Bug 2175145

Description of problem:
SP 800-132 and FIPS 140-3 IG D.N define 4 checks that need to be performed by the module when performing PBKDF key derivation.

These checks are implemented in OpenSSL 3, but they can be bypassed by setting the "pkcs5" parameter (see https://www.openssl.org/docs/man3.0/man7/EVP_KDF-PBKDF2.html) to 1. When this parameter is set, the module must return a non-approved service indicator. Alternatively, this parameter could be ignored (i.e. always perform the checks). Note that ignoring the parameter and always running the checks will require adjusting the tests, since some of them fail.

Additionally, the OpenSSL 3 PBKDF2 self-test uses a 5 byte salt length, which is below the minimum of 16 bytes required by SP 800-132 section 5.1.


Version-Release number of selected component (if applicable):
openssl-3.0.1-46.el9_0

How reproducible:
Run the attached reproducer with the last parameter set to 1, and see that it will support a lower limit than required.

Steps to Reproduce:
1. Approved as expected:
$(head -1 kdf2.c | sed -E 's#^// ##g') && ./kdf2 PBKDF2 SHA256 HMAC 16 0 8 14 0
ERR Failed to duplicate EVP_KDF_CTX, this may be unsupported by your version of OpenSSL; using original context
OK (indicator: not implemented in provider): 0x57c04624699b881c8ec4e80f7
2. Lowering any of salt length, password length, or output key length fails the call:
$(head -1 kdf2.c | sed -E 's#^// ##g') && ./kdf2 PBKDF2 SHA256 HMAC 15 0 7 13 0
ERR Failed to set EVP_KDF_CTX parameters: error:1C800069:Provider routines::invalid key length (in function kdf_pbkdf2_set_ctx_params in providers/implementations/kdfs/pbkdf2.c:207):
ERR Failed to set EVP_KDF_CTX parameters: error:1C800070:Provider routines::invalid salt length (in function kdf_pbkdf2_set_ctx_params in providers/implementations/kdfs/pbkdf2.c:217):
ERR Failed to derive key: error:1C8000AB:Provider routines::key size too small (in function pbkdf2_derive in providers/implementations/kdfs/pbkdf2.c:326):
3. Running the same command with the pkcs5 parameter set to 1 passes:
$(head -1 kdf2.c | sed -E 's#^// ##g') && ./kdf2 PBKDF2 SHA256 HMAC 15 0 7 13 1
ERR Failed to duplicate EVP_KDF_CTX, this may be unsupported by your version of OpenSSL; using original context
OK (indicator: not implemented in provider): 0x712fad9de3f4c1ee726ca5932

Actual results:
Setting the pkcs5 parameter to 1 allows behavior that is not valid in FIPS mode.

Expected results:
Either setting the pkcs5 parameter to 1 causes an explicit indicator to show that the call was unapproved, or disabling the lower bounds checks is not possible in FIPS mode.