Merged PR 8136159: Fix unit test failure importing DH key to CNG

+ Depending on the environment applications using CNG can either need to
  opt-in to performing FIPS checks, or opt-out of performing them.
+ For unit tests to succeed in environment where the application must
  opt-out of FIPS checks, we must opt-out of these checks when using a DH
  key which has a private key modulo P.

Author: samuel-lee-msft

unittest/lib/cng_implementations.cpp

@@ -2774,6 +2774,7 @@ DhImp<ImpCng, AlgDh>::setKey( PCDLKEY_TESTBLOB pcKeyBlob )
     BCRYPT_DH_KEY_BLOB * pBlob = (BCRYPT_DH_KEY_BLOB *) blobBuf;
     PBYTE p;
     UINT32 cbP;
+    UINT32 flags = 0;
 
     if( state.hKey != NULL )
     {
@@ -2802,13 +2803,20 @@ DhImp<ImpCng, AlgDh>::setKey( PCDLKEY_TESTBLOB pcKeyBlob )
     memcpy( p + cbP - pcKeyBlob->cbPrivKey, pcKeyBlob->abPrivKey, pcKeyBlob->cbPrivKey );
     p += cbP;
 
+    if( pcKeyBlob->fPrivateModP )
+    {
+        // Having a private key mod P is incompatible with FIPS SP800-56ar3 checks
+        // Ensure we have opted out of running these checks in BCrypt
+        flags |= BCRYPT_NO_KEY_VALIDATION;
+    }
+
     ntStatus = BCryptImportKeyPair( BCRYPT_DH_ALG_HANDLE,
                                     NULL,
                                     BCRYPT_DH_PRIVATE_BLOB,
                                     &state.hKey,
                                     blobBuf,
                                     (UINT32)(p - blobBuf),
-                                    0 );
+                                    flags );
     CHECK( NT_SUCCESS( ntStatus ), "?" );
 
 cleanup:

unittest/lib/testDh.cpp

@@ -1026,6 +1026,7 @@ testDhtestGroups( DhImplementation  * pDh, INT64 line )
         blob1.cbPrivKey = SymCryptDlkeySizeofPrivateKey( pKey1 );
         blob2.cbPrivKey = SymCryptDlkeySizeofPrivateKey( pKey2 );
 
+        blob1.fPrivateModP = FALSE;
         blob2.fPrivateModP = TRUE;
 
         scError = SymCryptDlkeyGetValue(
@@ -1078,7 +1079,7 @@ testDhtestGroups( DhImplementation  * pDh, INT64 line )
             {
                 scError = SymCryptDlkeySetPrivateKeyLength( pKey1, SYMCRYPT_MAX(nBitsPrivGenerated+1, pGroup->nMinBitsPriv), 0 );
                 CHECK4( scError == SYMCRYPT_NO_ERROR, "Error setting private key length nBitsPrivGenerated+1 %d cbP %d", nBitsPrivGenerated+1, cbP );
-                
+
                 scError = SymCryptDlkeySetValue(
                         &blob1.abPrivKey[0], blob1.cbPrivKey,
                         &blob1.abPubKey[0], cbP,