Bug 1991003

Summary:	Enable the import of plain keys into the NSS Software Token while in FIPS mode [rhel-8, openjdk-11]
Product:	Red Hat Enterprise Linux 8	Reporter:	Martin Balao <mbalao>
Component:	java-11-openjdk	Assignee:	Martin Balao <mbalao>
Status:	CLOSED ERRATA	QA Contact:	OpenJDK QA <java-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	ableisch, ahughes, akashche, jandrlik, jvanek, leiyu, mmillson, nmoumoul, orivat, sgehwolf
Target Milestone:	beta	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	java-11-openjdk-11.0.12.0.7-7.el8	Doc Type:	Bug Fix
Doc Text:	While in FIPS mode, the NSS Software Token does not allow the import of private or secret plain keys. This caused the OpenJDK keytool application to fail when used with OpenJDK in FIPS mode. With this update, OpenJDK will now import such keys into the NSS database. This behaviour may be disabled using -Dcom.redhat.fips.plainKeySupport=false.	Story Points:	---
Clone Of:
Clones:	2014211 2014212 (view as bug list)		Environment:
Last Closed:	2022-05-10 13:40:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2014211, 2014212, 2029653, 2029660

Description Martin Balao 2021-08-06 19:05:31 UTC

Description of problem:

While in FIPS mode, the NSS Software Token does not allow the import of private or secret plain keys into the token (not even as session keys). Thus, OpenJDK's FIPS solution cannot enable the use of keys from plain files, JKS keystores or obtained by any other means external to the NSS Software Token. The only mechanism so far would be to generate the keys inside the token or import them directly to it (NSS DB) with external tooling. Please note that: 1) certificates and public keys are not affected by this; and 2) private and secret keys should only be used in crypto algorithms provided by the NSS Software Token (which is FIPS compliant).

This issue generates an impact on applications that want to retrieve a key external to the NSS Software Token and use it there temporarily, getting benefit of FIPS compliant algorithms.

Version-Release number of selected component (if applicable):

RHEL 8.4

How reproducible:

Always.

Steps to Reproduce:
1. Enable RHEL FIPS mode
2. Get a private key from a file (Java app)
3. Try to generate a signature through a Signature service (Java app)

Actual results:

The private key cannot be imported into the NSS Software Token. The native C_CreateObject PKCS#11 call to the NSS library fails.

Expected results:

The private key is created inside the NSS Software Token as a session key (CKA_TOKEN attribute is 'false') and the signature is generated.

Additional info:

This is a followup bug of RH1759335.

Comment 29 errata-xmlrpc 2022-05-10 13:40:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (java-11-openjdk bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1799

Comment 30 Red Hat Bugzilla 2023-09-15 01:35:24 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days