From 56511d480823bedafce604374fa3b15d3b3ffd6b Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Mon, 31 Jul 2023 09:41:28 +0200
Subject: [PATCH 26/48] 0058-FIPS-limit-rsa-encrypt.patch

Patch-name: 0058-FIPS-limit-rsa-encrypt.patch
Patch-id: 58
Patch-status: |
    # https://bugzilla.redhat.com/show_bug.cgi?id=2053289
From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd
---
 providers/common/securitycheck.c              |  1 +
 .../implementations/asymciphers/rsa_enc.c     | 35 +++++++++++
 .../30-test_evp_data/evppkey_rsa_common.txt   | 58 ++++++++++++++++++-
 test/recipes/80-test_cms.t                    |  5 +-
 test/recipes/80-test_ssl_old.t                | 27 +++++++--
 5 files changed, 118 insertions(+), 8 deletions(-)

diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c
index e534ad0a5f..c017c658e5 100644
--- a/providers/common/securitycheck.c
+++ b/providers/common/securitycheck.c
@@ -27,6 +27,7 @@
  * Set protect = 1 for encryption or signing operations, or 0 otherwise. See
  * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf.
  */
+/* Red Hat build implements some extra limitations in providers/implementations/asymciphers/rsa_enc.c */
 int ossl_rsa_check_key(OSSL_LIB_CTX *ctx, const RSA *rsa, int operation)
 {
     int protect = 0;
diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c
index d865968058..872967bcb3 100644
--- a/providers/implementations/asymciphers/rsa_enc.c
+++ b/providers/implementations/asymciphers/rsa_enc.c
@@ -132,6 +132,17 @@ static int rsa_decrypt_init(void *vprsactx, void *vrsa,
     return rsa_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECRYPT);
 }
 
+# ifdef FIPS_MODULE
+static int fips_padding_allowed(const PROV_RSA_CTX *prsactx)
+{
+    if (prsactx->pad_mode == RSA_PKCS1_PADDING || prsactx->pad_mode == RSA_NO_PADDING
+        || prsactx->pad_mode == RSA_PKCS1_WITH_TLS_PADDING)
+        return 0;
+
+    return 1;
+}
+# endif
+
 static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen,
                        size_t outsize, const unsigned char *in, size_t inlen)
 {
@@ -141,6 +152,18 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen,
     if (!ossl_prov_is_running())
         return 0;
 
+# ifdef FIPS_MODULE
+    if (fips_padding_allowed(prsactx) == 0) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
+        return 0;
+    }
+
+    if (RSA_bits(prsactx->rsa) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
+        return 0;
+    }
+# endif
+
     if (out == NULL) {
         size_t len = RSA_size(prsactx->rsa);
 
@@ -204,6 +227,18 @@ static int rsa_decrypt(void *vprsactx, unsigned char *out, size_t *outlen,
     if (!ossl_prov_is_running())
         return 0;
 
+# ifdef FIPS_MODULE
+    if (fips_padding_allowed(prsactx) == 0) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
+        return 0;
+    }
+
+    if (RSA_bits(prsactx->rsa) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
+        return 0;
+    }
+# endif
+
     if (prsactx->pad_mode == RSA_PKCS1_WITH_TLS_PADDING) {
         if (out == NULL) {
             *outlen = SSL_MAX_MASTER_KEY_LENGTH;
diff --git a/test/recipes/30-test_evp_data/evppkey_rsa_common.txt b/test/recipes/30-test_evp_data/evppkey_rsa_common.txt
index 8680797b90..95d5d51102 100644
--- a/test/recipes/30-test_evp_data/evppkey_rsa_common.txt
+++ b/test/recipes/30-test_evp_data/evppkey_rsa_common.txt
@@ -248,13 +248,13 @@ Input = 64b0e9f9892371110c40ba5739dc0974002aa6e6160b481447c6819947c2d3b537a6e377
 Output = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
 
 # RSA decrypt
-
+Availablein = default
 Decrypt = RSA-2048
 Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C701ABF2D4CC67003471A187900B05AA812BD25ED05C675DFC8C97A24A7BF49BD6214992CAD766D05A9A2B57B74F26A737E0237B8B76C45F1F226A836D7CFBC75BA999BDBE48DBC09227AA46C88F21DCCBA7840141AD5A5D71FD122E6BD6AC3E564780DFE623FC1CA9B995A6037BF0BBD43B205A84AC5444F34202C05CE9113087176432476576DE6FFFF9A52EA57C08BE3EC2F49676CB8E12F762AC71FA3C321E00AC988910C85FF52F93825666CE0D40FFAA0592078919D4493F46D95CCF76364C6D57760DD0B64805F9AFC76A2365A5575CA301D5103F0EA76CB9A78
 Output = "Hello World"
 
 # Corrupted ciphertext
-FIPSversion = <3.2.0
+Availablein = default
 Decrypt = RSA-2048
 Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C701ABF2D4CC67003471A187900B05AA812BD25ED05C675DFC8C97A24A7BF49BD6214992CAD766D05A9A2B57B74F26A737E0237B8B76C45F1F226A836D7CFBC75BA999BDBE48DBC09227AA46C88F21DCCBA7840141AD5A5D71FD122E6BD6AC3E564780DFE623FC1CA9B995A6037BF0BBD43B205A84AC5444F34202C05CE9113087176432476576DE6FFFF9A52EA57C08BE3EC2F49676CB8E12F762AC71FA3C321E00AC988910C85FF52F93825666CE0D40FFAA0592078919D4493F46D95CCF76364C6D57760DD0B64805F9AFC76A2365A5575CA301D5103F0EA76CB9A79
 Output = "Hello World"
@@ -619,36 +619,42 @@ vcDtKrdWo6btTWc1Kml9QhbpMhKxJ6Y9VBHOb6mNXb79cyY+NygUJ0OBgWbtfdY2
 h90qjKHS9PvY4Q==
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=354fe67b4a126d5d35fe36c777791a3f7ba13def484e2d3908aff722fad468fb21696de95d0be911c2d3174f8afcc201035f7b6d8e69402de5451618c21a535fa9d7bfc5b8dd9fc243f8cf927db31322d6e881eaa91a996170e657a05a266426d98c88003f8477c1227094a0d9fa1e8c4024309ce1ecccb5210035d47ac72e8a
 Output=6628194e12073db03ba94cda9ef9532397d50dba79b987004afefe34
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=640db1acc58e0568fe5407e5f9b701dff8c3c91e716c536fc7fcec6cb5b71c1165988d4a279e1577d730fc7a29932e3f00c81515236d8d8e31017a7a09df4352d904cdeb79aa583adcc31ea698a4c05283daba9089be5491f67c1a4ee48dc74bbbe6643aef846679b4cb395a352d5ed115912df696ffe0702932946d71492b44
 Output=750c4047f547e8e41411856523298ac9bae245efaf1397fbe56f9dd5
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=423736ed035f6026af276c35c0b3741b365e5f76ca091b4e8c29e2f0befee603595aa8322d602d2e625e95eb81b2f1c9724e822eca76db8618cf09c5343503a4360835b5903bc637e3879fb05e0ef32685d5aec5067cd7cc96fe4b2670b6eac3066b1fcf5686b68589aafb7d629b02d8f8625ca3833624d4800fb081b1cf94eb
 Output=d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c2451fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=45ead4ca551e662c9800f1aca8283b0525e6abae30be4b4aba762fa40fd3d38e22abefc69794f6ebbbc05ddbb11216247d2f412fd0fba87c6e3acd888813646fd0e48e785204f9c3f73d6d8239562722dddd8771fec48b83a31ee6f592c4cfd4bc88174f3b13a112aae3b9f7b80e0fc6f7255ba880dc7d8021e22ad6a85f0755
 Output=52e650d98e7f2a048b4f86852153b97e01dd316f346a19f67a85
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=36f6e34d94a8d34daacba33a2139d00ad85a9345a86051e73071620056b920e219005855a213a0f23897cdcd731b45257c777fe908202befdd0b58386b1244ea0cf539a05d5d10329da44e13030fd760dcd644cfef2094d1910d3f433e1c7c6dd18bc1f2df7f643d662fb9dd37ead9059190f4fa66ca39e869c4eb449cbdc439
 Output=8da89fd9e5f974a29feffb462b49180f6cf9e802
 
+Availablein = default
 Decrypt=RSA-OAEP-1
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -673,36 +679,42 @@ SwGNdhGLJDiac1Dsg2sAY6IXISNv2O222JtR5+64e2EbcTLLfqc1bCMVHB53UVB8
 eG2e4XlBcKjI6A==
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0181af8922b9fcb4d79d92ebe19815992fc0c1439d8bcd491398a0f4ad3a329a5bd9385560db532683c8b7da04e4b12aed6aacdf471c34c9cda891addcc2df3456653aa6382e9ae59b54455257eb099d562bbe10453f2b6d13c59c02e10f1f8abb5da0d0570932dacf2d0901db729d0fefcc054e70968ea540c81b04bcaefe720e
 Output=8ff00caa605c702830634d9a6c3d42c652b58cf1d92fec570beee7
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=018759ff1df63b2792410562314416a8aeaf2ac634b46f940ab82d64dbf165eee33011da749d4bab6e2fcd18129c9e49277d8453112b429a222a8471b070993998e758861c4d3f6d749d91c4290d332c7a4ab3f7ea35ff3a07d497c955ff0ffc95006b62c6d296810d9bfab024196c7934012c2df978ef299aba239940cba10245
 Output=2d
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=018802bab04c60325e81c4962311f2be7c2adce93041a00719c88f957575f2c79f1b7bc8ced115c706b311c08a2d986ca3b6a9336b147c29c6f229409ddec651bd1fdd5a0b7f610c9937fdb4a3a762364b8b3206b4ea485fd098d08f63d4aa8bb2697d027b750c32d7f74eaf5180d2e9b66b17cb2fa55523bc280da10d14be2053
 Output=74fc88c51bc90f77af9d5e9a4a70133d4b4e0b34da3c37c7ef8e
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=00a4578cbc176318a638fba7d01df15746af44d4f6cd96d7e7c495cbf425b09c649d32bf886da48fbaf989a2117187cafb1fb580317690e3ccd446920b7af82b31db5804d87d01514acbfa9156e782f867f6bed9449e0e9a2c09bcecc6aa087636965e34b3ec766f2fe2e43018a2fddeb140616a0e9d82e5331024ee0652fc7641
 Output=a7eb2a5036931d27d4e891326d99692ffadda9bf7efd3e34e622c4adc085f721dfe885072c78a203b151739be540fa8c153a10f00a
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=00ebc5f5fda77cfdad3c83641a9025e77d72d8a6fb33a810f5950f8d74c73e8d931e8634d86ab1246256ae07b6005b71b7f2fb98351218331ce69b8ffbdc9da08bbc9c704f876deb9df9fc2ec065cad87f9090b07acc17aa7f997b27aca48806e897f771d95141fe4526d8a5301b678627efab707fd40fbebd6e792a25613e7aec
 Output=2ef2b066f854c33f3bdcbb5994a435e73d6c6c
 
+Availablein = default
 Decrypt=RSA-OAEP-2
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -727,36 +739,42 @@ iUGx07dw5a0x7jc7KKzaaf+bb0D+V4ufGvuFg2+WJ9N6z/c8J3nmNLsmARwsj38z
 Ya4qnqZe1onjY5o=
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=026a0485d96aebd96b4382085099b962e6a2bdec3d90c8db625e14372de85e2d5b7baab65c8faf91bb5504fb495afce5c988b3f6a52e20e1d6cbd3566c5cd1f2b8318bb542cc0ea25c4aab9932afa20760eaddec784396a07ea0ef24d4e6f4d37e5052a7a31e146aa480a111bbe926401307e00f410033842b6d82fe5ce4dfae80
 Output=087820b569e8fa8d
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=024db89c7802989be0783847863084941bf209d761987e38f97cb5f6f1bc88da72a50b73ebaf11c879c4f95df37b850b8f65d7622e25b1b889e80fe80baca2069d6e0e1d829953fc459069de98ea9798b451e557e99abf8fe3d9ccf9096ebbf3e5255d3b4e1c6d2ecadf067a359eea86405acd47d5e165517ccafd47d6dbee4bf5
 Output=4653acaf171960b01f52a7be63a3ab21dc368ec43b50d82ec3781e04
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0239bce681032441528877d6d1c8bb28aa3bc97f1df584563618995797683844ca86664732f4bed7a0aab083aaabfb7238f582e30958c2024e44e57043b97950fd543da977c90cdde5337d618442f99e60d7783ab59ce6dd9d69c47ad1e962bec22d05895cff8d3f64ed5261d92b2678510393484990ba3f7f06818ae6ffce8a3a
 Output=d94cd0e08fa404ed89
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=02994c62afd76f498ba1fd2cf642857fca81f4373cb08f1cbaee6f025c3b512b42c3e8779113476648039dbe0493f9246292fac28950600e7c0f32edf9c81b9dec45c3bde0cc8d8847590169907b7dc5991ceb29bb0714d613d96df0f12ec5d8d3507c8ee7ae78dd83f216fa61de100363aca48a7e914ae9f42ddfbe943b09d9a0
 Output=6cc641b6b61e6f963974dad23a9013284ef1
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0162042ff6969592a6167031811a239834ce638abf54fec8b99478122afe2ee67f8c5b18b0339805bfdbc5a4e6720b37c59cfba942464c597ff532a119821545fd2e59b114e61daf71820529f5029cf524954327c34ec5e6f5ba7efcc4de943ab8ad4ed787b1454329f70db798a3a8f4d92f8274e2b2948ade627ce8ee33e43c60
 Output=df5151832b61f4f25891fb4172f328d2eddf8371ffcfdbe997939295f30eca6918017cfda1153bf7a6af87593223
 
+Availablein = default
 Decrypt=RSA-OAEP-3
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -781,36 +799,42 @@ s/XkIiO6MDAcQabYfLtw4wy308Z9JUc9sfbL8D4/kSbj6XloJ5qGWywrQmUkz8Uq
 aD0x7TDrmEvkEro=
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=04cce19614845e094152a3fe18e54e3330c44e5efbc64ae16886cb1869014cc5781b1f8f9e045384d0112a135ca0d12e9c88a8e4063416deaae3844f60d6e96fe155145f4525b9a34431ca3766180f70e15a5e5d8e8b1a516ff870609f13f896935ced188279a58ed13d07114277d75c6568607e0ab092fd803a223e4a8ee0b1a8
 Output=4a86609534ee434a6cbca3f7e962e76d455e3264c19f605f6e5ff6137c65c56d7fb344cd52bc93374f3d166c9f0c6f9c506bad19330972d2
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0097b698c6165645b303486fbf5a2a4479c0ee85889b541a6f0b858d6b6597b13b854eb4f839af03399a80d79bda6578c841f90d645715b280d37143992dd186c80b949b775cae97370e4ec97443136c6da484e970ffdb1323a20847821d3b18381de13bb49aaea66530c4a4b8271f3eae172cd366e07e6636f1019d2a28aed15e
 Output=b0adc4f3fe11da59ce992773d9059943c03046497ee9d9f9a06df1166db46d98f58d27ec074c02eee6cbe2449c8b9fc5080c5c3f4433092512ec46aa793743c8
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0301f935e9c47abcb48acbbe09895d9f5971af14839da4ff95417ee453d1fd77319072bb7297e1b55d7561cd9d1bb24c1a9a37c619864308242804879d86ebd001dce5183975e1506989b70e5a83434154d5cbfd6a24787e60eb0c658d2ac193302d1192c6e622d4a12ad4b53923bca246df31c6395e37702c6a78ae081fb9d065
 Output=bf6d42e701707b1d0206b0c8b45a1c72641ff12889219a82bdea965b5e79a96b0d0163ed9d578ec9ada20f2fbcf1ea3c4089d83419ba81b0c60f3606da99
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=02d110ad30afb727beb691dd0cf17d0af1a1e7fa0cc040ec1a4ba26a42c59d0a796a2e22c8f357ccc98b6519aceb682e945e62cb734614a529407cd452bee3e44fece8423cc19e55548b8b994b849c7ecde4933e76037e1d0ce44275b08710c68e430130b929730ed77e09b015642c5593f04e4ffb9410798102a8e96ffdfe11e4
 Output=fb2ef112f5e766eb94019297934794f7be2f6fc1c58e
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=00dbb8a7439d90efd919a377c54fae8fe11ec58c3b858362e23ad1b8a44310799066b99347aa525691d2adc58d9b06e34f288c170390c5f0e11c0aa3645959f18ee79e8f2be8d7ac5c23d061f18dd74b8c5f2a58fcb5eb0c54f99f01a83247568292536583340948d7a8c97c4acd1e98d1e29dc320e97a260532a8aa7a758a1ec2
 Output=28ccd447bb9e85166dabb9e5b7d1adadc4b9d39f204e96d5e440ce9ad928bc1c2284
 
+Availablein = default
 Decrypt=RSA-OAEP-4
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -835,36 +859,42 @@ OPlAQGLrhaQpJFILOPW7iGoBlvSLuNzqYP2SzAJ/GOeBWKNKXF1fhgoPbAQHGn0B
 MSwGUGLx60i3nRyDyw==
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=036046a4a47d9ed3ba9a89139c105038eb7492b05a5d68bfd53accff4597f7a68651b47b4a4627d927e485eed7b4566420e8b409879e5d606eae251d22a5df799f7920bfc117b992572a53b1263146bcea03385cc5e853c9a101c8c3e1bda31a519807496c6cb5e5efb408823a352b8fa0661fb664efadd593deb99fff5ed000e5
 Output=af71a901e3a61d3132f0fc1fdb474f9ea6579257ffc24d164170145b3dbde8
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=03d6eb654edce615bc59f455265ed4e5a18223cbb9be4e4069b473804d5de96f54dcaaa603d049c5d94aa1470dfcd2254066b7c7b61ff1f6f6770e3215c51399fd4e34ec5082bc48f089840ad04354ae66dc0f1bd18e461a33cc1258b443a2837a6df26759aa2302334986f87380c9cc9d53be9f99605d2c9a97da7b0915a4a7ad
 Output=a3b844a08239a8ac41605af17a6cfda4d350136585903a417a79268760519a4b4ac3303ec73f0f87cfb32399
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0770952181649f9f9f07ff626ff3a22c35c462443d905d456a9fd0bff43cac2ca7a9f554e9478b9acc3ac838b02040ffd3e1847de2e4253929f9dd9ee4044325a9b05cabb808b2ee840d34e15d105a3f1f7b27695a1a07a2d73fe08ecaaa3c9c9d4d5a89ff890d54727d7ae40c0ec1a8dd86165d8ee2c6368141016a48b55b6967
 Output=308b0ecbd2c76cb77fc6f70c5edd233fd2f20929d629f026953bb62a8f4a3a314bde195de85b5f816da2aab074d26cb6acddf323ae3b9c678ac3cf12fbdde7
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0812b76768ebcb642d040258e5f4441a018521bd96687e6c5e899fcd6c17588ff59a82cc8ae03a4b45b31299af1788c329f7dcd285f8cf4ced82606b97612671a45bedca133442144d1617d114f802857f0f9d739751c57a3f9ee400912c61e2e6992be031a43dd48fa6ba14eef7c422b5edc4e7afa04fdd38f402d1c8bb719abf
 Output=15c5b9ee1185
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=07b60e14ec954bfd29e60d0047e789f51d57186c63589903306793ced3f68241c743529aba6a6374f92e19e0163efa33697e196f7661dfaaa47aac6bde5e51deb507c72c589a2ca1693d96b1460381249b2cdb9eac44769f2489c5d3d2f99f0ee3c7ee5bf64a5ac79c42bd433f149be8cb59548361640595513c97af7bc2509723
 Output=21026e6800c7fa728fcaaba0d196ae28d7a2ac4ffd8abce794f0985f60c8a6737277365d3fea11db8923a2029a
 
+Availablein = default
 Decrypt=RSA-OAEP-5
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -889,36 +919,42 @@ xT1F29tenZbQ/s9Cdd8JdLxKBza0p0wyaQU++2hqziQG4iyeBY3bSuVAYnri/bCC
 Yejn5Ly8mU2q+jBcRQ==
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0630eebcd2856c24f798806e41f9e67345eda9ceda386acc9facaea1eeed06ace583709718d9d169fadf414d5c76f92996833ef305b75b1e4b95f662a20faedc3bae0c4827a8bf8a88edbd57ec203a27a841f02e43a615bab1a8cac0701de34debdef62a088089b55ec36ea7522fd3ec8d06b6a073e6df833153bc0aefd93bd1a3
 Output=4046ca8baa3347ca27f49e0d81f9cc1d71be9ba517d4
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0ebc37376173a4fd2f89cc55c2ca62b26b11d51c3c7ce49e8845f74e7607317c436bc8d23b9667dfeb9d087234b47bc6837175ae5c0559f6b81d7d22416d3e50f4ac533d8f0812f2db9e791fe9c775ac8b6ad0f535ad9ceb23a4a02014c58ab3f8d3161499a260f39348e714ae2a1d3443208fd8b722ccfdfb393e98011f99e63f
 Output=5cc72c60231df03b3d40f9b57931bc31109f972527f28b19e7480c7288cb3c92b22512214e4be6c914792ddabdf57faa8aa7
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0a98bf1093619394436cf68d8f38e2f158fde8ea54f3435f239b8d06b8321844202476aeed96009492480ce3a8d705498c4c8c68f01501dc81db608f60087350c8c3b0bd2e9ef6a81458b7c801b89f2e4fe99d4900ba6a4b5e5a96d865dc676c7755928794130d6280a8160a190f2df3ea7cf9aa0271d88e9e6905ecf1c5152d65
 Output=b20e651303092f4bccb43070c0f86d23049362ed96642fc5632c27db4a52e3d831f2ab068b23b149879c002f6bf3feee97591112562c
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=008e7a67cacfb5c4e24bec7dee149117f19598ce8c45808fef88c608ff9cd6e695263b9a3c0ad4b8ba4c95238e96a8422b8535629c8d5382374479ad13fa39974b242f9a759eeaf9c83ad5a8ca18940a0162ba755876df263f4bd50c6525c56090267c1f0e09ce0899a0cf359e88120abd9bf893445b3cae77d3607359ae9a52f8
 Output=684e3038c5c041f7
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=00003474416c7b68bdf961c385737944d7f1f40cb395343c693cc0b4fe63b31fedf1eaeeac9ccc0678b31dc32e0977489514c4f09085f6298a9653f01aea4045ff582ee887be26ae575b73eef7f3774921e375a3d19adda0ca31aa1849887c1f42cac9677f7a2f4e923f6e5a868b38c084ef187594dc9f7f048fea2e02955384ab
 Output=32488cb262d041d6e4dd35f987bf3ca696db1f06ac29a44693
 
+Availablein = default
 Decrypt=RSA-OAEP-6
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -943,36 +979,42 @@ tu4XIedy0DiaVZw9PN+VUNRXxGsDe3RkGx1SFmr4ohPIOWIGzfukQi8Y1vYdvLXS
 FMlxv0gq65dqc3DC
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=1688e4ce7794bba6cb7014169ecd559cede2a30b56a52b68d9fe18cf1973ef97b2a03153951c755f6294aa49adbdb55845ab6875fb3986c93ecf927962840d282f9e54ce8b690f7c0cb8bbd73440d9571d1b16cd9260f9eab4783cc482e5223dc60973871783ec27b0ae0fd47732cbc286a173fc92b00fb4ba6824647cd93c85c1
 Output=47aae909
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=1052ed397b2e01e1d0ee1c50bf24363f95e504f4a03434a08fd822574ed6b9736edbb5f390db10321479a8a139350e2bd4977c3778ef331f3e78ae118b268451f20a2f01d471f5d53c566937171b2dbc2d4bde459a5799f0372d6574239b2323d245d0bb81c286b63c89a361017337e4902f88a467f4c7f244bfd5ab46437ff3b6
 Output=1d9b2e2223d9bc13bfb9f162ce735db48ba7c68f6822a0a1a7b6ae165834e7
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=2155cd843ff24a4ee8badb7694260028a490813ba8b369a4cbf106ec148e5298707f5965be7d101c1049ea8584c24cd63455ad9c104d686282d3fb803a4c11c1c2e9b91c7178801d1b6640f003f5728df007b8a4ccc92bce05e41a27278d7c85018c52414313a5077789001d4f01910b72aad05d220aa14a58733a7489bc54556b
 Output=d976fc
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=0ab14c373aeb7d4328d0aaad8c094d88b9eb098b95f21054a29082522be7c27a312878b637917e3d819e6c3c568db5d843802b06d51d9e98a2be0bf40c031423b00edfbff8320efb9171bd2044653a4cb9c5122f6c65e83cda2ec3c126027a9c1a56ba874d0fea23f380b82cf240b8cf540004758c4c77d934157a74f3fc12bfac
 Output=d4738623df223aa43843df8467534c41d013e0c803c624e263666b239bde40a5f29aeb8de79e3daa61dd0370f49bd4b013834b98212aef6b1c5ee373b3cb
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=028387a318277434798b4d97f460068df5298faba5041ba11761a1cb7316b24184114ec500257e2589ed3b607a1ebbe97a6cc2e02bf1b681f42312a33b7a77d8e7855c4a6de03e3c04643f786b91a264a0d6805e2cea91e68177eb7a64d9255e4f27e713b7ccec00dc200ebd21c2ea2bb890feae4942df941dc3f97890ed347478
 Output=bb47231ca5ea1d3ad46c99345d9a8a61
 
+Availablein = default
 Decrypt=RSA-OAEP-7
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -997,36 +1039,42 @@ njraT2MgdSwJ2AX/fR8a4NAXru7pzvoNfdf/d15EtXgyL2QF1iEdoZUZZmqof9xM
 2MiPa249Z+lh3Luj0A==
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=09b3683d8a2eb0fb295b62ed1fb9290b714457b7825319f4647872af889b30409472020ad12912bf19b11d4819f49614824ffd84d09c0a17e7d17309d12919790410aa2995699f6a86dbe3242b5acc23af45691080d6b1ae810fb3e3057087f0970092ce00be9562ff4053b6262ce0caa93e13723d2e3a5ba075d45f0d61b54b61
 Output=050b755e5e6880f7b9e9d692a74c37aae449b31bfea6deff83747a897f6c2c825bb1adbf850a3c96994b5de5b33cbc7d4a17913a7967
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=2ecf15c97c5a15b1476ae986b371b57a24284f4a162a8d0c8182e7905e792256f1812ba5f83f1f7a130e42dcc02232844edc14a31a68ee97ae564a383a3411656424c5f62ddb646093c367be1fcda426cf00a06d8acb7e57776fbbd855ac3df506fc16b1d7c3f2110f3d8068e91e186363831c8409680d8da9ecd8cf1fa20ee39d
 Output=4eb68dcd93ca9b19df111bd43608f557026fe4aa1d5cfac227a3eb5ab9548c18a06dded23f81825986b2fcd71109ecef7eff88873f075c2aa0c469f69c92bc
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=4bc89130a5b2dabb7c2fcf90eb5d0eaf9e681b7146a38f3173a3d9cfec52ea9e0a41932e648a9d69344c50da763f51a03c95762131e8052254dcd2248cba40fd31667786ce05a2b7b531ac9dac9ed584a59b677c1a8aed8c5d15d68c05569e2be780bf7db638fd2bfd2a85ab276860f3777338fca989ffd743d13ee08e0ca9893f
 Output=8604ac56328c1ab5ad917861
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=2e456847d8fc36ff0147d6993594b9397227d577752c79d0f904fcb039d4d812fea605a7b574dd82ca786f93752348438ee9f5b5454985d5f0e1699e3e7ad175a32e15f03deb042ab9fe1dd9db1bb86f8c089ccb45e7ef0c5ee7ca9b7290ca6b15bed47039788a8a93ff83e0e8d6244c71006362deef69b6f416fb3c684383fbd0
 Output=fdda5fbf6ec361a9d9a4ac68af216a0686f438b1e0e5c36b955f74e107f39c0dddcc
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=1fb9356fd5c4b1796db2ebf7d0d393cc810adf6145defc2fce714f79d93800d5e2ac211ea8bbecca4b654b94c3b18b30dd576ce34dc95436ef57a09415645923359a5d7b4171ef22c24670f1b229d3603e91f76671b7df97e7317c97734476d5f3d17d21cf82b5ba9f83df2e588d36984fd1b584468bd23b2e875f32f68953f7b2
 Output=4a5f4914bee25de3c69341de07
 
+Availablein = default
 Decrypt=RSA-OAEP-8
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
@@ -1057,36 +1105,42 @@ Z7CDuaemy2HkLbNiuMmJbbcGTgKtWuYVh9oVtGSckFlJCf6zfby2VL63Jo7IAeWo
 tKo5Eb69iFQvBb4=
 -----END PRIVATE KEY-----
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=267bcd118acab1fc8ba81c85d73003cb8610fa55c1d97da8d48a7c7f06896a4db751aa284255b9d36ad65f37653d829f1b37f97b8001942545b2fc2c55a7376ca7a1be4b1760c8e05a33e5aa2526b8d98e317088e7834c755b2a59b12631a182c05d5d43ab1779264f8456f515ce57dfdf512d5493dab7b7338dc4b7d78db9c091ac3baf537a69fc7f549d979f0eff9a94fda4169bd4d1d19a69c99e33c3b55490d501b39b1edae118ff6793a153261584d3a5f39f6e682e3d17c8cd1261fa72
 Output=f735fd55ba92592c3b52b8f9c4f69aaa1cbef8fe88add095595412467f9cf4ec0b896c59eda16210e7549c8abb10cdbc21a12ec9b6b5b8fd2f10399eb6
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=93ac9f0671ec29acbb444effc1a5741351d60fdb0e393fbf754acf0de49761a14841df7772e9bc82773966a1584c4d72baea00118f83f35cca6e537cbd4d811f5583b29783d8a6d94cd31be70d6f526c10ff09c6fa7ce069795a3fcd0511fd5fcb564bcc80ea9c78f38b80012539d8a4ddf6fe81e9cddb7f50dbbbbcc7e5d86097ccf4ec49189fb8bf318be6d5a0715d516b49af191258cd32dc833ce6eb4673c03a19bbace88cc54895f636cc0c1ec89096d11ce235a265ca1764232a689ae8
 Output=81b906605015a63aabe42ddf11e1978912f5404c7474b26dce3ed482bf961ecc818bf420c54659
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=81ebdd95054b0c822ef9ad7693f5a87adfb4b4c4ce70df2df84ed49c04da58ba5fc20a19e1a6e8b7a3900b22796dc4e869ee6b42792d15a8eceb56c09c69914e813cea8f6931e4b8ed6f421af298d595c97f4789c7caa612c7ef360984c21b93edc5401068b5af4c78a8771b984d53b8ea8adf2f6a7d4a0ba76c75e1dd9f658f20ded4a46071d46d7791b56803d8fea7f0b0f8e41ae3f09383a6f9585fe7753eaaffd2bf94563108beecc207bbb535f5fcc705f0dde9f708c62f49a9c90371d3
 Output=fd326429df9b890e09b54b18b8f34f1e24
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=bcc35f94cde66cb1136625d625b94432a35b22f3d2fa11a613ff0fca5bd57f87b902ccdc1cd0aebcb0715ee869d1d1fe395f6793003f5eca465059c88660d446ff5f0818552022557e38c08a67ead991262254f10682975ec56397768537f4977af6d5f6aaceb7fb25dec5937230231fd8978af49119a29f29e424ab8272b47562792d5c94f774b8829d0b0d9f1a8c9eddf37574d5fa248eefa9c5271fc5ec2579c81bdd61b410fa61fe36e424221c113addb275664c801d34ca8c6351e4a858
 Output=f1459b5f0c92f01a0f723a2e5662484d8f8c0a20fc29dad6acd43bb5f3effdf4e1b63e07fdfe6628d0d74ca19bf2d69e4a0abf86d293925a796772f8088e
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 Input=232afbc927fa08c2f6a27b87d4a5cb09c07dc26fae73d73a90558839f4fd66d281b87ec734bce237ba166698ed829106a7de6942cd6cdce78fed8d2e4d81428e66490d036264cef92af941d3e35055fe3981e14d29cbb9a4f67473063baec79a1179f5a17c9c1832f2838fd7d5e59bb9659d56dce8a019edef1bb3accc697cc6cc7a778f60a064c7f6f5d529c6210262e003de583e81e3167b89971fb8c0e15d44fffef89b53d8d64dd797d159b56d2b08ea5307ea12c241bd58d4ee278a1f2e
 Output=53e6e8c729d6f9c319dd317e74b0db8e4ccca25f3c8305746e137ac63a63ef3739e7b595abb96e8d55e54f7bd41ab433378ffb911d
 
+Availablein = default
 Decrypt=RSA-OAEP-9
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
index cbec426137..9ba7fbeed2 100644
--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
@@ -233,7 +233,7 @@ my @smime_pkcs7_tests = (
       \&final_compare
     ],
 
-    [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients",
+    [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients, no Red Hat FIPS",
       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
         "-aes256", "-stream", "-out", "{output}.cms",
         $smrsa1,
@@ -1022,6 +1022,9 @@ sub check_availability {
     return "$tnam: skipped, DSA disabled\n"
         if ($no_dsa && $tnam =~ / DSA/);
 
+    return "$tnam: skipped, Red Hat FIPS\n"
+        if ($tnam =~ /no Red Hat FIPS/);
+
     return "";
 }
 
diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t
index e2dcb68fb5..0775112b40 100644
--- a/test/recipes/80-test_ssl_old.t
+++ b/test/recipes/80-test_ssl_old.t
@@ -493,6 +493,18 @@ sub testssl {
             # the default choice if TLSv1.3 enabled
             my $flag = $protocol eq "-tls1_3" ? "" : $protocol;
             my $ciphersuites = "";
+            my %redhat_skip_cipher = map {$_ => 1} qw(
+AES256-GCM-SHA384:@SECLEVEL=0
+AES256-CCM8:@SECLEVEL=0
+AES256-CCM:@SECLEVEL=0
+AES128-GCM-SHA256:@SECLEVEL=0
+AES128-CCM8:@SECLEVEL=0
+AES128-CCM:@SECLEVEL=0
+AES256-SHA256:@SECLEVEL=0
+AES128-SHA256:@SECLEVEL=0
+AES256-SHA:@SECLEVEL=0
+AES128-SHA:@SECLEVEL=0
+	    );
             foreach my $cipher (@{$ciphersuites{$protocol}}) {
                 if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) {
                     note "*****SKIPPING $protocol $cipher";
@@ -504,11 +516,16 @@ sub testssl {
                     } else {
                         $cipher = $cipher.':@SECLEVEL=0';
                     }
-                    ok(run(test([@ssltest, @exkeys, "-cipher",
-                                 $cipher,
-                                 "-ciphersuites", $ciphersuites,
-                                 $flag || ()])),
-                       "Testing $cipher");
+                    if ($provider eq "fips" && exists $redhat_skip_cipher{$cipher}) {
+                        note "*****SKIPPING $cipher in Red Hat FIPS mode";
+                        ok(1);
+                    } else {
+                        ok(run(test([@ssltest, @exkeys, "-cipher",
+                                     $cipher,
+                                     "-ciphersuites", $ciphersuites,
+                                     $flag || ()])),
+                           "Testing $cipher");
+                    }
                 }
             }
             next if $protocol eq "-tls1_3";
-- 
2.41.0