Bug 617239
| Summary: | openssl problems on FIPS enabled s390x with ibmca engine enabled | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Miroslav Vadkerti <mvadkert> | |
| Component: | openssl-ibmca | Assignee: | Dan Horák <dhorak> | |
| Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 5.5 | CC: | gmuelas, mvadkert, tmraz | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | s390x | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 618595 (view as bug list) | Environment: | ||
| Last Closed: | 2014-06-02 13:17:41 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 618595 | |||
|
Description
Miroslav Vadkerti
2010-07-22 15:05:09 UTC
With enabled ibmca engine i get the folowing error:
# openssl engine -c -tt
(dynamic) Dynamic engine loading support
[ unavailable ]
(ibmca) Ibmca hardware engine support
[RSA, DSA, DH, RAND, DES-ECB, DES-CBC, DES-EDE3, DES-EDE3-CBC, AES-128-ECB, AES-128-CBC, AES-192-ECB, AES-192-CBC, AES-256-ECB, AES-256-CBC, SHA1, SHA256]
[ available ]
# openssl speed -evp aes-128-cbc
internal error loading RSA key number 0
1851:error:0406A08D:rsa routines:RSA_new_method:non fips method:rsa_eng.c:183:
1851:error:0D079064:asn1 encoding routines:ASN1_ITEM_EX_COMBINE_NEW:aux error:tasn_new.c:221:
1851:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:402:Type=RSA
Note:
Both of the errors (in description and the above) appear ONLY when machine is FIPS mode.
In none FIPS mode openssl speed shows significant performance gain (ibmca is really used)
openssl speed is not working in the FIPS mode and I think it is not an important bug to fix - the same code is used in FIPS and non-FIPS modes so anyone who wants to benchmark the speed can switch to non-FIPS mode. However the error with the ibmca engine is different. The question with it is though whether the ibmca engine + the HW is FIPS certified or not. If it is, the ibmca engine should be modified to set the RSA_FLAG_FIPS_METHOD on its RSA implementation method. If it is not certified, it means the ibmca engine simply has to be disabled by the administrator in the FIPS mode. Reassigning. Hello, at this point of time is openssl-ibmca and the underlying crypto HW not completely FIPS certified, but we are working on it. Till the work is finished we should have in RHEL fips_mode=no and ibmca engine on. IBM will request (via standard feature request) to RH a change of this setting as soon as we are with SW and HW FIPS certified. Kind regards, Gonzalo. This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug. Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in RHEL5 stream. If the issue is critical for your business, please provide additional business justification through the appropriate support channels (https://access.redhat.com/site/support). |