Bug 1133718

Summary: Key strength validation is not performed for RC4 algorithm
Product: Red Hat Enterprise Linux 7 Reporter: Nathan Kinder <nkinder>
Component: jssAssignee: Christina Fu <cfu>
Status: CLOSED ERRATA QA Contact: Asha Akkiangady <aakkiang>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.1CC: cfu, edewata, extras-qa, jdennis, kwright, mharmsen, nkinder, rmeggins, rpattath
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: jss-4.2.6-35.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1133717
: 1190303 (view as bug list) Environment:
Last Closed: 2015-03-05 13:22:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1133717    
Bug Blocks: 1190303    

Description Nathan Kinder 2014-08-26 00:53:50 UTC 
+++ This bug was initially created as a clone of Bug #1133717 +++

JSS doesn't currently validate the key strength properly for the RC4 algorithm.  Any strength is considered valid.  Here is the RC4 validation method from mozilla/security/jss/org/mozilla/jss/crypto/KeyGenAlgorithm.java:

------------------------------------------------------------------------------
    public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return true;
                }
            }, null, null);
------------------------------------------------------------------------------

RC4 acceptable key sizes should really be between 40 and 2048 bits. The RC4 strength validator method should look like this:

------------------------------------------------------------------------------
    public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return strength>=40 && strength <= (256*8);
                }
            }, null, null);
------------------------------------------------------------------------------
Comment 3 Roshni 2014-11-03 19:17:04 UTC 
Verified on jss-4.2.6-35.el7.x86_64, pki-ca-10.2.0-3.el7.noarch, pki-kra-10.2.0-3.el7.noarch.

Verified using the cli commands described in comment 1.
Comment 5 errata-xmlrpc 2015-03-05 13:22:26 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0521.html