Bug 1448162

Summary:	Please turn on new non-sha1 AES types in krb5
Product:	[Fedora] Fedora	Reporter:	Robbie Harwood <rharwood>
Component:	crypto-policies	Assignee:	Nikos Mavrogiannopoulos <nmavrogi>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	26	CC:	nmavrogi
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	https://gitlab.com/nmav/fedora-crypto-policies/merge_requests/2
Whiteboard:
Fixed In Version:	crypto-policies-20170531-1.gitce0df7b.fc26	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-06-09 19:17:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1428744
Bug Blocks:

Description Robbie Harwood 2017-05-04 16:18:22 UTC

krb5 in version 1.15.1 adds two new AES types:

aes128-cts-hmac-sha256-128
aes256-cts-hmac-sha384-192

Please turn these on in Fedora (26+).  Thanks!

Comment 1 Nikos Mavrogiannopoulos 2017-05-09 07:38:11 UTC

Hi Robbie,
 It is faster if you submit a PR on the upstream project [0], however for such a change we should first address #1428744. Without that it would be very easy to introduce a non-working policy without any means to detect that.

[0]. https://gitlab.com/nmav/fedora-crypto-policies

Comment 2 Fedora Update System 2017-05-31 09:07:53 UTC

crypto-policies-20170531-1.gitce0df7b.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-dd3d98b5bc

Comment 3 Fedora Update System 2017-06-01 03:21:20 UTC

crypto-policies-20170531-1.gitce0df7b.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-dd3d98b5bc

Comment 4 Fedora Update System 2017-06-09 19:17:25 UTC

crypto-policies-20170531-1.gitce0df7b.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.