Bug 500454

Summary:	NSS does not handle ECC correctly
Product:	Red Hat Enterprise Linux 5	Reporter:	Bob Relyea <rrelyea>
Component:	nss	Assignee:	Kai Engert (:kaie) (inactive account) <kengert>
Status:	CLOSED CURRENTRELEASE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	low
Version:	5.5	CC:	ebenes
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-11-06 19:12:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	500877

Description Bob Relyea 2009-05-12 18:49:35 UTC

Description of problem:

NSS does not implement the ECC PKCS #11 boundary correctly. This causes a number of HSMs to fail when used with NSS. This problem has been fixed upstream in Mozilla bug https://bugzilla.mozilla.org/show_bug.cgi?id=480280 .


Version-Release number of selected component (if applicable):


How reproducible:
Install and ECC capable HSM and try to use it.


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

The fix changes NSS to conform to the PKCS #11 spec. Some PKCS #11 modules may have conformed to NSS usage. To maintain support for those modules NSS accepts a define "NSS_USE_DECODED_CKA_EC_POINT" which tells NSS to revert to the old usage.

bob

Comment 1 RHEL Program Management 2009-11-06 19:03:47 UTC

This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release. If you would like
this request to be reviewed for the next minor release, ask your
support representative to set the next rhel-x.y flag to "?".

Comment 2 Bob Relyea 2009-11-06 19:12:12 UTC

This bug is already fixed.