Bug 1994676

Summary:	Enable the import of plain keys into the NSS Software Token while in FIPS mode [rhel-9, openjdk-8]
Product:	Red Hat Enterprise Linux 9	Reporter:	Andrew John Hughes <ahughes>
Component:	java-1.8.0-openjdk	Assignee:	Martin Balao <mbalao>
Status:	CLOSED ERRATA	QA Contact:	OpenJDK QA <java-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	jandrlik, jvanek
Target Milestone:	beta	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	java-1.8.0-openjdk-1.8.0.312.b05-0.2.ea.el9	Doc Type:	Bug Fix
Doc Text:	While in FIPS mode, the NSS Software Token does not allow the import of private or secret plain keys. This caused the OpenJDK keytool application to fail when used with OpenJDK in FIPS mode. With this update, OpenJDK will now import such keys into the NSS database. This behaviour may be disabled using -Dcom.redhat.fips.plainKeySupport=false.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 12:32:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2029659, 2029668

Description Andrew John Hughes 2021-08-17 16:41:46 UTC

This bug was initially created as a copy of Bug #1991003

I am copying this bug because: 

FIPS support should be kept in sync between java-1.8.0-openjdk, java-11-openjdk & java-17-openjdk and RHEL 8 & 9 where possible.

Description of problem:

While in FIPS mode, the NSS Software Token does not allow the import of private or secret plain keys into the token (not even as session keys). Thus, OpenJDK's FIPS solution cannot enable the use of keys from plain files, JKS keystores or obtained by any other means external to the NSS Software Token. The only mechanism so far would be to generate the keys inside the token or import them directly to it (NSS DB) with external tooling. Please note that: 1) certificates and public keys are not affected by this; and 2) private and secret keys should only be used in crypto algorithms provided by the NSS Software Token (which is FIPS compliant).

This issue generates an impact on applications that want to retrieve a key external to the NSS Software Token and use it there temporarily, getting benefit of FIPS compliant algorithms.

Version-Release number of selected component (if applicable):

RHEL 8.4

How reproducible:

Always.

Steps to Reproduce:
1. Enable RHEL FIPS mode
2. Get a private key from a file (Java app)
3. Try to generate a signature through a Signature service (Java app)

Actual results:

The private key cannot be imported into the NSS Software Token. The native C_CreateObject PKCS#11 call to the NSS library fails.

Expected results:

The private key is created inside the NSS Software Token as a session key (CKA_TOKEN attribute is 'false') and the signature is generated.

Additional info:

This is a followup bug of RH1759335.

Comment 8 errata-xmlrpc 2022-05-17 12:32:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: java-1.8.0-openjdk), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2336