Commit d44817c5cb for openssl.org

commit d44817c5cb03361379b6c48fc8367debbd276e75
Author: Milan Broz <gmazyland@gmail.com>
Date:   Mon Aug 24 11:01:10 2026 +0200

    Revert "Allow X448MLKEM1024 to be fips approved"

    This reverts commit b64f68a94e61fa2363c598c75444482b48056697.

    While this combination can be marked as approved (not for TLS),
    it could cause issues in the future.
    As there is no real user requirement for it, keep it disabled.

    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Mon Aug 24 10:07:20 2026
    Merged-from: https://github.com/openssl/openssl/pull/32465

diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index 8d94c141cc..b7a4f83217 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -586,7 +586,7 @@ static const OSSL_ALGORITHM fips_asym_kem[] = {
     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions },
 #if !defined(OPENSSL_NO_ECX)
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
-    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
+    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
 #endif
 #if !defined(OPENSSL_NO_EC)
     { PROV_NAMES_SecP256r1MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
@@ -657,7 +657,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
 #if !defined(OPENSSL_NO_ECX)
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
-    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
+    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
         PROV_DESCS_X448MLKEM1024 },
 #endif
 #if !defined(OPENSSL_NO_EC)
diff --git a/providers/implementations/include/prov/names.h b/providers/implementations/include/prov/names.h
index b2536c2ec9..09146dd01e 100644
--- a/providers/implementations/include/prov/names.h
+++ b/providers/implementations/include/prov/names.h
@@ -437,7 +437,7 @@
 #define PROV_NAMES_X25519MLKEM768 "X25519MLKEM768"
 #define PROV_DESCS_X25519MLKEM768 "X25519+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_X448MLKEM1024 "X448MLKEM1024"
-#define PROV_DESCS_X448MLKEM1024 "X448+ML-KEM-1024 hybrid implementation"
+#define PROV_DESCS_X448MLKEM1024 "X448+ML-KEM-1024 TLS hybrid implementation"
 #define PROV_NAMES_SecP256r1MLKEM768 "SecP256r1MLKEM768"
 #define PROV_DESCS_SecP256r1MLKEM768 "P-256+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_SecP384r1MLKEM1024 "SecP384r1MLKEM1024"