wpa_supplicant in FIPS 140-2 mode

[Jouni Malinen]

On Wed, Jul 29, 2015 at 05:20:06PM -0400, Jate Sujjavanich wrote:
> I replaced the calls within to aes_wrap/aes_unwrap in crypto_openssl.c with
> the callbacks in aes_wrap.c/aes_unwrap.c. They actually lead down to EVP_*
> functions within OpenSSL which is valid in FIPS mode. The callbacks to
> aes_encrypt_* lead to higher level EVP_* calls which are allowed in FIPS
> mode.
> 
> Do you see anything wrong with this algorithmically as far as encryption is
> concerned?

No, the changes here are just reverting back to the older design. In
fact, all you would have needed to do for this is "git revert
f19c907822ad0dec3480b1435b615ae22c5533a1" (i.e., revert the "OpenSSL:
Implement aes_wrap() and aes_unwrap()" commit).. Like I said, this is
not the direction I want to go to, so I hope that there is a better
solution for AES key wrap than this as far as hostap.git is concerned.

-- 
Jouni Malinen                                            PGP id EFC895FA