Add PWCT for RSA and ECDSA for FIPS 140-2.
Since only the consumers knows whether an EC key will be used for
ECDSA or ECDHE, it is part of the FIPS policy for the consumer to
check the validity of the generated key before signing with it.
Change-Id: Ie250f655c8fcb6a59cc7210def1e87eb958e9349
Reviewed-on: https://boringssl-review.googlesource.com/14745
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/include/openssl/ec_key.h b/include/openssl/ec_key.h
index 1dbae62..cb7ef10 100644
--- a/include/openssl/ec_key.h
+++ b/include/openssl/ec_key.h
@@ -159,6 +159,10 @@
* about the problem can be found on the error stack. */
OPENSSL_EXPORT int EC_KEY_check_key(const EC_KEY *key);
+/* EC_KEY_check_fips performs a signing pairwise consistency test (FIPS 140-2
+ * 4.9.2). It returns one if it passes and zero otherwise. */
+OPENSSL_EXPORT int EC_KEY_check_fips(const EC_KEY *key);
+
/* EC_KEY_set_public_key_affine_coordinates sets the public key in |key| to
* (|x|, |y|). It returns one on success and zero otherwise. */
OPENSSL_EXPORT int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key,
