RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1709585 - PKI (test support) for PKCS#11standard AES KeyWrap for HSM support
Summary: PKI (test support) for PKCS#11standard AES KeyWrap for HSM support
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: pki-core
Version: ---
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Christina Fu
QA Contact: PKI QE
URL:
Whiteboard:
Depends On: 1489256
Blocks: 1711801
TreeView+ depends on / blocked
 
Reported: 2019-05-13 21:35 UTC by Christina Fu
Modified: 2021-02-01 14:14 UTC (History)
6 users (show)

Fixed In Version: pki-core-10.5.17-3.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1711801 (view as bug list)
Environment:
Last Closed: 2021-02-01 07:40:51 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Christina Fu 2019-05-13 21:35:45 UTC
Description of problem:
This bug means to add test support for Bug 1709551 - JSS: add PKCS#11standard AES KeyWrap for HSM support 

https://bugzilla.redhat.com/show_bug.cgi?id=1709551

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
At current time, due to lack of PSS support, PKI instance cannot be installed with Thales SW12.50 and up (this is currently being worked on).
The potential fix for the JSS bug mentioned earlier could use CRMFPopClient to test AES KeyWrap/Padding if KeyPairGenerator is set properly.  There currently exists no such option for RSA key generation routine.

Expected results:


Additional info:

Comment 3 Christina Fu 2019-05-17 23:32:23 UTC
commit 2044d7c260822c832b1569058a5a35393b118853
Author: Christina Fu <cfu>
Date:   Fri May 17 14:26:26 2019 -0400

    bug-1709585-AesKeyWrap removed development debugging message

commit dbd2d9b587f46b8af2f78b73d62715c1fd3344fc
Author: Christina Fu <cfu>
Date:   Mon May 13 20:09:24 2019 -0400

    Bug 1709585 PKI (test support) for PKCS#11standard AES KeyWrap for HSM support
    
    This patch adds test support to
    Bug 1709551 - JSS: add PKCS#11standard AES KeyWrap for HSM support
    
    specifically on the ability for CRMFPopClient to generate temporary RSA keys
     so that they can be extractable on HSM, as currently PSS is not yet supported
    by PKI so can't rely on KRA to test the feature.
    Also for the same reason, until Thales HSM SW 12.60 is available,
    tests are only limited to
    1. not break existing functionality for CKM_NSS_AES_KEY_WRAP_PAD on nss
    2. have the expected result to be documented in https://bugzilla.redhat.com/show
    
    Also, relevant OIDs in CryptoUtil are changed to referce the JSS definitions
    in KeyWrapAlgorithm instead, with the addition of AES_KEY_WRAP_OID.
    (This results in a dependency)
    
    See https://bugzilla.redhat.com/show_bug.cgi?id=1709551 for more detail.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1709585

Comment 8 Fraser Tweedale 2019-09-19 11:56:13 UTC
This change seems to have introduced a regression that breaks key archival and retrieval using 3DES.
Please see the pull request for DOGTAG_10_5_BRANCH: https://github.com/dogtagpki/pki/pull/258.

There is also a PR for DOGTAG_10_6_BRANCH (https://github.com/dogtagpki/pki/pull/259) but no fix
is needed on newer branches (or in JSS).

Comment 9 Fraser Tweedale 2019-09-19 23:45:22 UTC
Regression fixes merged to DOGTAG_10_5_BRANCH.  Moving back to POST.

commit 4d9b4f23d761621073eb7f858e654fc7aceb406d
Author: Fraser Tweedale <ftweedal>
Date:   Thu Sep 19 20:54:17 2019 +1000

    CryptoUtil.getKeywrapAlgorithmFromOID: Fix DES-EDE3-CBC selection
    
    Commit dbd2d9b587f46b8af2f78b73d62715c1fd3344fc contained the edit:
    
    -        if (oid.equals(KW_DES_CBC_PAD))
    +        if (oid.equals(KeyWrapAlgorithm.DES_CBC_PAD_OID))
    
    KW_DES_CBC_PAD was 1.2.840.113549.3.7 (DES-EDE3-CBC; this definition
    was removed in the same commit). But
    KeyWrapAlgorithm.DES_CBC_PAD_OID is 1.3.14.3.2.7.  This is a
    behaviour change that breaks KRA archival (possibly recovery too).
    
    Test equality to KeyWrapAlgorithm.DES3_CBC_PAD_OID to restore the
    correct behaviour.  Also fix a similar error in WrappingParams.java.
    
    Related: https://bugzilla.redhat.com/show_bug.cgi?id=1709585

commit c08b0cdbf069033d7ddc4e769890bf6281200659
Author: Fraser Tweedale <ftweedal>
Date:   Thu Sep 19 17:17:24 2019 +1000

    CryptoUtil: include OID in NoSuchAlgorithmException

commit df26b7e86b3341c2cc7c0d5d9c3d9f680496a071
Author: Fraser Tweedale <ftweedal>
Date:   Thu Sep 19 15:41:40 2019 +1000

    SecurityDataProcess.archive: log decryption failure

Comment 16 RHEL Program Management 2021-02-01 07:40:51 UTC
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.


Note You need to log in before you can comment on or make changes to this bug.