diff -up openssl-1.1.1j/apps/pkcs12.c.fips openssl-1.1.1j/apps/pkcs12.c

--- openssl-1.1.1j/apps/pkcs12.c.fips   2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/apps/pkcs12.c    2021-03-03 12:57:42.194734484 +0100

@@ -123,7 +123,7 @@ int pkcs12_main(int argc, char **argv)

     int export_cert = 0, options = 0, chain = 0, twopass = 0, keytype = 0;

     int iter = PKCS12_DEFAULT_ITER, maciter = PKCS12_DEFAULT_ITER;

 #ifndef OPENSSL_NO_RC2

-    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;

+    int cert_pbe = FIPS_mode() ? NID_pbe_WithSHA1And3_Key_TripleDES_CBC : NID_pbe_WithSHA1And40BitRC2_CBC;

 #else

     int cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;

 #endif

diff -up openssl-1.1.1j/apps/speed.c.fips openssl-1.1.1j/apps/speed.c

--- openssl-1.1.1j/apps/speed.c.fips    2021-03-03 12:57:42.185734409 +0100

+++ openssl-1.1.1j/apps/speed.c 2021-03-03 12:57:42.195734492 +0100

@@ -1593,7 +1593,8 @@ int speed_main(int argc, char **argv)

             continue;

         if (strcmp(*argv, "rsa") == 0) {

             for (loop = 0; loop < OSSL_NELEM(rsa_doit); loop++)

-                rsa_doit[loop] = 1;

+       if (!FIPS_mode() || loop != R_RSA_512)

+                    rsa_doit[loop] = 1;

             continue;

         }

         if (found(*argv, rsa_choices, &i)) {

@@ -1603,7 +1604,9 @@ int speed_main(int argc, char **argv)

 #endif

 #ifndef OPENSSL_NO_DSA

         if (strcmp(*argv, "dsa") == 0) {

-            dsa_doit[R_DSA_512] = dsa_doit[R_DSA_1024] =

+            if (!FIPS_mode())

+                dsa_doit[R_DSA_512] = 1;

+            dsa_doit[R_DSA_1024] =

                 dsa_doit[R_DSA_2048] = 1;

             continue;

         }

@@ -1634,19 +1637,21 @@ int speed_main(int argc, char **argv)

         }

         if (strcmp(*argv, "ecdh") == 0) {

             for (loop = 0; loop < OSSL_NELEM(ecdh_doit); loop++)

-                ecdh_doit[loop] = 1;

+                if(!FIPS_mode() || (loop != R_EC_X25519 && loop != R_EC_X448))

+                    ecdh_doit[loop] = 1;

             continue;

         }

         if (found(*argv, ecdh_choices, &i)) {

-            ecdh_doit[i] = 2;

+            if(!FIPS_mode() || (i != R_EC_X25519 && i != R_EC_X448))

+                ecdh_doit[i] = 2;

             continue;

         }

-        if (strcmp(*argv, "eddsa") == 0) {

+        if (!FIPS_mode() && strcmp(*argv, "eddsa") == 0) {

             for (loop = 0; loop < OSSL_NELEM(eddsa_doit); loop++)

                 eddsa_doit[loop] = 1;

             continue;

         }

-        if (found(*argv, eddsa_choices, &i)) {

+        if (!FIPS_mode() && found(*argv, eddsa_choices, &i)) {

             eddsa_doit[i] = 2;

             continue;

         }

@@ -1735,23 +1740,31 @@ int speed_main(int argc, char **argv)

     /* No parameters; turn on everything. */

     if ((argc == 0) && !doit[D_EVP]) {

         for (i = 0; i < ALGOR_NUM; i++)

-            if (i != D_EVP)

+            if (i != D_EVP &&

+                (!FIPS_mode() || (i != D_WHIRLPOOL &&

+                                  i != D_MD2 && i != D_MD4 &&

+                                  i != D_MD5 && i != D_MDC2 &&

+                                  i != D_RMD160)))

                 doit[i] = 1;

 #ifndef OPENSSL_NO_RSA

         for (i = 0; i < RSA_NUM; i++)

-            rsa_doit[i] = 1;

+            if (!FIPS_mode() || i != R_RSA_512)

+                rsa_doit[i] = 1;

 #endif

 #ifndef OPENSSL_NO_DSA

         for (i = 0; i < DSA_NUM; i++)

-            dsa_doit[i] = 1;

+            if (!FIPS_mode() || i != R_DSA_512)

+                dsa_doit[i] = 1;

 #endif

 #ifndef OPENSSL_NO_EC

         for (loop = 0; loop < OSSL_NELEM(ecdsa_doit); loop++)

             ecdsa_doit[loop] = 1;

         for (loop = 0; loop < OSSL_NELEM(ecdh_doit); loop++)

-            ecdh_doit[loop] = 1;

-        for (loop = 0; loop < OSSL_NELEM(eddsa_doit); loop++)

-            eddsa_doit[loop] = 1;

+            if(!FIPS_mode() || (loop != R_EC_X25519 && loop != R_EC_X448))

+                ecdh_doit[loop] = 1;

+        if (!FIPS_mode())

+            for (loop = 0; loop < OSSL_NELEM(eddsa_doit); loop++)

+                eddsa_doit[loop] = 1;

 #endif

     }

     for (i = 0; i < ALGOR_NUM; i++)

@@ -1799,30 +1812,46 @@ int speed_main(int argc, char **argv)

     AES_set_encrypt_key(key24, 192, &aes_ks2);

     AES_set_encrypt_key(key32, 256, &aes_ks3);

 #ifndef OPENSSL_NO_CAMELLIA

-    Camellia_set_key(key16, 128, &camellia_ks1);

-    Camellia_set_key(ckey24, 192, &camellia_ks2);

-    Camellia_set_key(ckey32, 256, &camellia_ks3);

+    if (doit[D_CBC_128_CML] || doit[D_CBC_192_CML] || doit[D_CBC_256_CML]) {

+        Camellia_set_key(key16, 128, &camellia_ks1);

+        Camellia_set_key(ckey24, 192, &camellia_ks2);

+        Camellia_set_key(ckey32, 256, &camellia_ks3);

+    }

 #endif

 #ifndef OPENSSL_NO_IDEA

-    IDEA_set_encrypt_key(key16, &idea_ks);

+    if (doit[D_CBC_IDEA]) {

+        IDEA_set_encrypt_key(key16, &idea_ks);

+    }

 #endif

 #ifndef OPENSSL_NO_SEED

-    SEED_set_key(key16, &seed_ks);

+    if (doit[D_CBC_SEED]) {

+        SEED_set_key(key16, &seed_ks);

+    }

 #endif

 #ifndef OPENSSL_NO_RC4

-    RC4_set_key(&rc4_ks, 16, key16);

+   if (doit[D_RC4]) {

+        RC4_set_key(&rc4_ks, 16, key16);

+    }

 #endif

 #ifndef OPENSSL_NO_RC2

-    RC2_set_key(&rc2_ks, 16, key16, 128);

+    if (doit[D_CBC_RC2]) {

+        RC2_set_key(&rc2_ks, 16, key16, 128);

+    }

 #endif

 #ifndef OPENSSL_NO_RC5

-    RC5_32_set_key(&rc5_ks, 16, key16, 12);

+    if (doit[D_CBC_RC5]) {

+        RC5_32_set_key(&rc5_ks, 16, key16, 12);

+    }

 #endif

 #ifndef OPENSSL_NO_BF

-    BF_set_key(&bf_ks, 16, key16);

+    if (doit[D_CBC_BF]) {

+        BF_set_key(&bf_ks, 16, key16);

+    }

 #endif

 #ifndef OPENSSL_NO_CAST

-    CAST_set_key(&cast_ks, 16, key16);

+    if (doit[D_CBC_CAST]) {

+        CAST_set_key(&cast_ks, 16, key16);

+    }

 #endif

 #ifndef SIGALRM

 # ifndef OPENSSL_NO_DES

@@ -2120,6 +2149,7 @@ int speed_main(int argc, char **argv)

         for (i = 0; i < loopargs_len; i++) {

             loopargs[i].hctx = HMAC_CTX_new();

+            HMAC_CTX_set_flags(loopargs[i].hctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

             if (loopargs[i].hctx == NULL) {

                 BIO_printf(bio_err, "HMAC malloc failure, exiting...");

                 exit(1);

diff -up openssl-1.1.1j/Configure.fips openssl-1.1.1j/Configure

--- openssl-1.1.1j/Configure.fips   2021-03-03 12:57:42.192734467 +0100

+++ openssl-1.1.1j/Configure    2021-03-03 12:57:42.195734492 +0100

@@ -329,7 +329,7 @@ $config{sdirs} = [

     "md2", "md4", "md5", "sha", "mdc2", "hmac", "ripemd", "whrlpool", "poly1305", "blake2", "siphash", "sm3",

     "des", "aes", "rc2", "rc4", "rc5", "idea", "aria", "bf", "cast", "camellia", "seed", "sm4", "chacha", "modes",

     "bn", "ec", "rsa", "dsa", "dh", "sm2", "dso", "engine",

-    "buffer", "bio", "stack", "lhash", "rand", "err",

+    "buffer", "bio", "stack", "lhash", "rand", "err", "fips",

     "evp", "asn1", "pem", "x509", "x509v3", "conf", "txt_db", "pkcs7", "pkcs12", "comp", "ocsp", "ui",

     "cms", "ts", "srp", "cmac", "ct", "async", "kdf", "store"

     ];

diff -up openssl-1.1.1j/crypto/cmac/cm_pmeth.c.fips openssl-1.1.1j/crypto/cmac/cm_pmeth.c

--- openssl-1.1.1j/crypto/cmac/cm_pmeth.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/cmac/cm_pmeth.c   2021-03-03 12:57:42.195734492 +0100

@@ -129,7 +129,7 @@ static int pkey_cmac_ctrl_str(EVP_PKEY_C

 const EVP_PKEY_METHOD cmac_pkey_meth = {

     EVP_PKEY_CMAC,

-    EVP_PKEY_FLAG_SIGCTX_CUSTOM,

+    EVP_PKEY_FLAG_SIGCTX_CUSTOM | EVP_PKEY_FLAG_FIPS,

     pkey_cmac_init,

     pkey_cmac_copy,

     pkey_cmac_cleanup,

diff -up openssl-1.1.1j/crypto/dh/dh_err.c.fips openssl-1.1.1j/crypto/dh/dh_err.c

--- openssl-1.1.1j/crypto/dh/dh_err.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dh/dh_err.c   2021-03-03 12:57:42.195734492 +0100

@@ -25,6 +25,9 @@ static const ERR_STRING_DATA DH_str_func

     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_PEERKEY, 0), "dh_cms_set_peerkey"},

     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_SHARED_INFO, 0),

      "dh_cms_set_shared_info"},

+    {ERR_PACK(ERR_LIB_DH, DH_F_DH_COMPUTE_KEY, 0), "DH_compute_key"},

+    {ERR_PACK(ERR_LIB_DH, DH_F_DH_GENERATE_KEY, 0), "DH_generate_key"},

+    {ERR_PACK(ERR_LIB_DH, DH_F_DH_GENERATE_PARAMETERS_EX, 0), "DH_generate_parameters_ex"},

     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_DUP, 0), "DH_meth_dup"},

     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_NEW, 0), "DH_meth_new"},

     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_SET1_NAME, 0), "DH_meth_set1_name"},

@@ -72,12 +75,14 @@ static const ERR_STRING_DATA DH_str_reas

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_INVALID_PUBKEY), "invalid public key"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_KDF_PARAMETER_ERROR), "kdf parameter error"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_KEYS_NOT_SET), "keys not set"},

+    {ERR_PACK(ERR_LIB_DH, 0, DH_R_KEY_SIZE_TOO_SMALL), "key size too small"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_MISSING_PUBKEY), "missing pubkey"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_MODULUS_TOO_LARGE), "modulus too large"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NOT_SUITABLE_GENERATOR),

     "not suitable generator"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NO_PARAMETERS_SET), "no parameters set"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NO_PRIVATE_VALUE), "no private value"},

+    {ERR_PACK(ERR_LIB_DH, 0, DH_R_NON_FIPS_METHOD), "non FIPS method"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR),

     "parameter encoding error"},

     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"},

diff -up openssl-1.1.1j/crypto/dh/dh_gen.c.fips openssl-1.1.1j/crypto/dh/dh_gen.c

--- openssl-1.1.1j/crypto/dh/dh_gen.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dh/dh_gen.c   2021-03-03 12:57:42.195734492 +0100

@@ -16,6 +16,9 @@

 #include "internal/cryptlib.h"

 #include <openssl/bn.h>

 #include "dh_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 static int dh_builtin_genparams(DH *ret, int prime_len, int generator,

                                 BN_GENCB *cb);

@@ -23,6 +26,13 @@ static int dh_builtin_genparams(DH *ret,

 int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,

                               BN_GENCB *cb)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)

+        && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW)) {

+        DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);

+        return 0;

+    }

+#endif

     if (ret->meth->generate_params)

         return ret->meth->generate_params(ret, prime_len, generator, cb);

     return dh_builtin_genparams(ret, prime_len, generator, cb);

@@ -65,6 +75,18 @@ static int dh_builtin_genparams(DH *ret,

     int g, ok = -1;

     BN_CTX *ctx = NULL;

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_DH_BUILTIN_GENPARAMS, FIPS_R_FIPS_SELFTEST_FAILED);

+        return 0;

+    }

+

+    if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN)) {

+        DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);

+        goto err;

+    }

+#endif

+

     ctx = BN_CTX_new();

     if (ctx == NULL)

         goto err;

diff -up openssl-1.1.1j/crypto/dh/dh_key.c.fips openssl-1.1.1j/crypto/dh/dh_key.c

--- openssl-1.1.1j/crypto/dh/dh_key.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dh/dh_key.c   2021-03-03 13:02:45.963247596 +0100

@@ -11,6 +11,9 @@

 #include "internal/cryptlib.h"

 #include "dh_local.h"

 #include "crypto/bn.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 static int generate_key(DH *dh);

 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);

@@ -34,6 +37,13 @@ int DH_compute_key(unsigned char *key, c

     int ret = 0, i;

     volatile size_t npad = 0, mask = 1;

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)

+        && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW)) {

+        DHerr(DH_F_DH_COMPUTE_KEY, DH_R_NON_FIPS_METHOD);

+        return 0;

+    }

+#endif

     /* compute the key; ret is constant unless compute_key is external */

     if ((ret = dh->meth->compute_key(key, pub_key, dh)) <= 0)

         return ret;

@@ -109,6 +119,14 @@ static int generate_key(DH *dh)

     BN_MONT_CTX *mont = NULL;

     BIGNUM *pub_key = NULL, *priv_key = NULL;

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode()

+        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {

+        DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);

+        return 0;

+    }

+#endif

+

     if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {

         DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);

         return 0;

@@ -206,6 +224,13 @@ static int compute_key(unsigned char *ke

         DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE);

         goto err;

     }

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode()

+        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {

+        DHerr(DH_F_COMPUTE_KEY, DH_R_KEY_SIZE_TOO_SMALL);

+        goto err;

+    }

+#endif

     ctx = BN_CTX_new();

     if (ctx == NULL)

@@ -255,6 +280,9 @@ static int dh_bn_mod_exp(const DH *dh, B

 static int dh_init(DH *dh)

 {

+#ifdef OPENSSL_FIPS

+    FIPS_selftest_check();

+#endif

     dh->flags |= DH_FLAG_CACHE_MONT_P;

     return 1;

 }

diff -up openssl-1.1.1j/crypto/dh/dh_pmeth.c.fips openssl-1.1.1j/crypto/dh/dh_pmeth.c

--- openssl-1.1.1j/crypto/dh/dh_pmeth.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dh/dh_pmeth.c 2021-03-03 12:57:42.196734500 +0100

@@ -480,7 +480,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *

 const EVP_PKEY_METHOD dh_pkey_meth = {

     EVP_PKEY_DH,

-    0,

+    EVP_PKEY_FLAG_FIPS,

     pkey_dh_init,

     pkey_dh_copy,

     pkey_dh_cleanup,

@@ -514,7 +514,7 @@ const EVP_PKEY_METHOD dh_pkey_meth = {

 const EVP_PKEY_METHOD dhx_pkey_meth = {

     EVP_PKEY_DHX,

-    0,

+    EVP_PKEY_FLAG_FIPS,

     pkey_dh_init,

     pkey_dh_copy,

     pkey_dh_cleanup,

diff -up openssl-1.1.1j/crypto/dsa/dsa_err.c.fips openssl-1.1.1j/crypto/dsa/dsa_err.c

--- openssl-1.1.1j/crypto/dsa/dsa_err.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dsa/dsa_err.c 2021-03-03 12:57:42.196734500 +0100

@@ -16,12 +16,15 @@

 static const ERR_STRING_DATA DSA_str_functs[] = {

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSAPARAMS_PRINT, 0), "DSAparams_print"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSAPARAMS_PRINT_FP, 0), "DSAparams_print_fp"},

+    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_KEYGEN, 0), "dsa_builtin_keygen"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_PARAMGEN, 0),

      "dsa_builtin_paramgen"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_PARAMGEN2, 0),

      "dsa_builtin_paramgen2"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_DO_SIGN, 0), "DSA_do_sign"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_DO_VERIFY, 0), "DSA_do_verify"},

+    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_GENERATE_KEY, 0), "DSA_generate_key"},

+    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_GENERATE_PARAMETERS_EX, 0), "DSA_generate_parameters_ex"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_DUP, 0), "DSA_meth_dup"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_NEW, 0), "DSA_meth_new"},

     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_SET1_NAME, 0), "DSA_meth_set1_name"},

@@ -51,11 +54,14 @@ static const ERR_STRING_DATA DSA_str_rea

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_INVALID_DIGEST_TYPE),

     "invalid digest type"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_INVALID_PARAMETERS), "invalid parameters"},

+    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_KEY_SIZE_INVALID), "key size invalid"},

+    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_KEY_SIZE_TOO_SMALL), "key size too small"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_MISSING_PARAMETERS), "missing parameters"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_MISSING_PRIVATE_KEY),

     "missing private key"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_MODULUS_TOO_LARGE), "modulus too large"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_NO_PARAMETERS_SET), "no parameters set"},

+    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_NON_FIPS_DSA_METHOD), "non FIPS DSA method"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_PARAMETER_ENCODING_ERROR),

     "parameter encoding error"},

     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_Q_NOT_PRIME), "q not prime"},

diff -up openssl-1.1.1j/crypto/dsa/dsa_gen.c.fips openssl-1.1.1j/crypto/dsa/dsa_gen.c

--- openssl-1.1.1j/crypto/dsa/dsa_gen.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dsa/dsa_gen.c 2021-03-03 12:57:42.196734500 +0100

@@ -22,12 +22,22 @@

 #include <openssl/rand.h>

 #include <openssl/sha.h>

 #include "dsa_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 int DSA_generate_parameters_ex(DSA *ret, int bits,

                                const unsigned char *seed_in, int seed_len,

                                int *counter_ret, unsigned long *h_ret,

                                BN_GENCB *cb)

 {

+# ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)

+        && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW)) {

+        DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);

+        return 0;

+    }

+# endif

     if (ret->meth->dsa_paramgen)

         return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,

                                        counter_ret, h_ret, cb);

@@ -35,9 +45,15 @@ int DSA_generate_parameters_ex(DSA *ret,

         const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();

         size_t qbits = EVP_MD_size(evpmd) * 8;

+# ifdef OPENSSL_FIPS

+        return dsa_builtin_paramgen2(ret, bits, qbits, evpmd,

+                          seed_in, seed_len, -1, NULL, counter_ret,

+                          h_ret, cb);

+# else

         return dsa_builtin_paramgen(ret, bits, qbits, evpmd,

                                     seed_in, seed_len, NULL, counter_ret,

                                     h_ret, cb);

+# endif

     }

 }

@@ -309,7 +325,7 @@ int dsa_builtin_paramgen2(DSA *ret, size

                           int *counter_ret, unsigned long *h_ret,

                           BN_GENCB *cb)

 {

-    int ok = -1;

+    int ok = 0;

     unsigned char *seed = NULL, *seed_tmp = NULL;

     unsigned char md[EVP_MAX_MD_SIZE];

     int mdsize;

@@ -332,6 +348,20 @@ int dsa_builtin_paramgen2(DSA *ret, size

         goto err;

     }

+# ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_DSA_BUILTIN_PARAMGEN2, FIPS_R_FIPS_SELFTEST_FAILED);

+        goto err;

+    }

+

+    if (FIPS_mode() &&

+        (L != 2048 || N != 224) && (L != 2048 || N != 256) &&

+        (L != 3072 || N != 256)) {

+        DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_KEY_SIZE_INVALID);

+        goto err;

+    }

+# endif

+

     if (evpmd == NULL) {

         if (N == 160)

             evpmd = EVP_sha1();

@@ -432,9 +462,10 @@ int dsa_builtin_paramgen2(DSA *ret, size

                 goto err;

             /* Provided seed didn't produce a prime: error */

             if (seed_in) {

-                ok = 0;

-                DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_Q_NOT_PRIME);

-                goto err;

+                /* Different seed_out will indicate that seed_in

+                 * did not generate primes.

+                 */

+                seed_in = NULL;

             }

             /* do a callback call */

@@ -520,11 +551,14 @@ int dsa_builtin_paramgen2(DSA *ret, size

             if (counter >= (int)(4 * L))

                 break;

         }

+#if 0

+        /* Cannot happen */

         if (seed_in) {

             ok = 0;

             DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_INVALID_PARAMETERS);

             goto err;

         }

+#endif

     }

  end:

     if (!BN_GENCB_call(cb, 2, 1))

@@ -595,7 +629,7 @@ int dsa_builtin_paramgen2(DSA *ret, size

         BN_free(ret->g);

         ret->g = BN_dup(g);

         if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {

-            ok = -1;

+            ok = 0;

             goto err;

         }

         if (counter_ret != NULL)

@@ -612,3 +646,53 @@ int dsa_builtin_paramgen2(DSA *ret, size

     EVP_MD_CTX_free(mctx);

     return ok;

 }

+

+#ifdef OPENSSL_FIPS

+

+int FIPS_dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,

+                               const EVP_MD *evpmd, const unsigned char *seed_in,

+                               size_t seed_len, int idx, unsigned char *seed_out,

+                               int *counter_ret, unsigned long *h_ret,

+                               BN_GENCB *cb)

+{

+    return dsa_builtin_paramgen2(ret, L, N, evpmd, seed_in, seed_len,

+        idx, seed_out, counter_ret, h_ret, cb);

+}

+

+int FIPS_dsa_paramgen_check_g(DSA *dsa)

+{

+    BN_CTX *ctx;

+    BIGNUM *tmp;

+    BN_MONT_CTX *mont = NULL;

+    int rv = -1;

+

+    ctx = BN_CTX_new();

+    if (ctx == NULL)

+        return -1;

+    if (BN_cmp(dsa->g, BN_value_one()) <= 0)

+        return 0;

+    if (BN_cmp(dsa->g, dsa->p) >= 0)

+        return 0;

+    BN_CTX_start(ctx);

+    tmp = BN_CTX_get(ctx);

+    if (tmp == NULL)

+        goto err;

+    if ((mont=BN_MONT_CTX_new()) == NULL)

+        goto err;

+    if (!BN_MONT_CTX_set(mont,dsa->p,ctx))

+        goto err;

+    /* Work out g^q mod p */

+    if (!BN_mod_exp_mont(tmp,dsa->g,dsa->q, dsa->p, ctx, mont))

+        goto err;

+    if (!BN_cmp(tmp, BN_value_one()))

+        rv = 1;

+    else

+        rv = 0;

+ err:

+    BN_CTX_end(ctx);

+    BN_MONT_CTX_free(mont);

+    BN_CTX_free(ctx);

+    return rv;

+}

+

+#endif

diff -up openssl-1.1.1j/crypto/dsa/dsa_key.c.fips openssl-1.1.1j/crypto/dsa/dsa_key.c

--- openssl-1.1.1j/crypto/dsa/dsa_key.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dsa/dsa_key.c 2021-03-03 12:57:42.196734500 +0100

@@ -13,10 +13,49 @@

 #include <openssl/bn.h>

 #include "dsa_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+# include "crypto/fips.h"

+

+static int fips_check_dsa(DSA *dsa)

+{

+    EVP_PKEY *pk;

+    unsigned char tbs[] = "DSA Pairwise Check Data";

+    int ret = 0;

+

+    if ((pk = EVP_PKEY_new()) == NULL)

+        goto err;

+

+    EVP_PKEY_set1_DSA(pk, dsa);

+

+    if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))

+        ret = 1;

+

+ err:

+    if (ret == 0) {

+        FIPSerr(FIPS_F_FIPS_CHECK_DSA, FIPS_R_PAIRWISE_TEST_FAILED);

+        fips_set_selftest_fail();

+    }

+

+    if (pk)

+        EVP_PKEY_free(pk);

+

+    return ret;

+}

+

+#endif

+

 static int dsa_builtin_keygen(DSA *dsa);

 int DSA_generate_key(DSA *dsa)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)

+        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)) {

+        DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);

+        return 0;

+    }

+#endif

     if (dsa->meth->dsa_keygen)

         return dsa->meth->dsa_keygen(dsa);

     return dsa_builtin_keygen(dsa);

@@ -28,6 +67,14 @@ static int dsa_builtin_keygen(DSA *dsa)

     BN_CTX *ctx = NULL;

     BIGNUM *pub_key = NULL, *priv_key = NULL;

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)

+        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN)) {

+        DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);

+        goto err;

+    }

+#endif

+

     if ((ctx = BN_CTX_new()) == NULL)

         goto err;

@@ -65,6 +112,13 @@ static int dsa_builtin_keygen(DSA *dsa)

     dsa->priv_key = priv_key;

     dsa->pub_key = pub_key;

+#ifdef OPENSSL_FIPS

+    if (FIPS_mode() && !fips_check_dsa(dsa)) {

+        dsa->pub_key = NULL;

+        dsa->priv_key = NULL;

+        goto err;

+    }

+#endif

     ok = 1;

  err:

diff -up openssl-1.1.1j/crypto/dsa/dsa_ossl.c.fips openssl-1.1.1j/crypto/dsa/dsa_ossl.c

--- openssl-1.1.1j/crypto/dsa/dsa_ossl.c.fips   2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dsa/dsa_ossl.c    2021-03-03 12:57:42.196734500 +0100

@@ -14,6 +14,9 @@

 #include <openssl/sha.h>

 #include "dsa_local.h"

 #include <openssl/asn1.h>

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);

 static int dsa_sign_setup_no_digest(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,

@@ -77,6 +80,19 @@ static DSA_SIG *dsa_do_sign(const unsign

         goto err;

     }

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_DSA_DO_SIGN, FIPS_R_FIPS_SELFTEST_FAILED);

+        return NULL;

+    }

+

+    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)

+        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {

+        DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_KEY_SIZE_TOO_SMALL);

+        return NULL;

+    }

+#endif

+

     ret = DSA_SIG_new();

     if (ret == NULL)

         goto err;

@@ -315,6 +331,18 @@ static int dsa_do_verify(const unsigned

         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_BAD_Q_VALUE);

         return -1;

     }

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_DSA_DO_VERIFY, FIPS_R_FIPS_SELFTEST_FAILED);

+        return -1;

+    }

+

+    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)

+        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {

+        DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);

+        return -1;

+    }

+#endif

     if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {

         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_MODULUS_TOO_LARGE);

@@ -403,6 +431,9 @@ static int dsa_do_verify(const unsigned

 static int dsa_init(DSA *dsa)

 {

+#ifdef OPENSSL_FIPS

+    FIPS_selftest_check();

+#endif

     dsa->flags |= DSA_FLAG_CACHE_MONT_P;

     return 1;

 }

diff -up openssl-1.1.1j/crypto/dsa/dsa_pmeth.c.fips openssl-1.1.1j/crypto/dsa/dsa_pmeth.c

--- openssl-1.1.1j/crypto/dsa/dsa_pmeth.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/dsa/dsa_pmeth.c   2021-03-03 12:57:42.196734500 +0100

@@ -211,8 +211,8 @@ static int pkey_dsa_paramgen(EVP_PKEY_CT

         BN_GENCB_free(pcb);

         return 0;

     }

-    ret = dsa_builtin_paramgen(dsa, dctx->nbits, dctx->qbits, dctx->pmd,

-                               NULL, 0, NULL, NULL, NULL, pcb);

+    ret = dsa_builtin_paramgen2(dsa, dctx->nbits, dctx->qbits, dctx->pmd,

+                               NULL, 0, -1, NULL, NULL, NULL, pcb);

     BN_GENCB_free(pcb);

     if (ret)

         EVP_PKEY_assign_DSA(pkey, dsa);

@@ -241,7 +241,7 @@ static int pkey_dsa_keygen(EVP_PKEY_CTX

 const EVP_PKEY_METHOD dsa_pkey_meth = {

     EVP_PKEY_DSA,

-    EVP_PKEY_FLAG_AUTOARGLEN,

+    EVP_PKEY_FLAG_AUTOARGLEN | EVP_PKEY_FLAG_FIPS,

     pkey_dsa_init,

     pkey_dsa_copy,

     pkey_dsa_cleanup,

diff -up openssl-1.1.1j/crypto/ec/ecdh_ossl.c.fips openssl-1.1.1j/crypto/ec/ecdh_ossl.c

--- openssl-1.1.1j/crypto/ec/ecdh_ossl.c.fips   2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/ec/ecdh_ossl.c    2021-03-03 12:57:42.196734500 +0100

@@ -19,9 +19,20 @@

 #include <openssl/ec.h>

 #include "ec_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

+

 int ossl_ecdh_compute_key(unsigned char **psec, size_t *pseclen,

                           const EC_POINT *pub_key, const EC_KEY *ecdh)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_ECDH_COMPUTE_KEY, FIPS_R_FIPS_SELFTEST_FAILED);

+        return -1;

+    }

+#endif

+

     if (ecdh->group->meth->ecdh_compute_key == NULL) {

         ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_CURVE_DOES_NOT_SUPPORT_ECDH);

         return 0;

diff -up openssl-1.1.1j/crypto/ec/ecdsa_ossl.c.fips openssl-1.1.1j/crypto/ec/ecdsa_ossl.c

--- openssl-1.1.1j/crypto/ec/ecdsa_ossl.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/ec/ecdsa_ossl.c   2021-03-03 12:57:42.196734500 +0100

@@ -14,6 +14,10 @@

 #include "crypto/bn.h"

 #include "ec_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

+

 int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,

                           BIGNUM **rp)

 {

@@ -163,6 +167,13 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns

     ECDSA_SIG *ret;

     const BIGNUM *priv_key;

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_OSSL_ECDSA_SIGN_SIG, FIPS_R_FIPS_SELFTEST_FAILED);

+        return NULL;

+    }

+#endif

+

     group = EC_KEY_get0_group(eckey);

     priv_key = EC_KEY_get0_private_key(eckey);

@@ -325,6 +336,13 @@ int ossl_ecdsa_verify_sig(const unsigned

     const EC_GROUP *group;

     const EC_POINT *pub_key;

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_OSSL_ECDSA_VERIFY_SIG, FIPS_R_FIPS_SELFTEST_FAILED);

+        return -1;

+    }

+#endif

+

     /* check input values */

     if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||

         (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {

diff -up openssl-1.1.1j/crypto/ec/ec_key.c.fips openssl-1.1.1j/crypto/ec/ec_key.c

--- openssl-1.1.1j/crypto/ec/ec_key.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/ec/ec_key.c   2021-03-03 12:57:42.196734500 +0100

@@ -179,14 +179,62 @@ ENGINE *EC_KEY_get0_engine(const EC_KEY

     return eckey->engine;

 }

+#ifdef OPENSSL_FIPS

+

+# include <openssl/fips.h>

+# include "crypto/fips.h"

+

+static int fips_check_ec(EC_KEY *key)

+{

+    EVP_PKEY *pk;

+    unsigned char tbs[] = "ECDSA Pairwise Check Data";

+    int ret = 0;

+

+    if (!EC_KEY_can_sign(key)) /* no test for non-signing keys */

+        return 1;

+

+    if ((pk = EVP_PKEY_new()) == NULL)

+        goto err;

+

+    EVP_PKEY_set1_EC_KEY(pk, key);

+

+    if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))

+        ret = 1;

+

+ err:

+    if (ret == 0) {

+        FIPSerr(FIPS_F_FIPS_CHECK_EC, FIPS_R_PAIRWISE_TEST_FAILED);

+        fips_set_selftest_fail();

+    }

+    if (pk)

+        EVP_PKEY_free(pk);

+    return ret;

+}

+

+#endif

+

 int EC_KEY_generate_key(EC_KEY *eckey)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        ECerr(EC_F_EC_KEY_GENERATE_KEY, EC_R_NOT_INITIALIZED);

+        return 0;

+    }

+#endif

     if (eckey == NULL || eckey->group == NULL) {

         ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);

         return 0;

     }

-    if (eckey->meth->keygen != NULL)

-        return eckey->meth->keygen(eckey);

+    if (eckey->meth->keygen != NULL) {

+        int rv = eckey->meth->keygen(eckey);

+

+#ifdef OPENSSL_FIPS

+        if (rv > 0 && FIPS_mode()) {

+            rv = fips_check_ec(eckey);

+        }

+#endif

+        return rv;

+    }

     ECerr(EC_F_EC_KEY_GENERATE_KEY, EC_R_OPERATION_NOT_SUPPORTED);

     return 0;

 }

diff -up openssl-1.1.1j/crypto/ec/ec_pmeth.c.fips openssl-1.1.1j/crypto/ec/ec_pmeth.c

--- openssl-1.1.1j/crypto/ec/ec_pmeth.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/ec/ec_pmeth.c 2021-03-03 12:57:42.197734509 +0100

@@ -438,7 +438,7 @@ static int pkey_ec_keygen(EVP_PKEY_CTX *

 const EVP_PKEY_METHOD ec_pkey_meth = {

     EVP_PKEY_EC,

-    0,

+    EVP_PKEY_FLAG_FIPS,

     pkey_ec_init,

     pkey_ec_copy,

     pkey_ec_cleanup,

diff -up openssl-1.1.1j/crypto/evp/digest.c.fips openssl-1.1.1j/crypto/evp/digest.c

--- openssl-1.1.1j/crypto/evp/digest.c.fips 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/digest.c  2021-03-03 12:57:42.197734509 +0100

@@ -14,6 +14,9 @@

 #include <openssl/engine.h>

 #include "crypto/evp.h"

 #include "evp_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 /* This call frees resources associated with the context */

 int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)

@@ -66,6 +69,12 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, cons

 int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)

 {

     EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_EVP_DIGESTINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);

+        return 0;

+    }

+#endif

 #ifndef OPENSSL_NO_ENGINE

     /*

      * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so

@@ -119,6 +128,15 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c

     }

 #endif

     if (ctx->digest != type) {

+#ifdef OPENSSL_FIPS

+        if (FIPS_mode()) {

+            if (!(type->flags & EVP_MD_FLAG_FIPS)

+                && !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)) {

+                EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_DISABLED_FOR_FIPS);

+                return 0;

+            }

+        }

+#endif

         if (ctx->digest && ctx->digest->ctx_size) {

             OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);

             ctx->md_data = NULL;

@@ -150,6 +168,10 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c

 int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)

 {

+#ifdef OPENSSL_FIPS

+    FIPS_selftest_check();

+#endif

+

     if (count == 0)

         return 1;

@@ -170,6 +192,9 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx,

 {

     int ret;

+#ifdef OPENSSL_FIPS

+    FIPS_selftest_check();

+#endif

     OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);

     ret = ctx->digest->final(ctx, md);

     if (size != NULL)

diff -up openssl-1.1.1j/crypto/evp/e_aes.c.fips openssl-1.1.1j/crypto/evp/e_aes.c

--- openssl-1.1.1j/crypto/evp/e_aes.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/e_aes.c   2021-03-03 12:57:42.197734509 +0100

@@ -397,7 +397,7 @@ static int aesni_xts_init_key(EVP_CIPHER

          * This addresses Rogaway's vulnerability.

          * See comment in aes_xts_init_key() below.

          */

-        if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

+        if (CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

             EVPerr(EVP_F_AESNI_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);

             return 0;

         }

@@ -817,7 +817,7 @@ static int aes_t4_xts_init_key(EVP_CIPHE

          * This addresses Rogaway's vulnerability.

          * See comment in aes_xts_init_key() below.

          */

-        if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

+        if (CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

             EVPerr(EVP_F_AES_T4_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);

             return 0;

         }

@@ -2833,9 +2833,9 @@ static int aes_ctr_cipher(EVP_CIPHER_CTX

     return 1;

 }

-BLOCK_CIPHER_generic_pack(NID_aes, 128, 0)

-    BLOCK_CIPHER_generic_pack(NID_aes, 192, 0)

-    BLOCK_CIPHER_generic_pack(NID_aes, 256, 0)

+BLOCK_CIPHER_generic_pack(NID_aes, 128, EVP_CIPH_FLAG_FIPS)

+    BLOCK_CIPHER_generic_pack(NID_aes, 192, EVP_CIPH_FLAG_FIPS)

+    BLOCK_CIPHER_generic_pack(NID_aes, 256, EVP_CIPH_FLAG_FIPS)

 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)

 {

@@ -2869,6 +2869,11 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *

     case EVP_CTRL_AEAD_SET_IVLEN:

         if (arg <= 0)

             return 0;

+# ifdef OPENSSL_FIPS

+        if (FIPS_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)

+            && arg < 12)

+            return 0;

+# endif

         /* Allocate memory for IV if needed */

         if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) {

             if (gctx->iv != c->iv)

@@ -3318,11 +3323,14 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX

                 | EVP_CIPH_CUSTOM_COPY | EVP_CIPH_CUSTOM_IV_LENGTH)

 BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, gcm, GCM,

-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |

+                    CUSTOM_FLAGS)

     BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, gcm, GCM,

-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |

+                    CUSTOM_FLAGS)

     BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, gcm, GCM,

-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |

+                    CUSTOM_FLAGS)

 static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)

 {

@@ -3380,7 +3388,7 @@ static int aes_xts_init_key(EVP_CIPHER_C

              *       BEFORE using the keys in the XTS-AES algorithm to process

              *       data with them."

              */

-            if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

+            if (CRYPTO_memcmp(key, key + bytes, bytes) == 0) {

                 EVPerr(EVP_F_AES_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);

                 return 0;

             }

@@ -3484,6 +3492,14 @@ static int aes_xts_cipher(EVP_CIPHER_CTX

         return 0;

     if (!out || !in || len < AES_BLOCK_SIZE)

         return 0;

+# ifdef OPENSSL_FIPS

+    /* Requirement of SP800-38E */

+    if (FIPS_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&

+        (len > (1UL << 20) * 16)) {

+        EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_TOO_LARGE);

+        return 0;

+    }

+# endif

     if (xctx->stream)

         (*xctx->stream) (in, out, len,

                          xctx->xts.key1, xctx->xts.key2,

@@ -3501,8 +3517,10 @@ static int aes_xts_cipher(EVP_CIPHER_CTX

                          | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \

                          | EVP_CIPH_CUSTOM_COPY)

-BLOCK_CIPHER_custom(NID_aes, 128, 1, 16, xts, XTS, XTS_FLAGS)

-    BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)

+BLOCK_CIPHER_custom(NID_aes, 128, 1, 16, xts, XTS,

+                    EVP_CIPH_FLAG_FIPS | XTS_FLAGS)

+    BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS,

+                    EVP_CIPH_FLAG_FIPS | XTS_FLAGS)

 static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)

 {

@@ -3772,11 +3790,11 @@ static int aes_ccm_cipher(EVP_CIPHER_CTX

 #define aes_ccm_cleanup NULL

 BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, ccm, CCM,

-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

     BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, ccm, CCM,

-                        EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                        EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

     BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, ccm, CCM,

-                        EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

+                        EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)

 typedef struct {

     union {

@@ -3869,7 +3887,7 @@ static int aes_wrap_cipher(EVP_CIPHER_CT

     return rv ? (int)rv : -1;

 }

-#define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE \

+#define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE | EVP_CIPH_FLAG_FIPS \

                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \

                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_FLAG_DEFAULT_ASN1)

diff -up openssl-1.1.1j/crypto/evp/e_des3.c.fips openssl-1.1.1j/crypto/evp/e_des3.c

--- openssl-1.1.1j/crypto/evp/e_des3.c.fips 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/e_des3.c  2021-03-03 12:57:42.197734509 +0100

@@ -211,16 +211,19 @@ BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY,

 # define des_ede3_cbc_cipher des_ede_cbc_cipher

 # define des_ede3_ecb_cipher des_ede_ecb_cipher

     BLOCK_CIPHER_defs(des_ede3, DES_EDE_KEY, NID_des_ede3, 8, 24, 8, 64,

-                  EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,

-                  des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)

+                  EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |

+                  EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL, NULL,

+                  des3_ctrl)

     BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 1,

-                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,

-                     des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)

+                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |

+                     EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL,

+                     NULL, des3_ctrl)

     BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 8,

-                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,

-                     des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)

+                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |

+                     EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL,

+                     NULL, des3_ctrl)

 static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

                             const unsigned char *iv, int enc)

diff -up openssl-1.1.1j/crypto/evp/e_null.c.fips openssl-1.1.1j/crypto/evp/e_null.c

--- openssl-1.1.1j/crypto/evp/e_null.c.fips 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/e_null.c  2021-03-03 12:57:42.197734509 +0100

@@ -19,7 +19,8 @@ static int null_cipher(EVP_CIPHER_CTX *c

                        const unsigned char *in, size_t inl);

 static const EVP_CIPHER n_cipher = {

     NID_undef,

-    1, 0, 0, 0,

+    1, 0, 0,

+    EVP_CIPH_FLAG_FIPS,

     null_init_key,

     null_cipher,

     NULL,

diff -up openssl-1.1.1j/crypto/evp/evp_enc.c.fips openssl-1.1.1j/crypto/evp/evp_enc.c

--- openssl-1.1.1j/crypto/evp/evp_enc.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/evp_enc.c 2021-03-03 12:57:42.197734509 +0100

@@ -18,9 +18,18 @@

 #include <openssl/engine.h>

 #include "crypto/evp.h"

 #include "evp_local.h"

+#ifdef OPENSSL_FIPS

+# include <openssl/fips.h>

+#endif

 int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_EVP_CIPHER_CTX_RESET, FIPS_R_FIPS_SELFTEST_FAILED);

+        return 0;

+    }

+#endif

     if (c == NULL)

         return 1;

     if (c->cipher != NULL) {

@@ -40,6 +49,12 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX

 EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)

 {

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_EVP_CIPHER_CTX_NEW, FIPS_R_FIPS_SELFTEST_FAILED);

+        return NULL;

+    }

+#endif

     return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));

 }

@@ -68,6 +83,12 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct

             enc = 1;

         ctx->encrypt = enc;

     }

+#ifdef OPENSSL_FIPS

+    if (FIPS_selftest_failed()) {

+        FIPSerr(FIPS_F_EVP_CIPHERINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);

+        return 0;

+    }

+#endif

 #ifndef OPENSSL_NO_ENGINE

     /*

      * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so

@@ -137,7 +158,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct

         }

         ctx->key_len = cipher->key_len;

         /* Preserve wrap enable flag, zero everything else */

-        ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;

+        ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW | EVP_CIPH_FLAG_NON_FIPS_ALLOW;

         if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {

             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {

                 ctx->cipher = NULL;

@@ -196,6 +217,18 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct

             return 0;

         }

     }

+#ifdef OPENSSL_FIPS

+    /* After 'key' is set no further parameters changes are permissible.

+     * So only check for non FIPS enabling at this point.

+     */

+    if (key && FIPS_mode()) {

+        if (!(ctx->cipher->flags & EVP_CIPH_FLAG_FIPS)

+            & !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)) {

+            EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_DISABLED_FOR_FIPS);

+            return 0;

+        }

+    }

+#endif

     if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {

         if (!ctx->cipher->init(ctx, key, iv, enc))

diff -up openssl-1.1.1j/crypto/evp/evp_err.c.fips openssl-1.1.1j/crypto/evp/evp_err.c

--- openssl-1.1.1j/crypto/evp/evp_err.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/evp_err.c 2021-03-03 12:57:42.198734517 +0100

@@ -23,6 +23,7 @@ static const ERR_STRING_DATA EVP_str_fun

     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_T4_XTS_INIT_KEY, 0),

      "aes_t4_xts_init_key"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_WRAP_CIPHER, 0), "aes_wrap_cipher"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_XTS_CIPHER, 0), "aes_xts_cipher"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_XTS_INIT_KEY, 0), "aes_xts_init_key"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_ALG_MODULE_INIT, 0), "alg_module_init"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_CCM_INIT_KEY, 0), "aria_ccm_init_key"},

@@ -186,6 +187,7 @@ static const ERR_STRING_DATA EVP_str_rea

     "different key types"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_DIFFERENT_PARAMETERS),

     "different parameters"},

+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_DISABLED_FOR_FIPS), "disabled for FIPS"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ERROR_LOADING_SECTION),

     "error loading section"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ERROR_SETTING_FIPS_MODE),

@@ -251,6 +253,7 @@ static const ERR_STRING_DATA EVP_str_rea

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PRIVATE_KEY_ENCODE_ERROR),

     "private key encode error"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"},

+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_TOO_LARGE), "too large"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_CIPHER), "unknown cipher"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_DIGEST), "unknown digest"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_OPTION), "unknown option"},

@@ -276,6 +279,8 @@ static const ERR_STRING_DATA EVP_str_rea

     "wrap mode not allowed"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_WRONG_FINAL_BLOCK_LENGTH),

     "wrong final block length"},

+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_XTS_DATA_UNIT_IS_TOO_LARGE),

+    "xts data unit is too large"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_XTS_DUPLICATED_KEYS),

     "xts duplicated keys"},

     {0, NULL}

diff -up openssl-1.1.1j/crypto/evp/evp_lib.c.fips openssl-1.1.1j/crypto/evp/evp_lib.c

--- openssl-1.1.1j/crypto/evp/evp_lib.c.fips    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/evp_lib.c 2021-03-03 12:57:42.198734517 +0100

@@ -192,6 +192,9 @@ int EVP_CIPHER_impl_ctx_size(const EVP_C

 int EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

                const unsigned char *in, unsigned int inl)

 {

+#ifdef OPENSSL_FIPS

+    FIPS_selftest_check();

+#endif

     return ctx->cipher->do_cipher(ctx, out, in, inl);

 }

diff -up openssl-1.1.1j/crypto/evp/m_sha1.c.fips openssl-1.1.1j/crypto/evp/m_sha1.c

--- openssl-1.1.1j/crypto/evp/m_sha1.c.fips 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/m_sha1.c  2021-03-03 12:57:42.198734517 +0100

@@ -95,7 +95,7 @@ static const EVP_MD sha1_md = {

     NID_sha1,

     NID_sha1WithRSAEncryption,

     SHA_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init,

     update,

     final,

@@ -145,7 +145,7 @@ static const EVP_MD sha224_md = {

     NID_sha224,

     NID_sha224WithRSAEncryption,

     SHA224_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init224,

     update224,

     final224,

@@ -164,7 +164,7 @@ static const EVP_MD sha256_md = {

     NID_sha256,

     NID_sha256WithRSAEncryption,

     SHA256_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init256,

     update256,

     final256,

@@ -224,7 +224,7 @@ static const EVP_MD sha512_224_md = {

     NID_sha512_224,

     NID_sha512_224WithRSAEncryption,

     SHA224_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init512_224,

     update512,

     final512,

@@ -243,7 +243,7 @@ static const EVP_MD sha512_256_md = {

     NID_sha512_256,

     NID_sha512_256WithRSAEncryption,

     SHA256_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init512_256,

     update512,

     final512,

@@ -262,7 +262,7 @@ static const EVP_MD sha384_md = {

     NID_sha384,

     NID_sha384WithRSAEncryption,

     SHA384_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init384,

     update384,

     final384,

@@ -281,7 +281,7 @@ static const EVP_MD sha512_md = {

     NID_sha512,

     NID_sha512WithRSAEncryption,

     SHA512_DIGEST_LENGTH,

-    EVP_MD_FLAG_DIGALGID_ABSENT,

+    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,

     init512,

     update512,

     final512,

diff -up openssl-1.1.1j/crypto/evp/m_sha3.c.fips openssl-1.1.1j/crypto/evp/m_sha3.c

--- openssl-1.1.1j/crypto/evp/m_sha3.c.fips 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/m_sha3.c  2021-03-03 12:57:42.198734517 +0100

@@ -295,7 +295,7 @@ const EVP_MD *EVP_sha3_##bitlen(void)

         NID_sha3_##bitlen,                           \

         NID_RSA_SHA3_##bitlen,                       \

         bitlen / 8,                                  \

-        EVP_MD_FLAG_DIGALGID_ABSENT,                 \

+        EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS, \

         s390x_sha3_init,                             \

         s390x_sha3_update,                           \

         s390x_sha3_final,                            \

@@ -308,7 +308,7 @@ const EVP_MD *EVP_sha3_##bitlen(void)

         NID_sha3_##bitlen,                           \

         NID_RSA_SHA3_##bitlen,                       \

         bitlen / 8,                                  \

-        EVP_MD_FLAG_DIGALGID_ABSENT,                 \

+        EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS, \

         sha3_init,                                   \

         sha3_update,                                 \

         sha3_final,                                  \

@@ -329,7 +329,7 @@ const EVP_MD *EVP_shake##bitlen(void)

         NID_shake##bitlen,                           \

         0,                                           \

         bitlen / 8,                                  \

-        EVP_MD_FLAG_XOF,                             \

+        EVP_MD_FLAG_XOF | EVP_MD_FLAG_FIPS,          \

         s390x_shake_init,                            \

         s390x_sha3_update,                           \

         s390x_shake_final,                           \

@@ -343,7 +343,7 @@ const EVP_MD *EVP_shake##bitlen(void)

         NID_shake##bitlen,                           \

         0,                                           \

         bitlen / 8,                                  \

-        EVP_MD_FLAG_XOF,                             \

+        EVP_MD_FLAG_XOF | EVP_MD_FLAG_FIPS,          \

         shake_init,                                  \

         sha3_update,                                 \

         sha3_final,                                  \

@@ -367,7 +367,7 @@ const EVP_MD *EVP_sha3_##bitlen(void)

         NID_sha3_##bitlen,                      \

         NID_RSA_SHA3_##bitlen,                  \

         bitlen / 8,                             \

-        EVP_MD_FLAG_DIGALGID_ABSENT,            \

+        EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS, \

         sha3_init,                              \

         sha3_update,                            \

         sha3_final,                             \

@@ -386,7 +386,7 @@ const EVP_MD *EVP_shake##bitlen(void)

         NID_shake##bitlen,                      \

         0,                                      \

         bitlen / 8,                             \

-        EVP_MD_FLAG_XOF,                        \

+        EVP_MD_FLAG_XOF | EVP_MD_FLAG_FIPS,     \

         shake_init,                             \

         sha3_update,                            \

         sha3_final,                             \

diff -up openssl-1.1.1j/crypto/evp/pmeth_lib.c.fips openssl-1.1.1j/crypto/evp/pmeth_lib.c

--- openssl-1.1.1j/crypto/evp/pmeth_lib.c.fips  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/pmeth_lib.c   2021-03-03 12:57:42.198734517 +0100

@@ -131,7 +131,15 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKE

         pmeth = ENGINE_get_pkey_meth(e, id);

     else

 #endif

+    {

         pmeth = EVP_PKEY_meth_find(id);

+#ifdef OPENSSL_FIPS

+        if (pmeth && !(pmeth->flags & EVP_PKEY_FLAG_FIPS) && FIPS_mode()) {

+            EVPerr(EVP_F_INT_CTX_NEW, EVP_R_DISABLED_FOR_FIPS);

+            return NULL;

+        }

+#endif

+    }

     if (pmeth == NULL) {

 #ifndef OPENSSL_NO_ENGINE

diff -up openssl-1.1.1j/crypto/fips/build.info.fips openssl-1.1.1j/crypto/fips/build.info

--- openssl-1.1.1j/crypto/fips/build.info.fips  2021-03-03 12:57:42.198734517 +0100

+++ openssl-1.1.1j/crypto/fips/build.info   2021-03-03 12:57:42.198734517 +0100

@@ -0,0 +1,15 @@

+LIBS=../../libcrypto

+SOURCE[../../libcrypto]=\

+        fips_aes_selftest.c fips_des_selftest.c fips_hmac_selftest.c \

+        fips_rsa_selftest.c fips_sha_selftest.c fips.c fips_dsa_selftest.c \

+        fips_post.c fips_drbg_ctr.c fips_drbg_hash.c fips_drbg_hmac.c \

+        fips_drbg_lib.c fips_drbg_rand.c fips_drbg_selftest.c fips_rand_lib.c \

+        fips_cmac_selftest.c fips_ecdh_selftest.c fips_ecdsa_selftest.c \

+        fips_dh_selftest.c fips_ers.c

+

+PROGRAMS_NO_INST=\

+          fips_standalone_hmac

+

+SOURCE[fips_standalone_hmac]=fips_standalone_hmac.c

+INCLUDE[fips_standalone_hmac]=../../include

+DEPEND[fips_standalone_hmac]=../../libcrypto

diff -up openssl-1.1.1j/crypto/fips/fips_aes_selftest.c.fips openssl-1.1.1j/crypto/fips/fips_aes_selftest.c

--- openssl-1.1.1j/crypto/fips/fips_aes_selftest.c.fips 2021-03-03 12:57:42.198734517 +0100

+++ openssl-1.1.1j/crypto/fips/fips_aes_selftest.c  2021-03-03 12:57:42.198734517 +0100

@@ -0,0 +1,372 @@

+/* ====================================================================

+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer. 

+ *

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in

+ *    the documentation and/or other materials provided with the

+ *    distribution.

+ *

+ * 3. All advertising materials mentioning features or use of this

+ *    software must display the following acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"