Bug 2053289

Summary:	FIPS provider doesn't block RSA encryption for key transport
Product:	Red Hat Enterprise Linux 9	Reporter:	Alicja Kario <hkario>
Component:	openssl	Assignee:	Dmitry Belyavskiy <dbelyavs>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Alicja Kario <hkario>
Severity:	high	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	high
Version:	9.0	CC:	cllang, dbelyavs, mjahoda, ssorce
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-3.0.1-25.el9	Doc Type:	Bug Fix
Doc Text:	.Cryptography not approved by FIPS no longer works in OpenSSL in FIPS mode Previously, cryptography that was not FIPS-approved worked in the OpenSSL toolkit regardless of system settings. Consequently, you could use cryptographic algorithms and ciphers that should be disabled when the system is running in FIPS mode, for example: * TLS cipher suites using the RSA key exchange worked. * RSA-based algorithms for public-key encryption and decryption worked despite using the PKCS #1 and SSLv23 paddings or using keys shorter than 2048 bits. This update contains fixes ensuring that cryptography not approved by FIPS no longer works in OpenSSL in FIPS mode.	Story Points:	---
Clone Of:
Clones:	2091977 (view as bug list)		Environment:
Last Closed:	2023-06-05 15:55:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2091977

Description Alicja Kario 2022-02-10 21:14:42 UTC

Description of problem:
When OpenSSL works in FIPS mode, and the user configuration overrides crypto policies the RSA key exchange works.

Version-Release number of selected component (if applicable):
openssl-3.0.1-7

How reproducible:
always

Steps to Reproduce:
1. switch system to FIPS mode
2. openssl s_server -key localhost.key -cert localhost.crt -rev -cipher @SECLEVEL=0:ALL:COMPLEMENTOFALL -ciphersuites TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256
3. openssl s_client -tls1_2 -cipher AES128-SHA

Actual results:
Connection successful

Expected results:
Connection failed

Additional info:

Comment 1 Dmitry Belyavskiy 2022-02-11 15:38:47 UTC

Is it a difference between 140-2 and 140-3 or upstream bug?

Comment 2 Alicja Kario 2022-02-11 16:54:14 UTC

It's our policy thing: we have not allowed RSA key exchange in RHEL-8 in FIPS mode

Comment 3 Dmitry Belyavskiy 2022-02-11 16:56:45 UTC

But if you override the policy, the policy doesn't matter anymore...

Comment 4 Alicja Kario 2022-02-11 17:16:08 UTC

I meant the Security Policy of the module

Comment 5 Dmitry Belyavskiy 2022-02-11 17:19:49 UTC

Sorry, I don't get. If RSA encryption is not permitted by the standard we have to disable it. If it is our distribution-level policy, it is not inside the boundary so it's overwritable.

Comment 6 Alicja Kario 2022-02-22 16:21:54 UTC

It is not a mechanism that we will certify in the FIPS module.

Comment 23 Clemens Lang 2023-06-05 15:55:43 UTC

RHEL 9.1 contains openssl-3.0.1-43.el9_0.