Bug 2100807

Description of problem:

PKCS#1 v1.5 padding support was removed as it will not be allowed in FIPS mode after 2023. None of the FIPS certified modules in RHEL will support it as a FIPS approved mechanism.

IPA vault plugin is using PKCS#1 v1.5 padding, hence it is not working (https://bugzilla.redhat.com/show_bug.cgi?id=2089907). The fix is to migrate to RSA-OAEP, this scratch build provides the IPA fix:

http://brew-task-repos.usersys.redhat.com/repos/scratch/ftrivino/ipa/4.9.10/2.el9/x86_64/

with this scratch build, IPA vault is using aes-128-cbc and OAEP with SHA256 padding (with FIPS enabled)

However, the issue now appears to be in pki-tomcat/kra. Based on the logs, it looks like the KeyArchivalRequest works, but later on the decryptExternalPrivate raises an exception: "INFO: PKIExceptionMapper: Returning PKIException"

I tried enabling "keyWrap.useOAEP=true" (+restarting the service) in the CS.cfg file (with no luck):

[root@master cloud-user]# grep debug /usr/share/pki/kra/conf/CS.cfg
debug.level=0

[root@master cloud-user]# grep keyWrap /usr/share/pki/kra/conf/CS.cfg
keyWrap.useOAEP=true


btw, probably not related to this issue but something to highlight here, I do see PKCS#1v1.5 being used here:

https://github.com/dogtagpki/pki/blob/master/base/common/python/pki/crypto.py#L265




Version-Release number of selected component (if applicable):

[root@master kra]# rpm -qa  | grep pki
krb5-pkinit-1.19.1-19.el9.x86_64
python3-idm-pki-11.2.0-0.4.beta3.el9.noarch
idm-pki-base-11.2.0-0.4.beta3.el9.noarch
pki-jackson-core-2.11.4-6.el9.noarch
pki-jackson-annotations-2.11.4-6.el9.noarch
pki-jackson-databind-2.11.4-6.el9.noarch
pki-servlet-4.0-api-9.0.50-1.el9.noarch
pki-jackson-module-jaxb-annotations-2.11.4-8.el9.noarch
pki-jackson-jaxrs-providers-2.11.4-7.el9.noarch
pki-jackson-jaxrs-json-provider-2.11.4-7.el9.noarch
pki-resteasy-jackson2-provider-3.0.26-15.el9.noarch
pki-resteasy-core-3.0.26-15.el9.noarch
pki-resteasy-client-3.0.26-15.el9.noarch
idm-pki-java-11.2.0-0.4.beta3.el9.noarch
idm-pki-tools-11.2.0-0.4.beta3.el9.x86_64
pki-servlet-engine-9.0.50-1.el9.noarch
idm-pki-server-11.2.0-0.4.beta3.el9.noarch
idm-pki-acme-11.2.0-0.4.beta3.el9.noarch
idm-pki-ca-11.2.0-0.4.beta3.el9.noarch
idm-pki-kra-11.2.0-0.4.beta3.el9.noarch


How reproducible:
100%

Steps to Reproduce:
1. Install ipa from the above scratch build
2. echo Secret123 | kinit admin
3. ipa vault-add myvault --type standard
ipa: ERROR: an internal error has occurred


Actual results:
ipa: ERROR: an internal error has occurred

Expected results:


Additional info:



2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: Request:
{
  "ClassName" : "com.netscape.certsrv.key.KeyArchivalRequest",
  "Attributes" : {
    "Attribute" : [ {
      "name" : "clientKeyID",
      "value" : "ipa:/users/admin/jmagne1000"
    }, {
      "name" : "dataType",
      "value" : "passPhrase"
    }, {
      "name" : "wrappedPrivateData",
      "value" : "IHgZUVeuNCotwEMjQbKuPQ=="
    }, {
      "name" : "transWrappedSessionKey",
      "value" : "XMcefjkfjh8Qok+RIZMqcWKUSvevfSxTgmk8D5b555V9kb3lpzxsyJsDsLs8osy97SY+L7WvsLFKrQBX1K2gLochvxkAGCOT1Rx/5vseEWu4gEEGB/JCPaUJrlTnVKlw+M8kkkcekWg+FFdUZ3gjshJi8CgNRhI8r9+HzU8SKe+Cx6E5Oic/wzUSGuQOk5RtDsfnYtyXOpXY1fdY8zulBpf6AbqG2kYhNd1P3v2W8kuc1AFyrfdJOSYBbifwJv7r28Ei+5LDiY3ZLDw0lN7DLkvC44nBzWXUG3Tg3utUZ2vPP/dcAzbrIAE1NZX9fMyLLs79/BOCJaBExLsMECd/7Q=="
    }, {
      "name" : "algorithmOID",
      "value" : "{2 16 840 1 101 3 4 1 2}"
    }, {
      "name" : "symmetricAlgorithmParams",
      "value" : "eTU1q5zpiPJTnlKUE6TvJw=="
    } ]
  }
}
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: KeyRequestDAO: Checking for key existence
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: KeyRequestDAO: - client key ID: ipa:/users/admin/jmagne1000
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: KeyRequestDAO: - status: active
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: KeyRequestDAO: - filter: (&(clientId=ipa:/users/admin/jmagne1000)(status=active))
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: LdapBoundConnFactory: getting a connection
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: LdapBoundConnFactory: master connection is connected: true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: LdapBoundConnFactory: connection already connected: true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: LdapBoundConnFactory: number of connections: 2
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting dbs.newSchemaEntryAdded=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting dbs.newSchemaEntryAdded=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: LDAPSession: Searching ou=keyRepository, ou=kra,o=kra,o=ipaca for (&(clientId=ipa:/users/admin/jmagne1000)(status=active))
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: LdapBoundConnFactory: number of connections: 3
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: KeyRequestDAO: Key does not exist
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting kra.ephemeralRequests=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: SignedAuditLogger: event RANDOM_GENERATION
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting kra.ephemeralRequests=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: SecurityDataProcessor.archive. Request id: 16560078593838057
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: SecurityDataProcessor.archive wrappedSecurityData: IHgZUVeuNCotwEMjQbKuPQ==
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting kra.allowEncDecrypt.archival=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting keyWrap.useOAEP=true
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: TransportKeyUnit.decryptExternalPrivate
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINE: SignedAuditLogger: event SECURITY_DATA_ARCHIVAL_REQUEST
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting pidDir=/var/run/pki/tomcat
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] FINEST: Getting pidDir=/var/run/pki/tomcat
2022-06-23 14:10:59 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: PKIExceptionMapper: Returning PKIException