[ColtonWilley]

Keep legacy algorithms registered with fips=yes, return valid metadata,
and fail loudly on attempts to use them. This is the intended design.
WP_ALLOW_NON_FIPS remains the explicit non-default override.

Alternative to #523 for the same initialization failure.

Verified with FIPS v5.2.1/v5.2.4 and non-FIPS builds, TLS 1.2/1.3,
and AddressSanitizer.

[Copilot]

🔵 Needs a closer look

Crypto-maintainer review and runtime validation are needed to confirm that the new OpenSSL ASN.1 allowlist matches wolfCrypt’s decryption parser and preserves policy compatibility across supported validated FIPS modules.

No open issues 🎉

What changed in this PR

This PR addresses the FIPS initialization failure described in #523 while preserving legacy algorithm registration. MD5, MD5-SHA1, and 3DES remain discoverable with valid metadata, but cryptographic use is explicitly rejected unless WP_ALLOW_NON_FIPS is enabled.

Changes:

• Replace legacy algorithm stubs with valid metadata and explicit rejection handlers.
• Enforce restrictions in digest-to-hash mapping and encrypted-key import, and bound PEM footer searches.
• Add policy regression tests, update build integration, and document FIPS behavior.

File	Description
test/​unit.h	Declare policy tests and support variadic logging macros in multithreaded builds.
test/​unit.c	Run FIPS policy tests before other algorithm fetches.
test/​test_tls1_prf.c	Check rejection of MD5-SHA1 in FIPS mode.
test/​test_fips_policy.c	Test discovery metadata, operation denial, KDF restrictions, and encrypted-key import.
test/​test_ecc.c	Expand truncated-PEM regression cases.
test/​include.am	Include policy tests in the Automake build.
src/​wp_wolfprov.c	Preserve legacy registrations when wolfCrypt omits their implementations.
src/​wp_internal.c	Reject MD5 hash mapping and validate encrypted-key algorithms.
src/​wp_digests.c	Provide legacy digest metadata and explicit rejection handlers.
src/​wp_des.c	Provide 3DES metadata and explicit rejection handlers.
src/​wp_dec_pem2der.c	Bound footer searches and reject traditional encrypted PEM in FIPS mode.
src/​wp_dec_epki2pki.c	Validate FIPS encryption policy before key decryption.
include/​wolfprovider/​settings.h	Define the default FIPS legacy-denial policy.
include/​wolfprovider/​internal.h	Declare the encrypted-key policy validator.
IDE/​WINVS/​unit-test/​unit-test.vcxproj	Include policy tests in the Visual Studio build.
docs/​FIPS_INTEGRATION_GUIDE.md	Explain discovery, rejection, encrypted-key restrictions, and the override.

_{Review effort: Balanced}