Bug 1687567 - rgw: use of PK11_ImportSymKey implies non-FIPS-compliant key management workflow (blocks FIPS)
Summary: rgw: use of PK11_ImportSymKey implies non-FIPS-compliant key management workf...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: RGW
Version: 3.2
Hardware: All
OS: All
medium
medium
Target Milestone: z2
: 3.2
Assignee: Marcus Watts
QA Contact: Tejas
John Brier
URL:
Whiteboard:
Depends On:
Blocks: 1629656
TreeView+ depends on / blocked
 
Reported: 2019-03-11 18:27 UTC by Matt Benjamin (redhat)
Modified: 2019-11-11 09:52 UTC (History)
17 users (show)

Fixed In Version: RHEL: ceph-12.2.8-127.el7cp Ubuntu: ceph_12.2.8-110redhat1
Doc Type: Known Issue
Doc Text:
.The Ceph Object Gateway's S3 does not always work in FIPS mode If a secret key of a Ceph Object Gateway user or sub-user is less than 112 bits in length, it can cause the `radosgw` daemon to exit unexpectedly when a user attempts to authenticate using S3. This is because the FIPS mode Red Hat Enterprise Linux security policy forbids construction of a cryptographic HMAC based on a key of less than 112 bits, and violation of this constraint yields an exception that is not correctly handled in Ceph Object Gateway. To work around this issue, ensure that the secret keys of Ceph Object Gateway users and sub-users are at least 112 bits in length.
Clone Of:
Environment:
Last Closed: 2019-04-30 15:57:07 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Ceph Project Bug Tracker 39456 None None None 2019-04-25 13:37:02 UTC
Red Hat Product Errata RHSA-2019:0911 None None None 2019-04-30 15:57:22 UTC

Description Matt Benjamin (redhat) 2019-03-11 18:27:43 UTC
Description of problem:

Similar to the situation with ceph-keys in [1], RGW uses PK11_ImportSymKey, which is not FIPS compliant.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1636251

Comment 57 errata-xmlrpc 2019-04-30 15:57:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:0911

Comment 58 John Brier 2019-04-30 17:07:15 UTC
Fixed typo. Removed of in "when a user of attempts".


Note You need to log in before you can comment on or make changes to this bug.