Bug 2142131

Summary:	In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator
Product:	Red Hat Enterprise Linux 9	Reporter:	Clemens Lang <cllang>
Component:	openssl	Assignee:	Clemens Lang <cllang>
Status:	CLOSED ERRATA	QA Contact:	Alicja Kario <hkario>
Severity:	medium	Docs Contact:	Jan Fiala <jafiala>
Priority:	high
Version:	9.0	CC:	cllang, dbelyavs, hkario, jafiala, ssorce
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	openssl-3.0.7-1.el9	Doc Type:	Deprecated Functionality
Doc Text:	.OpenSSL rejects RSA signatures with X9.31 padding in FIPS mode Because X9.31 RSA signatures were removed from the FIPS 186-5 standard, OpenSSL no longer supports signing or signature verification with RSA keys with X9.31 padding in FIPS mode.	Story Points:	---
Clone Of:
Clones:	2144015 2144016 (view as bug list)		Environment:
Last Closed:	2023-05-09 08:20:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2144015, 2144016

Description Clemens Lang 2022-11-11 17:51:11 UTC

Description of problem:
The current draft version of FIPS 186-5 says in Appendix E:

"ANSI X9.31 was withdrawn, so X9.31 RSA signatures were removed from this standard"

We should reject them or provide an indicator. It's currently unclear whether we will need this right now, or when FIPS 186-5 moves out of draft status.


Version-Release number of selected component (if applicable):
3.0.1-43.el9_0

How reproducible:
Attempt to create or verify an X9.31 signature.

Steps to Reproduce:
1. openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa2048.pem
2. openssl dgst -sha256 -sign rsa2048.pem -sigopt rsa_padding_mode:x931 -out rsa2048.pem.sha256sig rsa2048.pem
3. openssl dgst -sha256 -prverify rsa2048.pem -sigopt rsa_padding_mode:x931 -signature rsa2048.pem.sha256sig rsa2048.pem

Actual results:
Signing succeeds. Verification prints: "Verified OK"

Expected results:
80BB7833A87F0000:error:0200008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:crypto/rsa/rsa_pk1.c:75:

Additional info:
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5-draft.pdf.
I'll follow up with the lab on whether this will apply now or later.

Comment 22 errata-xmlrpc 2023-05-09 08:20:56 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Low: openssl security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2523