Bug 1603597

Summary:	Confusing error message when asking for invalid DSA parameter sizes in FIPS mode
Product:	Red Hat Enterprise Linux 7	Reporter:	Alicja Kario <hkario>
Component:	openssl	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Alicja Kario <hkario>
Severity:	low	Docs Contact:
Priority:	low
Version:	7.6	CC:	hkario, lmiksik
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-1.0.2k-16.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-30 11:24:02 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alicja Kario 2018-07-19 17:26:32 UTC

Description of problem:
When system is working in FIPS mode, only specific key sizes are allowed, asking openssl for generation of other key sizes causes it to report confusing error message "q not prime" instead of the expected "key size invalid"

Version-Release number of selected component (if applicable):
openssl-1.0.2k-15.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. turn system to FIPS mode
2. openssl dsaparam -out dsa-test.pem 2047

Actual results:
Generating DSA parameters, 2047 bit long prime
This could take some time
140075572418448:error:0A07B071:dsa routines:dsa_builtin_paramgen:q not prime:dsa_gen.c:165:
Error, DSA key generation failed

Expected results:
Generating DSA parameters, 2047 bit long prime
This could take some time
140178529699744:error:0A07B071:dsa routines:dsa_builtin_paramgen:key size invalid:dsa_gen.c:167:
Error, DSA key generation failed

Additional info:
while technically a regression (openssl-1.0.1e-60.el7.x86_64 was behaving correctly), it's only an issue in error message

Comment 9 errata-xmlrpc 2018-10-30 11:24:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:3221