Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2152133

Summary:	In FIPS mode, the kernel should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16
Product:	Red Hat Enterprise Linux 8	Reporter:	Clemens Lang <cllang>
Component:	kernel	Assignee:	Vladis Dronov <vdronov>
kernel sub component:	Crypto	QA Contact:	Ondrej Moriš <omoris>
Status:	CLOSED ERRATA	Docs Contact:	Mirek Jahoda <mjahoda>
Severity:	high
Priority:	high	CC:	herbert.xu, kernel-qe, mjahoda, omoris, rparrazo, vdronov
Version:	8.8	Keywords:	Triaged, ZStream
Target Milestone:	rc	Flags:	pm-rhel: mirror+
Target Release:	8.8
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	kernel-4.18.0-456.el8	Doc Type:	Enhancement
Doc Text:	See the Doc text in https://bugzilla.redhat.com/show_bug.cgi?id=2107595	Story Points:	---
Clone Of:	2152131
Clones:	2165132 2165133 (view as bug list)		Environment:
Last Closed:	2023-05-16 08:59:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2152131
Bug Blocks:	2165132, 2165133

Description Clemens Lang 2022-12-09 12:10:00 UTC

+++ This bug was initially created as a clone of Bug #2152131 +++

Description of problem:

Description of problem:
According to FIPS 140-3 IG, section D.R "Hash Functions Acceptable for Use in the SP 800-90A DRBGs", modules certified after May 16th, 2023 must not support the use of
 - SHA-224
 - SHA-384
 - SHA512-224
 - SHA512-256
 - SHA3-224
 - SHA3-384
and, potentially SHA3-256 and SHA3-512, since those are not yet specified.

We should either reject these hash algorithms with an error message, or provide an explicit indication that they are not FIPS-approved.


Version-Release number of selected component (if applicable):
kernel-4.18.0-442.el8.v2

How reproducible:
Check crypto/drbg.h for sha384

Actual results:
There's a HMAC DRBG using SHA-384 and a HASH DRBG using SHA-384.

Expected results:
Both of these DRBGs should not work in FIPS mode (and since they are not providing any performance improvements over using the untruncated hash, should probably be just removed completely).

Additional info:
See https://bugzilla.redhat.com/show_bug.cgi?id=2141748, which is the same report for OpenSSL. Additionally, note that we only need this for kernels to be submitted after 2023-05-16, so it is probably enough to do this in 8.8.

Comment 2 Vladis Dronov 2023-01-18 20:57:36 UTC

a suggested test: " dmesg | grep 'alg: self-tests for drbg_' " should not include "sha384".

WITHOUT DRBG FIPS FIX:

[root@rhel9 ~]# uname -r
5.14.0-70.22.1.el9_0.x86_64

[root@rhel9 ~]# dmesg | grep drbg
[    0.919221] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.934330] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.935164] alg: self-tests for drbg_nopr_hmac_sha384 (stdrng) passed
[    0.936493] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.937217] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.937793] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.938382] alg: self-tests for drbg_nopr_sha384 (stdrng) passed
[    0.939099] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.940017] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.941136] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.942128] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.945859] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.946738] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.947459] alg: self-tests for drbg_pr_hmac_sha384 (stdrng) passed
[    0.948179] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.949762] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.951576] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.952225] alg: self-tests for drbg_pr_sha384 (stdrng) passed
[    0.952886] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.953554] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.954220] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.954935] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed


WITH DRBG FIPS FIX:

# uname -r
5.14.0-236.1897_749749842.el9.x86_64

# dmesg | grep drbg
[    0.870752] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.874924] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.875914] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.876815] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.877593] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.878285] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.878949] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.879844] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.880784] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.881592] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.882325] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.883101] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.883827] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.884734] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.885718] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.886314] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.886997] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.887689] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed

Comment 15 errata-xmlrpc 2023-05-16 08:59:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2951