Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 1687567

Summary: rgw: use of PK11_ImportSymKey implies non-FIPS-compliant key management workflow (blocks FIPS)
Product: [Red Hat Storage] Red Hat Ceph Storage Reporter: Matt Benjamin (redhat) <mbenjamin>
Component: RGWAssignee: Marcus Watts <mwatts>
Status: CLOSED ERRATA QA Contact: Tejas <tchandra>
Severity: medium Docs Contact: John Brier <jbrier>
Priority: medium    
Version: 3.2CC: agunn, anharris, cbodley, ceph-eng-bugs, ceph-qe-bugs, jbrier, kbader, kkeithle, mbenjamin, mwatts, rzarzyns, sweil, tchandra, tserlin, uboppana, vpoliset, vumrao
Target Milestone: z2   
Target Release: 3.2   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: RHEL: ceph-12.2.8-127.el7cp Ubuntu: ceph_12.2.8-110redhat1 Doc Type: Known Issue
Doc Text:
.The Ceph Object Gateway's S3 does not always work in FIPS mode If a secret key of a Ceph Object Gateway user or sub-user is less than 112 bits in length, it can cause the `radosgw` daemon to exit unexpectedly when a user attempts to authenticate using S3. This is because the FIPS mode Red Hat Enterprise Linux security policy forbids construction of a cryptographic HMAC based on a key of less than 112 bits, and violation of this constraint yields an exception that is not correctly handled in Ceph Object Gateway. To work around this issue, ensure that the secret keys of Ceph Object Gateway users and sub-users are at least 112 bits in length.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-04-30 15:57:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1629656    

Description Matt Benjamin (redhat) 2019-03-11 18:27:43 UTC 
Description of problem:

Similar to the situation with ceph-keys in [1], RGW uses PK11_ImportSymKey, which is not FIPS compliant.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1636251
Comment 57 errata-xmlrpc 2019-04-30 15:57:07 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:0911
Comment 58 John Brier 2019-04-30 17:07:15 UTC 
Fixed typo. Removed of in "when a user of attempts".