RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2152131 - In FIPS mode, the kernel should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16
Summary: In FIPS mode, the kernel should reject SHA-224, SHA-384, SHA-512-224, and SHA...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: kernel
Version: 9.2
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: 9.2
Assignee: Vladis Dronov
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks: 2152133 2165130 2165131
TreeView+ depends on / blocked
 
Reported: 2022-12-09 12:02 UTC by Clemens Lang
Modified: 2023-05-09 10:03 UTC (History)
4 users (show)

Fixed In Version: kernel-5.14.0-253.el9
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2152133 2165130 2165131 (view as bug list)
Environment:
Last Closed: 2023-05-09 08:09:33 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Gitlab redhat/centos-stream/src/kernel centos-stream-9 merge_requests 1968 0 None opened crypto: testmgr - disallow certain DRBG hash functions in FIPS mode 2023-01-27 17:10:54 UTC
Red Hat Issue Tracker RHELPLAN-141768 0 None None None 2022-12-09 12:02:38 UTC
Red Hat Product Errata RHSA-2023:2458 0 None None None 2023-05-09 08:10:14 UTC

Internal Links: 2152133

Description Clemens Lang 2022-12-09 12:02:02 UTC 
Description of problem:

Description of problem:
According to FIPS 140-3 IG, section D.R "Hash Functions Acceptable for Use in the SP 800-90A DRBGs", modules certified after May 16th, 2023 must not support the use of
 - SHA-224
 - SHA-384
 - SHA512-224
 - SHA512-256
 - SHA3-224
 - SHA3-384
and, potentially SHA3-256 and SHA3-512, since those are not yet specified.

We should either reject these hash algorithms with an error message, or provide an explicit indication that they are not FIPS-approved.


Version-Release number of selected component (if applicable):
kernel-5.14.0-70.36.1.el9_0

How reproducible:
Check crypto/drbg.h for sha384

Actual results:
There's a HMAC DRBG using SHA-384 and a HASH DRBG using SHA-384.

Expected results:
Both of these DRBGs should not work in FIPS mode (and since they are not providing any performance improvements over using the untruncated hash, should probably be just removed completely).

Additional info:
See https://bugzilla.redhat.com/show_bug.cgi?id=2141748, which is the same report for OpenSSL. Additionally, note that we only need this for kernels to be submitted after 2023-05-16, so it is probably enough to do this in 9.2.
Comment 3 Vladis Dronov 2023-01-12 17:56:07 UTC 
Hi, Clemens,

Can you please clarify what is with SHA1 based DRBG? We do have one (if I understand code correctly).
AFAIU what is happening in Crypto, SHA1 usage should be disallowed too. WDYT?

#ifdef CONFIG_CRYPTO_DRBG_HASH
        {
                .flags = DRBG_HASH | DRBG_STRENGTH128,
                .statelen = 55, /* 440 bits */
                .blocklen_bytes = 20,
                .cra_name = "sha1",
                .backend_cra_name = "sha1",
        }, {
Comment 4 Clemens Lang 2023-01-12 19:39:53 UTC 
According to current FIPS rules, SHA-1 is still acceptable for DRBGs, so for now this is OK.

However, NIST will be moving to deprecate SHA-1 everywhere with a targeted phase out date of Dec 31, 2030: https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm

I expect that one of the next iterations of FIPS validations will require us to disable SHA-1. We could preempt this and disable it now if it is not being used and won't cause issues for customers.
Comment 6 Vladis Dronov 2023-01-13 18:02:08 UTC 
(In reply to Clemens Lang from comment #4)
> We could preempt this and disable it now if it is not
> being used and won't cause issues for customers.

thanks, Clemens. yeah, that's the point - we do not know.
so i would like to leave sha1 as it is for now.
Comment 7 Vladis Dronov 2023-01-18 21:00:59 UTC 
a suggested test: " dmesg | grep 'alg: self-tests for drbg_' " should not include "sha384".

WITHOUT DRBG FIPS FIX:

[root@rhel9 ~]# uname -r
5.14.0-70.22.1.el9_0.x86_64

[root@rhel9 ~]# dmesg | grep drbg
[    0.919221] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.934330] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.935164] alg: self-tests for drbg_nopr_hmac_sha384 (stdrng) passed
[    0.936493] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.937217] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.937793] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.938382] alg: self-tests for drbg_nopr_sha384 (stdrng) passed
[    0.939099] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.940017] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.941136] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.942128] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.945859] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.946738] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.947459] alg: self-tests for drbg_pr_hmac_sha384 (stdrng) passed
[    0.948179] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.949762] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.951576] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.952225] alg: self-tests for drbg_pr_sha384 (stdrng) passed
[    0.952886] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.953554] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.954220] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.954935] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed


WITH DRBG FIPS FIX:

# uname -r
5.14.0-236.1897_749749842.el9.x86_64

# dmesg | grep drbg
[    0.870752] alg: self-tests for drbg_nopr_hmac_sha512 (stdrng) passed
[    0.874924] alg: self-tests for drbg_nopr_hmac_sha256 (stdrng) passed
[    0.875914] alg: self-tests for drbg_nopr_hmac_sha1 (stdrng) passed
[    0.876815] alg: self-tests for drbg_nopr_sha256 (stdrng) passed
[    0.877593] alg: self-tests for drbg_nopr_sha512 (stdrng) passed
[    0.878285] alg: self-tests for drbg_nopr_sha1 (stdrng) passed
[    0.878949] alg: self-tests for drbg_nopr_ctr_aes256 (stdrng) passed
[    0.879844] alg: self-tests for drbg_nopr_ctr_aes192 (stdrng) passed
[    0.880784] alg: self-tests for drbg_nopr_ctr_aes128 (stdrng) passed
[    0.881592] alg: self-tests for drbg_pr_hmac_sha512 (stdrng) passed
[    0.882325] alg: self-tests for drbg_pr_hmac_sha256 (stdrng) passed
[    0.883101] alg: self-tests for drbg_pr_hmac_sha1 (stdrng) passed
[    0.883827] alg: self-tests for drbg_pr_sha256 (stdrng) passed
[    0.884734] alg: self-tests for drbg_pr_sha512 (stdrng) passed
[    0.885718] alg: self-tests for drbg_pr_sha1 (stdrng) passed
[    0.886314] alg: self-tests for drbg_pr_ctr_aes256 (stdrng) passed
[    0.886997] alg: self-tests for drbg_pr_ctr_aes192 (stdrng) passed
[    0.887689] alg: self-tests for drbg_pr_ctr_aes128 (stdrng) passed
Comment 20 errata-xmlrpc 2023-05-09 08:09:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2458
Note You need to log in before you can comment on or make changes to this bug.