Bug 1898641 - Need to add new signature algorithms for NSS.
Summary: Need to add new signature algorithms for NSS.
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: crypto-policies
Version: 34
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Alexander Sosedkin
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-11-17 17:51 UTC by Bob Relyea
Modified: 2026-03-05 00:04 UTC (History)
6 users (show)

Fixed In Version: crypto-policies-20210118-1.gitb21c811
Clone Of:
Environment:
Last Closed: 2022-01-11 16:13:29 UTC
Type: Bug
Embargoed:
fedora-admin-xmlrpc: mirror+


Attachments (Terms of Use)
Add rsa-pss, rsa-pkcs, and ecdsa to the nss policies. (1.18 KB, patch)
2020-11-17 18:00 UTC, Bob Relyea
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Gitlab redhat-crypto fedora-crypto-policies merge_requests 84 0 None None None 2021-01-18 18:24:07 UTC

Description Bob Relyea 2020-11-17 17:51:36 UTC
Upstream NSS just added policy support for rsa-pkcs, rsa-pss, and ecdsa as signature algorithms in NSS 3.59. crypto policies needs to add maps from the signature values to these new algorithm types. Without these new algorithms, rsa signatures will break when policies are installed.

The challenge is we can't add these to crypto policies before NSS updates because nss-check-policy will fail (we really need to have an option for nss-check-policy to allow *NEW* unknown policies (sigh)).

Anywaythe NSS 3.59 update needs to be coordinated with crypto policies.

Comment 1 Bob Relyea 2020-11-17 18:00:28 UTC
Created attachment 1730246 [details]
Add rsa-pss, rsa-pkcs, and ecdsa to the nss policies.

This patch also disabled acting on the results of policy check so it can be added before the new NSS is included.

Comment 4 Alexander Sosedkin 2021-01-18 18:24:07 UTC
Upstream merge request: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/84

Comment 5 Ben Cotton 2021-02-09 15:25:28 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 34 development cycle.
Changing version to 34.


Note You need to log in before you can comment on or make changes to this bug.