Bug 2152133

Summary:	In FIPS mode, the kernel should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16
Product:	Red Hat Enterprise Linux 8	Reporter:	Clemens Lang <cllang>
Component:	kernel	Assignee:	Vladis Dronov <vdronov>
kernel sub component:	Crypto	QA Contact:	Ondrej Moriš <omoris>
Status:	CLOSED ERRATA	Docs Contact:	Mirek Jahoda <mjahoda>
Severity:	high
Priority:	high	CC:	herbert.xu, kernel-qe, mjahoda, omoris, rparrazo, vdronov
Version:	8.8	Keywords:	Triaged, ZStream
Target Milestone:	rc
Target Release:	8.8
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	kernel-4.18.0-456.el8	Doc Type:	Enhancement
Doc Text:	See the Doc text in https://bugzilla.redhat.com/show_bug.cgi?id=2107595	Story Points:	---
Clone Of:	2152131
Clones:	2165132 2165133 (view as bug list)		Environment:
Last Closed:	2023-05-16 08:59:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2152131
Bug Blocks:	2165132, 2165133

Description Clemens Lang 2022-12-09 12:10:00 UTC

+++ This bug was initially created as a clone of Bug #2152131 +++

Description of problem:

Description of problem:
According to FIPS 140-3 IG, section D.R "Hash Functions Acceptable for Use in the SP 800-90A DRBGs", modules certified after May 16th, 2023 must not support the use of
 - SHA-224
 - SHA-384
 - SHA512-224
 - SHA512-256
 - SHA3-224
 - SHA3-384
and, potentially SHA3-256 and SHA3-512, since those are not yet specified.

We should either reject these hash algorithms with an error message, or provide an explicit indication that they are not FIPS-approved.


Version-Release number of selected component (if applicable):
kernel-4.18.0-442.el8.v2

How reproducible:
Check crypto/drbg.h for sha384

Actual results:
There's a HMAC DRBG using SHA-384 and a HASH DRBG using SHA-384.

Expected results:
Both of these DRBGs should not work in FIPS mode (and since they are not providing any performance improvements over using the untruncated hash, should probably be just removed completely).

Additional info:
See https://bugzilla.redhat.com/show_bug.cgi?id=2141748, which is the same report for OpenSSL. Additionally, note that we only need this for kernels to be submitted after 2023-05-16, so it is probably enough to do this in 8.8.

Comment 2 Vladis Dronov 2023-01-18 20:57:36 UTC

a suggested test: " dmesg | grep 'alg: self-tests for drbg_' " should not include "sha384".

WITHOUT DRBG FIPS FIX:

[root@rhel9 ~]# uname -r
5.14.0-70.22.1.el9_0.x86_64

[root@rhel9 ~]# dmesg | grep drbg
[    0.919221] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.934330] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.935164] alg: self-tests for drbg_nopr_hmac_sha384 (stdrng) passed
[    0.936493] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.937217] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.937793] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.938382] alg: self-tests for drbg_nopr_sha384 (stdrng) passed
[    0.939099] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.940017] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.941136] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.942128] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.945859] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.946738] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.947459] alg: self-tests for drbg_pr_hmac_sha384 (stdrng) passed
[    0.948179] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.949762] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.951576] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.952225] alg: self-tests for drbg_pr_sha384 (stdrng) passed
[    0.952886] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.953554] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.954220] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.954935] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed


WITH DRBG FIPS FIX:

# uname -r
5.14.0-236.1897_749749842.el9.x86_64

# dmesg | grep drbg
[    0.870752] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.874924] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.875914] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.876815] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.877593] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.878285] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.878949] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.879844] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.880784] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.881592] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.882325] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.883101] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.883827] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.884734] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.885718] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.886314] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.886997] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.887689] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed

Comment 15 errata-xmlrpc 2023-05-16 08:59:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2951