Bug 2114772

Summary:	[FIPS lab review] HKDF limitations
Product:	Red Hat Enterprise Linux 9	Reporter:	Dmitry Belyavskiy <dbelyavs>
Component:	openssl	Assignee:	Clemens Lang <cllang>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Alicja Kario <hkario>
Severity:	high	Docs Contact:
Priority:	high
Version:	9.1	CC:	afarley, cllang, hkario
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-3.0.1-41.el9_0	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	2118388 (view as bug list)		Environment:
Last Closed:	2023-06-05 15:55:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2118388

Description Dmitry Belyavskiy 2022-08-03 08:57:56 UTC

HKDF algorithms are only allowed in the context of TLS 1.3. 

HKDF is only approved when it is used as specified in SP800-56C. This spec
defines that HKDF is only allowed to process shared secrets that were agreed
on (DH) or exchanged (RSA). This means it is allowed to be used as part of TLS
1.3.

NIST made it very clear that HKDF is not allowed to be used as a general-
purpose KDF like SP800-108 KDFs. 

If HKDF is not merged with the key establishment method by the module, then it
is non-approved considering that 56C defines a schema that must be provided by
the module and not by the caller.

We can document that the HKDF indicator is applicable only for TLS applications. For any other use the function is unapproved and the indicator does not apply.

Comment 9 Clemens Lang 2023-06-05 15:55:26 UTC

RHEL 9.1 contains openssl-3.0.1-43.el9_0.