mlkem_crypto: Fix fallback to default provider in FIPS

Pavol Žáčikrequested to merge
pzacik/libssh-mirror:mlkem-fips-fix into master

See commit message for details. This was not uncovered in the CI because the FIPS OpenSSL provider is not actually loaded in the Centos Stream FIPS job.

Technically, the check via EVP_PKEY_CTX_new_from_name is only necessary in ssh_mlkem_decapsulate (In ssh_mlkem_encapsulate, we could also keep it as is and just remember whether we need to fall back based on the EVP_PKEY_new_raw_public_key_ex call), but I decided to unify the logic to make it cleaner. Let me know what you think is better.

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTING.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code
Edited by Pavol Žáčik

Merge request reports