Bug 1711375

Summary:	TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible
Product:	Red Hat Enterprise Linux 8	Reporter:	Alicja Kario <hkario>
Component:	nss	Assignee:	nss-nspr-maint <nss-nspr-maint>
Status:	CLOSED ERRATA	QA Contact:	Ivan Nikolchev <inikolch>
Severity:	medium	Docs Contact:
Priority:	high
Version:	8.0	CC:	dueno, inikolch, rrelyea, ssorce
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	8.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	nss-3.53.1-6.el8_2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-03 13:01:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1809549
Bug Blocks:

Description Alicja Kario 2019-05-17 16:01:38 UTC

Description of problem:
definition of TLS_AES_256_GCM_SHA384 in NSS does no specify that the cipher is FIPS compatible

Version-Release number of selected component (if applicable):
nss-3.41.0-5.el8

How reproducible:
always

Steps to Reproduce:
1. /usr/lib64/nss/unsupported-tools/listsuites
2.
3.

Actual results:
TLS_AES_128_GCM_SHA256:
  0x1301 TLS 1.3 TLS 1.3 AES-GCM  128 AEAD   Enabled  FIPS Domestic            
TLS_CHACHA20_POLY1305_SHA256:
  0x1303 TLS 1.3 TLS 1.3 CHACHA20POLY1305 256 AEAD   Enabled       Domestic            
TLS_AES_256_GCM_SHA384:
  0x1302 TLS 1.3 TLS 1.3 AES-GCM  256 AEAD   Enabled       Domestic

Expected results:
TLS_AES_128_GCM_SHA256:
  0x1301 TLS 1.3 TLS 1.3 AES-GCM  128 AEAD   Enabled  FIPS Domestic            
TLS_CHACHA20_POLY1305_SHA256:
  0x1303 TLS 1.3 TLS 1.3 CHACHA20POLY1305 256 AEAD   Enabled       Domestic            
TLS_AES_256_GCM_SHA384:
  0x1302 TLS 1.3 TLS 1.3 AES-GCM  256 AEAD   Enabled  FIPS Domestic

Additional info:

Comment 11 errata-xmlrpc 2020-08-03 13:01:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:3280