FIPS provider 3.1.2 accepts prohibited 8-bit AES-GCM authentication tags

The FIPS provider in OpenSSL 3.1.2 accepts and authenticates one-byte AES-GCM tags. SP 800-38D §5.2.1.2 permits only 32, 64, 96, 104, 112, 120, and 128-bit tags and says implementations shall not support other values. CAVP A3548 (capability response) records the same seven, and A3548 is the AES-GCM validation claimed by the security policy for CMVP certificate #4985, which names version 3.1.2. So the module authenticates at a tag length the standard prohibits and the certificate does not cover.

The FIPS provider registers AES-GCM through the common implementation (fipsprov.c:336), and the only tag-length check there is against zero (ciphercommon_gcm.c:240):

if (sz == 0 || ctx->enc)
    return 0;
ctx->taglen = sz;

CRYPTO_gcm128_finish() then compares exactly len bytes, so a 1-byte tag authenticates as-is.

To reproduce: built openssl-3.1.2 (commit 17a2c511) with enable-fips, set FIPS default properties, fetched AES-128-GCM with provider=fips. All-zero key and IV, empty AAD, ciphertext 0388dace60b6a392f328c2b971b2fe78, tag ab6e47d42cec13bdf53a67b21257bddf, set via OSSL_CIPHER_PARAM_AEAD_TAG and checked with EVP_DecryptFinal_ex().

provider_version=3.1.2  cipher_provider=fips  fips_default_properties=1
tag16_final=1                     # full tag accepts
tag1_correct_final=1              # truncated 1-byte tag accepts
tag1_wrong_final=0
tag0_set=0                        # only zero length is rejected
modified_ct_accept tag=5a pt0=01  # forged ciphertext, 1 of 256 tags accepted

Flipping the first ciphertext byte 03 to 02 and trying all 256 one-byte tags gives exactly one acceptance, returning altered plaintext. A retryable verification oracle exhausts the tag space in 256 attempts.

Under provider=fips, tag lengths outside 4, 8, 12, 13, 14, 15, and 16 bytes should be rejected before authentication.

The current OpenSSL 3.5.8 release is also affected: the same permissive check remains, and two provider=fips runs accepted the correct one-byte tag and exactly one of 256 tags for modified ciphertext.