:15:07 2026
    Merged-from: https://github.com/openssl/openssl/pull/32444

diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index b7a4f83217..8d94c141cc 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -586,7 +586,7 @@ static const OSSL_ALGORITHM fips_asym_kem[] = {
     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions },
 #if !defined(OPENSSL_NO_ECX)
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
-    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
+    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
 #endif
 #if !defined(OPENSSL_NO_EC)
     { PROV_NAMES_SecP256r1MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
@@ -657,7 +657,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
 #if !defined(OPENSSL_NO_ECX)
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
-    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
+    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
         PROV_DESCS_X448MLKEM1024 },
 #endif
 #if !defined(OPENSSL_NO_EC)
diff --git a/providers/implementations/include/prov/names.h b/providers/implementations/include/prov/names.h
index 09146dd01e..b2536c2ec9 100644
--- a/providers/implementations/include/prov/names.h
+++ b/providers/implementations/include/prov/names.h
@@ -437,7 +437,7 @@
 #define PROV_NAMES_X25519MLKEM768 "X25519MLKEM768"
 #define PROV_DESCS_X25519MLKEM768 "X25519+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_X448MLKEM1024 "X448MLKEM1024"
-#define PROV_DESCS_X448MLKEM1024 "X448+ML-KEM-1024 TLS hybrid implementation"
+#define PROV_DESCS_X448MLKEM1024 "X448+ML-KEM-1024 hybrid implementation"
 #define PROV_NAMES_SecP256r1MLKEM768 "SecP256r1MLKEM768"
 #define PROV_DESCS_SecP256r1MLKEM768 "P-256+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_SecP384r1MLKEM1024 "SecP384r1MLKEM1024"