From f4e3ec3dbe3b8e04a058d266adf8e048bab563f2 Mon Sep 17 00:00:00 2001 From: Mauri de Souza Meneguzzo Date: Wed, 18 Dec 2024 16:19:24 +0000 Subject: [PATCH] crypto/ecdsa: fix condition for fips140=only check Fixes #70894 Change-Id: I78c9f2e46006ffc5f1d2886218f8aaaf3f1b59eb GitHub-Last-Rev: 11f0b452f57aacc40139eab557a8bed1386ad07b GitHub-Pull-Request: golang/go#70904 Reviewed-on: https://go-review.googlesource.com/c/go/+/637455 Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Carlos Amedee Reviewed-by: David Chase --- src/crypto/ecdsa/ecdsa.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/crypto/ecdsa/ecdsa.go b/src/crypto/ecdsa/ecdsa.go index 77727aaf96befb..0f9749975ffba9 100644 --- a/src/crypto/ecdsa/ecdsa.go +++ b/src/crypto/ecdsa/ecdsa.go @@ -183,7 +183,7 @@ func GenerateKey(c elliptic.Curve, rand io.Reader) (*PrivateKey, error) { } func generateFIPS[P ecdsa.Point[P]](curve elliptic.Curve, c *ecdsa.Curve[P], rand io.Reader) (*PrivateKey, error) { - if fips140only.Enabled && fips140only.ApprovedRandomReader(rand) { + if fips140only.Enabled && !fips140only.ApprovedRandomReader(rand) { return nil, errors.New("crypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140-only mode") } privateKey, err := ecdsa.GenerateKey(c, rand)