Bug 1681274

Summary:	gnutls server application should not negotiate TLS 1.3 if the private key from PKCS#11 does not support RSA-PSS nor raw-RSA
Product:	Red Hat Enterprise Linux 8	Reporter:	Jakub Jelen <jjelen>
Component:	gnutls	Assignee:	Daiki Ueno <dueno>
Status:	CLOSED DEFERRED	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	8.1	CC:	ansasaki, dueno, hkario, ssorce, szidek
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-01-19 15:38:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1689967, 1701233
Bug Blocks:

Comment 1 Anderson Sasaki 2019-03-20 15:03:21 UTC

This issue was set to medium priority because this issue does not limit the core functionality of a component.

Comment 5 Simo Sorce 2019-05-21 18:47:49 UTC

What is the status of this bug?
Are we going to target 8.1?

Comment 7 Simo Sorce 2019-05-22 10:57:41 UTC

Aligning buig status based on feedback

Comment 8 Jakub Jelen 2019-08-09 15:55:33 UTC

Hubert,
the SoftHSM change that will allow testing this functionality was merged upstream:

https://github.com/opendnssec/SoftHSMv2/pull/455

though, there was no upstream release since then. But if you believe this is worth automated test case, please, fill a bug to backport this patch to softhsm.

Comment 9 Alicja Kario 2019-08-09 17:29:21 UTC

you mean bug 1701233 is insufficient?

Comment 10 Jakub Jelen 2019-08-12 05:17:35 UTC

It is fine. I did not notice we track this in a bugzilla already.