Commit 9ef31bc736 for openssl.org

commit 9ef31bc73697701219ff439b47f57de5cf61c1bf
Author: Pauli <paul.dale@oracle.com>
Date:   Tue Aug 4 10:49:57 2026 +1000

    Fix FIPS to require a derivation function with CTR-DRBG

    FIPS-140-3 requires that if a CTR-DRBG is allocated from the fips
    provider that either:

    a) The entropy source must be NIST validated and exist within the FIPS
    boundary

    or

    b) The CTR-DRBG must use a derivation function with an entropy source
    outside the FIPS boundary

    Given that we have no approved noise source inside the FIPS boundary, we
    need to enforce the fact that FIPS allocated CTR-DRBGS only allocate
    instances in which a derivation function is requested (i.e. the USE_DF
    parameter is asserted and set to one)

    Follow path b, and ensure that FIPS CTR-DRBG allocations assert the use
    of USE_DF or fail if an allocation does not

    Also fix up the evp tests to skip the 144 tests which allocate a DRBG
    without a derivation function when testing the fips provider

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Mon Aug 10 12:01:41 2026
    (Merged from https://github.com/openssl/openssl/pull/32235)

diff --git a/providers/implementations/rands/drbg_ctr.inc.in b/providers/implementations/rands/drbg_ctr.inc.in
index 74396fb019..69a3a9b2da 100644
--- a/providers/implementations/rands/drbg_ctr.inc.in
+++ b/providers/implementations/rands/drbg_ctr.inc.in
@@ -33,7 +33,7 @@ use OpenSSL::paramnames qw(produce_param_decoder);
 {- produce_param_decoder('drbg_ctr_set_ctx_params',
                          (['OSSL_DRBG_PARAM_PROPERTIES',           'propq',       'utf8_string'],
                           ['OSSL_DRBG_PARAM_CIPHER',               'cipher',      'utf8_string'],
-                          ['OSSL_DRBG_PARAM_USE_DF',               'df',          'int'],
+                          ['OSSL_DRBG_PARAM_USE_DF',               'df',          'int', '!fips'],
                           ['OSSL_PROV_PARAM_CORE_PROV_NAME',       'prov',        'utf8_string'],
                           ['OSSL_DRBG_PARAM_RESEED_REQUESTS',      'reseed_req',  'uint'],
                           ['OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL', 'reseed_time', 'uint64'],