Bug 1133718 - Key strength validation is not performed for RC4 algorithm
Summary: Key strength validation is not performed for RC4 algorithm
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: jss
Version: 7.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Christina Fu
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Depends On: 1133717
Blocks: 1190303
TreeView+ depends on / blocked
 
Reported: 2014-08-26 00:53 UTC by Nathan Kinder
Modified: 2015-03-05 13:22 UTC (History)
9 users (show)

Fixed In Version: jss-4.2.6-35.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1133717
: 1190303 (view as bug list)
Environment:
Last Closed: 2015-03-05 13:22:26 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0521 normal SHIPPED_LIVE jss bug fix and enhancement update 2015-03-05 16:32:59 UTC

Description Nathan Kinder 2014-08-26 00:53:50 UTC
+++ This bug was initially created as a clone of Bug #1133717 +++

JSS doesn't currently validate the key strength properly for the RC4 algorithm.  Any strength is considered valid.  Here is the RC4 validation method from mozilla/security/jss/org/mozilla/jss/crypto/KeyGenAlgorithm.java:

------------------------------------------------------------------------------
    public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return true;
                }
            }, null, null);
------------------------------------------------------------------------------

RC4 acceptable key sizes should really be between 40 and 2048 bits. The RC4 strength validator method should look like this:

------------------------------------------------------------------------------
    public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return strength>=40 && strength <= (256*8);
                }
            }, null, null);
------------------------------------------------------------------------------

Comment 3 Roshni 2014-11-03 19:17:04 UTC
Verified on jss-4.2.6-35.el7.x86_64, pki-ca-10.2.0-3.el7.noarch, pki-kra-10.2.0-3.el7.noarch.

Verified using the cli commands described in comment 1.

Comment 5 errata-xmlrpc 2015-03-05 13:22:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0521.html


Note You need to log in before you can comment on or make changes to this bug.