diff --git a/configure.ac b/configure.ac index e867cdfe236..e7ddab817bc 100644 --- a/configure.ac +++ b/configure.ac @@ -2615,7 +2615,8 @@ do done if test "$ENABLED_MLDSA_NO_CTX" = "yes" && test "$ENABLED_FIPS" != "no" && \ - test "$HAVE_FIPS_VERSION" -ge 7 + test "$HAVE_FIPS_VERSION" -ge 7 && (test "$ENABLED_FIPS_DEV" != "yes" || \ + test "$ENABLED_EXPERIMENTAL" != "yes") then AC_MSG_ERROR([ML-DSA no-ctx and draft are not in the FIPS module boundary: drop them from --enable-mldsa (or --enable-dilithium) in a FIPS v7 or later build.]) fi @@ -4587,6 +4588,7 @@ then fi if test "$ENABLED_FIPS" != "no" && test "$HAVE_FIPS_VERSION" -ge 7 && \ + test "$ENABLED_FIPS_DEV" != "yes" && \ { test "$ENABLED_AESSIV" = "yes" || test "$ENABLED_AESEAX" = "yes"; } then AC_MSG_ERROR([AES-SIV and AES-EAX are not in the FIPS module boundary: drop --enable-aessiv, --enable-aeseax, --enable-chrony or --enable-all-nonfips-crypto from a FIPS v7 build.]) @@ -7860,6 +7862,7 @@ do done if test "$ENABLED_FIPS" != "no" && test "$HAVE_FIPS_VERSION" -ge 7 && \ + test "$ENABLED_FIPS_DEV" != "yes" && \ { test "$ENABLED_AESGCMSIV" = "yes" || test "$ENABLED_AESCTS" = "yes" || \ test "$ENABLED_AESKEYWRAP_PADDING" = "yes"; } then diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index d3daf08842b..1cf7965c4a2 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -21059,7 +21059,7 @@ int wc_local_CmacUpdateAes(struct Cmac *cmac, const byte* in, word32 inSz) { #endif /* WOLFSSL_CMAC */ /* AES-SIV, EAX, GCM-SIV, CTS and KWP are kept out of the FIPS image. */ -#if FIPS_VERSION3_GE(7,0,0) && \ +#if FIPS_VERSION3_GE(7,0,0) && !defined(WOLFSSL_FIPS_DEV) && \ (defined(WOLFSSL_AES_SIV) || defined(WOLFSSL_AES_EAX) || \ defined(WOLFSSL_AESGCM_SIV) || defined(WOLFSSL_AES_CTS) || \ defined(WOLFSSL_AES_KEYWRAP_PADDING)) diff --git a/wolfssl/wolfcrypt/wc_mldsa.h b/wolfssl/wolfcrypt/wc_mldsa.h index 17f9d9135f3..cd6e1c8f33e 100644 --- a/wolfssl/wolfcrypt/wc_mldsa.h +++ b/wolfssl/wolfcrypt/wc_mldsa.h @@ -84,6 +84,7 @@ /* The pre-FIPS 204 no-context API is not in the FIPS module boundary. */ #if defined(HAVE_FIPS) && FIPS_VERSION3_GE(7,0,0) && \ + !(defined(WOLFSSL_FIPS_DEV) && defined(WOLFSSL_EXPERIMENTAL_SETTINGS)) && \ (defined(WOLFSSL_MLDSA_NO_CTX) || defined(WOLFSSL_MLDSA_FIPS204_DRAFT)) #error "WOLFSSL_MLDSA_NO_CTX or WOLFSSL_MLDSA_FIPS204_DRAFT is not allowed in FIPS v7 or later." #endif