Bug List: (74 of 74)
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2231540 - SSH does not use the ibmca crypto hardware in FIPS on s390x
Summary: SSH does not use the ibmca crypto hardware in FIPS on s390x
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: openssh
Version: 9.3
Hardware: s390x
OS: All
low
low
Target Milestone: rc
: ---
Assignee: Dmitry Belyavskiy
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-11 18:48 UTC by Ondrej Moriš
Modified: 2023-08-29 10:41 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-29 10:38:57 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker CRYPTO-11471 0 None None None 2023-08-29 10:41:56 UTC
Red Hat Issue Tracker RHELPLAN-165683 0 None None None 2023-08-11 18:50:04 UTC

Description Ondrej Moriš 2023-08-11 18:48:52 UTC 
This bug was initially created as a copy of Bug #1397547

I am copying this bug because: 

There seems to be a regression of this bug in RHEL-9.3 in FIPS. Scenario described below is implemented in TC#0544984 - /CoreOS/openssh/Regression/bz1397547-SSH-does-not-use-the-ibmca-crypto-hardware. The test fails on RHEL-9.3 with openssh-8.7p1-34.el9.s390x the same way that is described in the original bug report (counters are not incremented). When I downgrade to openssh-8.7p1-28.el9.s390x the test again works flawlessly. The most suspicious change in 9.3.9 openssh is in BZ#2091694 - isn't it possible that it brought this regression?

Description of problem:

Configured OpenSSL to use ibmca and verified the configuration for Apache but SSHD will not use the modular exponentiation (RSA/DH/DSA) from the crypto adapter.


Version-Release number of selected component (if applicable):

openssh-8.7p1-34.el9.s390x (the other packages make no difference)

How reproducible:

100% in FIPS mode on s390x

Steps to Reproduce:

1. Run TC#0544984 - /CoreOS/openssh/Regression/bz1397547-SSH-does-not-use-the-ibmca-crypto-hardware 

or 

0. configure the openssl.cnf as described in openssl.cnf.sample-s390x reboot 
1.configure openssl as above
2.reboot
3.run lszcrypt -VVV to check request_count
4.run icastats -r to clear stats
5.open multiple ssh sessions and the counter will not increment
6.run lszcrypt -VVV to check request_count
7.run icastats to verify the software count is incrementing and the hardware count is not

Actual results:

the request_count will not increment and icastats for hardware will not increment which means that ssh is using the builtin openssl engine instead of offloading to the crypto card

Expected results:

request_count should increment and icastats should increment for hardware

Additional info:

Works fine with openssh-8.7p1-28.el9.s390x. 
Works fine with openssh-8.7p1-34.el9.s390x when FIPS is disabled.
Comment 2 Dmitry Belyavskiy 2023-08-14 07:25:49 UTC 
I discussed something similar in https://bugzilla.redhat.com/show_bug.cgi?id=2224568

Karel, could you please check if it is the same issue?
Comment 3 Karel Srot 2023-08-14 08:00:58 UTC 
No, this is something different. The issue in bug 2224568  has been fixed with openssl-ibmca-2.4.0-4.el9 which has been installed in test jobs above.

However, I had been discussing this issue previously with Hubert Kario who spotted it. The ibmca engine is not used when openssl is configured to use the ibmca engine. It works when openssl is using ibmca provider. The engine is deprecated and it has never been FIPS compliant, we believe this is not worth fixing. Users should be using ibmca provider instead.
Comment 4 Dmitry Belyavskiy 2023-08-14 08:20:38 UTC 
Ondra, could you please check whether switching to the provider fixes the issue? If yes, I'd close it as WONTFIX.
Comment 5 Ondrej Moriš 2023-08-29 10:38:57 UTC 
(In reply to Dmitry Belyavskiy from comment #4)
> Ondra, could you please check whether switching to the provider fixes the
> issue? If yes, I'd close it as WONTFIX.

Yes, it works fine when imbca provider is enabled. Thank you both!
Note You need to log in before you can comment on or make changes to this bug.
Bug List: (74 of 74)