Bug 617239 - openssl problems on FIPS enabled s390x with ibmca engine enabled
openssl problems on FIPS enabled s390x with ibmca engine enabled
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: openssl-ibmca (Show other bugs)
5.5
s390x Linux
medium Severity medium
: rc
: ---
Assigned To: Dan Horák
BaseOS QE Security Team
:
Depends On:
Blocks: 618595
  Show dependency treegraph
 
Reported: 2010-07-22 11:05 EDT by Miroslav Vadkerti
Modified: 2014-09-08 08:15 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 618595 (view as bug list)
Environment:
Last Closed: 2014-06-02 09:17:41 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Miroslav Vadkerti 2010-07-22 11:05:09 EDT
Description of problem:
When testing on s390x in FIPS mode on RHEL5.5 openssl fails:

# prelink -u -a
prelink: /usr/bin/sprof: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/gencat: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/getent: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/locale: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/iconv: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/rpcgen: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/localedef: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/bin/getconf: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/sbin/iconvconfig.s390x: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/sbin/rpcinfo: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/sbin/iconvconfig: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/sbin/zdump: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/sbin/zic: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
prelink: /usr/libexec/getconf/POSIX_V6_LP64_OFF64: Using /lib64/ld64.so.1, not /lib/ld64.so.1 as dynamic linker
# export OPENSSL_FIPS=1
# openssl speed aes-256-cbc
fips.c(151): OpenSSL internal error, assertion failed: FATAL FIPS SELFTEST FAILURE
Aborted
# echo $?
134

Version-Release number of selected component (if applicable):
openssl-0.9.8e-12.el5_4.6

How reproducible:
100%

Steps to Reproduce:
openssl speed aes-256-cbc
openssl speed rsa512
openssl speed rsa4096
openssl speed rsa
openssl speed des
openssl speed blowfish
openssl speed sha1
openssl speed sha256

all encryption methods fail
  
Actual results:
Error

Expected results:
No error (for FIPS supported encryptions)

Additional info:
Tested only on s390x
Comment 1 Miroslav Vadkerti 2010-07-23 04:53:31 EDT
With enabled ibmca engine i get the folowing error:

# openssl engine -c -tt
(dynamic) Dynamic engine loading support
     [ unavailable ]
(ibmca) Ibmca hardware engine support
 [RSA, DSA, DH, RAND, DES-ECB, DES-CBC, DES-EDE3, DES-EDE3-CBC, AES-128-ECB, AES-128-CBC, AES-192-ECB, AES-192-CBC, AES-256-ECB, AES-256-CBC, SHA1, SHA256]
     [ available ]
# openssl speed -evp aes-128-cbc
internal error loading RSA key number 0
1851:error:0406A08D:rsa routines:RSA_new_method:non fips method:rsa_eng.c:183:
1851:error:0D079064:asn1 encoding routines:ASN1_ITEM_EX_COMBINE_NEW:aux error:tasn_new.c:221:
1851:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:402:Type=RSA

Note: 
Both of the errors (in description and the above) appear ONLY when machine is FIPS mode.
In none FIPS mode openssl speed shows significant performance gain (ibmca is really used)
Comment 2 Tomas Mraz 2010-08-02 07:57:11 EDT
openssl speed is not working in the FIPS mode and I think it is not an important bug to fix - the same code is used in FIPS and non-FIPS modes so anyone who wants to benchmark the speed can switch to non-FIPS mode. However the error with the ibmca engine is different. The question with it is though whether the ibmca engine + the HW is FIPS certified or not. If it is, the ibmca engine should be modified to set the RSA_FLAG_FIPS_METHOD on its RSA implementation method.

If it is not certified, it means the ibmca engine simply has to be disabled by the administrator in the FIPS mode.

Reassigning.
Comment 4 Gonzalo Muelas Serrano 2010-08-20 10:15:53 EDT
Hello,

at this point of time is openssl-ibmca and the underlying crypto HW not completely FIPS certified, but we are working on it. Till the work is finished we should have in RHEL fips_mode=no and ibmca engine on. IBM will request (via standard feature request) to RH a change of this setting as soon as we are with SW and HW FIPS certified.

Kind regards,
Gonzalo.
Comment 5 RHEL Product and Program Management 2014-03-07 07:47:51 EST
This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug.
Comment 6 RHEL Product and Program Management 2014-06-02 09:17:41 EDT
Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in RHEL5 stream. If the issue is critical for your business, please provide additional business justification through the appropriate support channels (https://access.redhat.com/site/support).

Note You need to log in before you can comment on or make changes to this bug.