Bug 1660177

Summary:	FIPS-140: Tracker for compliance in .NET Core packages
Product:	dotNET	Reporter:	David Mulford <dmulford>
Component:	rh-dotnet60	Assignee:	Omair Majid <omajid>
Status:	NEW ---	QA Contact:	jiri vanek <jvanek>
Severity:	unspecified	Docs Contact:	Jacob Taylor Valdez <jvaldez>
Priority:	unspecified
Version:	6.0	CC:	andrew.slice, bodavis, dbhole, lvaleeva, rwagner
Target Milestone:	ga	Keywords:	FutureFeature
Target Release:	6.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Mulford 2018-12-17 17:29:28 UTC

This bug is a tracker for the FIPS-140 compliance in the Red Hat .NET Core packages. As of now, we've discussed internally with the following summary.

.NET Core calls out to OpenSSL for all but the following crypto algorithms.

  - RSA-PSS
  - RSA-OEAP
  - IDEA

Some work with Microsoft is needed here, as there has been discussions to move more implementations within the .NET framework.

Comment 1 David Mulford 2019-01-23 14:45:19 UTC

Any update on this? The upstream issue [1] seems to also have gone silent, so let me know if there is anything needed from me to push this forward.

[1] https://github.com/dotnet/corefx/issues/29417

Comment 4 Omair Majid 2020-01-24 15:20:45 UTC

.NET Core 2.2 has gone EOL.

I am re-targeting the bug to the latest version, .NET Core 3.1.

Comment 6 Omair Majid 2022-06-07 13:30:31 UTC

(In reply to David Mulford from comment #0)
> .NET Core calls out to OpenSSL for all but the following crypto algorithms.
> 
>   - RSA-PSS
>   - RSA-OEAP
>   - IDEA

With recent versions of .NET:

- It's my understanding that RSA-PSS and RSA-OEAP are only used on the fallback code paths, if OpenSSL is missing these features. These code paths shouldn't get executed on RHEL.

- The IDEA implementation is a unit test case. It's not part of the .NET product itself. The only IDEA implementation that .NET applications can make use of is the OpenSSL-based one.