Bug 1925104

Summary:	Camellia ciphers are still enabled in kerberos while docs say they are disabled everywhere
Product:	Red Hat Enterprise Linux 8	Reporter:	Alicja Kario <hkario>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	unspecified	Docs Contact:
Priority:	low
Version:	8.3	CC:	omoris, pvrabec
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	crypto-policies-20210617-1.gitc776d3e.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 19:51:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alicja Kario 2021-02-04 12:25:14 UTC

Description of problem:
The documentation for crypto-policies:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening
https://access.redhat.com/articles/3642912
says that Camellia is disabled evrywhere. That is not the case for Kerberos, at least camellia256-cts-cmac and camellia128-cts-cmac are still active there

Comment 5 Ondrej Moriš 2021-06-28 10:49:10 UTC

Successfully verified manually.

OLD (crypto-policies-20210209-1.gitbfb6bed.el8_3.noarch)
========================================================
# man crypto-policies
...
       Cipher suites and protocols disabled in all policy levels

       The following ciphersuites and protocols are available but disabled in all 
       crypto policy levels. They can be enabled only by explicit configuration
       of individual applications:

       ·   DH with parameters < 1024 bits
       ·   RSA with key size < 1024 bits
       ·   Camellia
       ·   ARIA
       ·   SEED
       ·   IDEA
       ·   Integrity only ciphersuites
       ·   TLS CBC mode ciphersuites using SHA-384 HMAC
       ·   AES-CCM8
       ·   all ECC curves incompatible with TLS 1.3, including secp256k1
...

NEW (crypto-policies-20210617-1.gitc776d3e.el8.noarch)
======================================================
# man crypto-policies
...
       Cipher suites and protocols disabled in all predefined policies

       The following ciphersuites and protocols are available but disabled in all 
       predefined crypto policies. They can be enabled only by explicit
       configuration of individual applications:

       ·   DH with parameters < 1024 bits
       ·   RSA with key size < 1024 bits
       ·   ARIA
       ·   SEED
       ·   IDEA
       ·   Integrity only ciphersuites
       ·   TLS CBC mode ciphersuites using SHA-384 HMAC
       ·   AES-CCM8
       ·   all ECC curves incompatible with TLS 1.3, including secp256k1
       ·   IKEv1
...

Also, this man page now correctly mentions Camellia in non-TLS Ciphers only for LEGACY and DEFAULT policies.

Comment 7 errata-xmlrpc 2021-11-09 19:51:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4460