crypto/ecdsa: fix condition for fips140=only check

Fixes golang#70894 Change-Id: I78c9f2e46006ffc5f1d2886218f8aaaf3f1b59eb GitHub-Last-Rev: 11f0b45 GitHub-Pull-Request: golang#70904 Reviewed-on: https://go-review.googlesource.com/c/go/+/637455 Reviewed-by: Filippo Valsorda <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Carlos Amedee <[email protected]> Reviewed-by: David Chase <[email protected]>
starius · Dec 18, 2024 · f4e3ec3 · f4e3ec3
1 parent 6aa46eb
commit f4e3ec3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/crypto/ecdsa/ecdsa.go b/src/crypto/ecdsa/ecdsa.go
@@ -183,7 +183,7 @@ func GenerateKey(c elliptic.Curve, rand io.Reader) (*PrivateKey, error) {
 }
 
 func generateFIPS[P ecdsa.Point[P]](curve elliptic.Curve, c *ecdsa.Curve[P], rand io.Reader) (*PrivateKey, error) {
-	if fips140only.Enabled && fips140only.ApprovedRandomReader(rand) {
+	if fips140only.Enabled && !fips140only.ApprovedRandomReader(rand) {
 		return nil, errors.New("crypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
 	}
 	privateKey, err := ecdsa.GenerateKey(c, rand)