Bug 1711801

Summary:	PKI (test support) for PKCS#11standard AES KeyWrap for HSM support [rhel-7.6.z]
Product:	Red Hat Enterprise Linux 7	Reporter:	RAD team bot copy to z-stream <autobot-eus-copy>
Component:	pki-core	Assignee:	Christina Fu <cfu>
Status:	CLOSED WONTFIX	QA Contact:	PKI QE <bugzilla-pkiqe>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	7.7	CC:	aakkiang, cfu, mharmsen, msauton
Target Milestone:	rc	Keywords:	TestCaseProvided, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1709585	Environment:
Last Closed:	2019-06-14 23:12:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1709585
Bug Blocks:

Description RAD team bot copy to z-stream 2019-05-20 07:11:01 UTC

This bug has been copied from bug #1709585 and has been proposed to be backported to 7.6 z-stream (EUS).

Comment 2 Christina Fu 2019-05-21 16:26:52 UTC

commit dbd2d9b587f46b8af2f78b73d62715c1fd3344fc
Author: Christina Fu <cfu>
Date:   Mon May 13 20:09:24 2019 -0400

    Bug 1709585 PKI (test support) for PKCS#11standard AES KeyWrap for HSM support
    
    This patch adds test support to
    Bug 1709551 - JSS: add PKCS#11standard AES KeyWrap for HSM support
    
    specifically on the ability for CRMFPopClient to generate temporary RSA keys
     so that they can be extractable on HSM, as currently PSS is not yet supported
    by PKI so can't rely on KRA to test the feature.
    Also for the same reason, until Thales HSM SW 12.60 is available,
    tests are only limited to
    1. not break existing functionality for CKM_NSS_AES_KEY_WRAP_PAD on nss
    2. have the expected result to be documented in https://bugzilla.redhat.com/sh
    
    Also, relevant OIDs in CryptoUtil are changed to referce the JSS definitions
    in KeyWrapAlgorithm instead, with the addition of AES_KEY_WRAP_OID.
    (This results in a dependency)
    
    See https://bugzilla.redhat.com/show_bug.cgi?id=1709551 for more detail.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1709585

Comment 5 Matthew Harmsen 2019-06-14 23:12:02 UTC

CLOSED WONTFIX -- will be initially applied to RHEL 7.8