Bug 2160797
| Summary: | openssl smime and cms commands default to 3DES and PKCS#1v1.5 encryption in FIPS mode | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Alicja Kario <hkario> |
| Component: | openssl | Assignee: | Dmitry Belyavskiy <dbelyavs> |
| Status: | CLOSED ERRATA | QA Contact: | Alicja Kario <hkario> |
| Severity: | low | Docs Contact: | Petr Hybl <phybl> |
| Priority: | low | ||
| Version: | 9.0 | CC: | cllang, dbelyavs, jafiala |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openssl-3.0.7-18.el9 | Doc Type: | Bug Fix |
| Doc Text: |
.OpenSSL commands `cms` and `smime` can encrypt files in FIPS mode
Previously, the default configuration of the `cms` and `smime` OpenSSL commands used legacy encryption algorithms, such as 3DES or PKCS #1 v1.5. These algorithms are disabled in FIPS mode. As a result, encrypting files by using the `smime` command with the default settings did not work on systems in FIPS mode. This update introduces the following changes:
* In FIPS mode, OpenSSL APIs create CMS data by using OAEP with RSA keys by default.
* In FIPS mode, the `cms` OpenSSL command creates CMS files encrypted with `aes-128-cbc` and OAEP when provided RSA keys.
The use of ECDSA keys is unaffected. In non-FIPS mode, OpenSSL APIs and the `cms` command continue to use PKCS#1 v1.5 padding and 3DES encryption by default.
As a consequence, you can use the `cms` and `smime` OpenSSL commands in FIPS mode to encrypt files.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-07 08:52:59 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Alicja Kario
2023-01-13 18:14:09 UTC
Same issue for cms command: # openssl cms -encrypt -in message.txt -out message.enc client/cert.pem 403C7406297F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (DES-EDE3-CBC : 27), Properties () 403C7406297F0000:error:17000065:CMS routines:ossl_cms_EncryptedContent_init_bio:cipher initialisation error:crypto/cms/cms_enc.c:78: 403C7406297F0000:error:17000068:CMS routines:CMS_final:cms lib:crypto/cms/cms_smime.c:882: # openssl cms -encrypt -in message.txt -out message.enc -aes128 client/cert.pem 404C8805B77F0000:error:1C8000A5:Provider routines:rsa_encrypt:illegal or unsupported padding mode:providers/implementations/asymciphers/rsa_enc.c:163: 404C8805B77F0000:error:17000074:CMS routines:cms_EnvelopedData_Encryption_init_bio:error setting recipientinfo:crypto/cms/cms_env.c:1142: 404C8805B77F0000:error:17000068:CMS routines:CMS_final:cms lib:crypto/cms/cms_smime.c:882: Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (openssl bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:6627 |