Simo,
this issue was identified by Nikos earlier this week as it was overlooked during the initial review of the packages in PELC. The ideal solution should be removal of the crypto implementation in this package.

Jack, can you check where is this crypto implementation used and whether the system one can be used instead?

Hello:

On sick leave today but wanted to take a first pass at this.

I'm going by the 3 things left in the review as I recall:

1. CMAC and HMAC : These are authentication code implementations that satisfy the secure channel protocols for the token management system.

These routines simply create thee required string by going through an algorithm that consists of using a bunch of low level crypto steps such
as encryption. The thing is ,all the actual cyrpto operations are done with jss thus nss. The code in question then merely orchestrates
the process of doing cyrpto operations and arranging the results in the final string. Here is where I ask if this actuall qualifies as an
undesired implementation or not?  If it is undesired we can probably move that level of code down into jss.

3. The DSA stuff looks, upon further review to mostly use either jss or the sun stuff to perform actual crypto operations and such. The grey
area is there seems to be some low level code that constructs things such as algorithm ids, which could be problematic.

I'm going to need to take another pass at this again next week. Also, I can find out if we even still have anyone that uses DSA at this point.

Jack,
about 1, yes please move all of it in JSS, and the same for 3 (unless you plan to remove it entirely.

Both HMAC and DSA are algorithms constructed on lower level cryptographic primitives indeed, but they are considered algorithms in their own by FIPS and require to be implemented within the certified libraries.

This is tested partially with :

1. CRMFPopClient -Worked as expected
2. PKCS10Client -Worked as expected
3. SharedToken CMC -Worked as expected
4. Agent CMC - -Worked as expected
5. CMC Encrypted/Decreypted POP - HAve some issues because of bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1744095

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:3416

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days