Bug 709055

Summary: libcryptsetup crypt_get_volume_key() should be disabled in FIPS mode
Product: Red Hat Enterprise Linux 6 Reporter: RHEL Program Management <pm-rhel>
Component: cryptsetup-luksAssignee: Milan Broz <mbroz>
Status: CLOSED ERRATA QA Contact: Release Test Team <release-test-team>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 6.1CC: agk, atodorov, iboverma, mbroz, mitr, pm-eus, prajnoha, prockai, pvrabec, sgrubb, syeghiay, tmraz, zkabelac
Target Milestone: rcKeywords: FutureFeature, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: cryptsetup-luks-1.2.0-3.el6_1.1 Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-06-20 07:09:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 701936    
Bug Blocks:    

Description RHEL Program Management 2011-05-30 13:35:51 UTC
This bug has been copied from bug #701936 and has been proposed
to be backported to 6.1 z-stream (EUS).

Comment 3 Milan Broz 2011-06-02 12:19:47 UTC
Fix in  cryptsetup-luks-1.2.0-3.el6_1.1.

Comment 4 Alexander Todorov 2011-06-03 09:11:32 UTC
Per https://bugzilla.redhat.com/show_bug.cgi?id=701936#c15

# rpm -q cryptsetup-luks
cryptsetup-luks-1.2.0-3.el6_1.1.x86_64


# cryptsetup luksDump --dump-master-key /dev/vda2
Running in FIPS mode.

WARNING!
========
LUKS header dump with volume key is sensitive information
which allows access to encrypted partition without passphrase.
This dump should be always stored encrypted on safe place.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: 
Function not available in FIPS mode.

Comment 5 errata-xmlrpc 2011-06-20 07:09:27 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0884.html