Commit 4d75dc1ec9 for openssl.org

commit 4d75dc1ec90db26c8625e7746d3428a94b1a2d2a
Author: Pauli <paul.dale@oracle.com>
Date:   Wed Oct 21 14:17:00 2026 +1100

    fips: update continuous RNG test critical values

    The current values are based on NIST's high end suggestion of a
    type 1 error probability of 2¯²⁰. This is too low for large deployments.

    This probability is changed to NIST's low end suggestion of 2¯⁴⁰. The
    upshot is that false positives will occur a lot less frequently.

    Refer: NIST SP 800-90B section 4.4
    (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf)

    Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Merge-date: Fri Oct 30 08:59:59 2026
    Merged-from: https://github.com/openssl/openssl/pull/33289

diff --git a/providers/implementations/rands/fips_crng_test.c b/providers/implementations/rands/fips_crng_test.c
index 5b00c21705..4f5c87cb69 100644
--- a/providers/implementations/rands/fips_crng_test.c
+++ b/providers/implementations/rands/fips_crng_test.c
@@ -113,11 +113,11 @@ static int RCT_test(CRNG_TEST *crngt, uint8_t next)
      *
      *      C = 1 + \left\lceil\frac{ -log_2 \alpha}H\right\rceil
      *
-     * where alpha = 2^-20 and H is the expected entropy per sample.
+     * where alpha = 2^-40 and H is the expected entropy per sample.
      */
     static const unsigned int rct_c[9] = {
-        41, /* H = 0.5 */
-        21, 11, 8, 6, 5, 5, 4, 4 /* H = 1, ..., 8 */
+        81, /* H = 0.5 */
+        41, 21, 15, 11, 9, 8, 7, 6 /* H = 1, ..., 8 */
     };

     if (ossl_likely(crngt->rct.b != 0)
@@ -142,12 +142,12 @@ static int APT_test(CRNG_TEST *crngt, uint8_t next)
     /*
      * Critical values for this test are drawn from a binomial
      * distribution with n = 512, p = 2^-H at a critical threshold of
-     * 2^-20.  H being the expected entropy per sample.  Refer SP 800-90B
-     * section 4.4.2, table 2.
+     * 2^-40.  H being the expected entropy per sample.  Refer SP 800-90B
+     * section 4.4.2, footnote 10.
      */
     static const unsigned int apt_c[9] = {
-        410, /* H = 0.5 */
-        311, 177, 103, 62, 39, 25, 18, 13 /* H = 1, ..., 8 */
+        432, /* H = 0.5 */
+        336, 201, 123, 78, 51, 35, 26, 19 /* H = 1, ..., 8 */
     };

     if (ossl_likely(crngt->apt.b != 0)) {