test: do not skip OCB decryption in FIPS mode

tniessen · targos · commit d05263edccaa · 2025-05-31T13:23:25.000+02:00
I believe that OCB should work in FIPS mode, and only CCM should be skipped here. PR-URL: #58382 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
@@ -304,7 +304,7 @@ for (const test of TEST_CASES) {
 }
 
 // Test that create(De|C)ipheriv throws if the mode is CCM or OCB and no
-// authentication tag has been specified.
+// authentication tag length has been specified.
 {
   for (const mode of ['ccm', 'ocb']) {
     assert.throws(() => {
@@ -316,7 +316,7 @@ for (const test of TEST_CASES) {
     });
 
     // CCM decryption is unsupported in FIPS mode.
-    if (!isFipsEnabled) {
+    if (!isFipsEnabled || mode !== 'ccm') {
       assert.throws(() => {
         crypto.createDecipheriv(`aes-256-${mode}`,
                                 'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
