Bug 960193 - Enable ECC in nss and nss-softoken
Enable ECC in nss and nss-softoken
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: nss (Show other bugs)
6.5
Unspecified Unspecified
high Severity high
: rc
: 6.5
Assigned To: Elio Maldonado Batiz
Hubert Kario
:
Depends On: 990223
Blocks: 960208 960241 RHEL65FIPS140 1002964
  Show dependency treegraph
 
Reported: 2013-05-06 12:28 EDT by Elio Maldonado Batiz
Modified: 2013-11-21 01:14 EST (History)
12 users (show)

See Also:
Fixed In Version: nss-3.14.3-33.el6
Doc Type: Release Note
Doc Text:
Network Security Services's (NSS) own internal cryptographic module in Red Hat Enterprise Linux 6.5 now supports the NIST Suite B set of recommended algorithms for Elliptic curve cryptography (ECC).
Story Points: ---
Clone Of:
: 960208 960241 990223 1002964 (view as bug list)
Environment:
Last Closed: 2013-11-21 01:14:01 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Required nss changes for ecc in patch format (2.41 KB, patch)
2013-05-06 12:39 EDT, Elio Maldonado Batiz
rrelyea: review+
Details | Diff
Part 1: add support ecc suite-b only - libraries (9.08 KB, patch)
2013-05-20 11:27 EDT, Elio Maldonado Batiz
no flags Details | Diff
Part 2: add support ecc suite-b only - test scripts (8.23 KB, patch)
2013-05-20 11:28 EDT, Elio Maldonado Batiz
no flags Details | Diff
Part 3: limit the ecc support to suite-b only - spec file (10.72 KB, patch)
2013-05-20 11:41 EDT, Elio Maldonado Batiz
emaldona: review? (rrelyea)
Details | Diff
Part 1: limit the ecc support to suite-b only - libraries (2.30 KB, patch)
2013-05-20 11:53 EDT, Elio Maldonado Batiz
rrelyea: review+
Details | Diff
Part 2: limit the ecc support to suite-b only - test scripts (4.39 KB, patch)
2013-05-20 11:55 EDT, Elio Maldonado Batiz
emaldona: review? (rrelyea)
Details | Diff

  None (edit)
Description Elio Maldonado Batiz 2013-05-06 12:28:39 EDT
Description of problem:
The nss ECC code from upstream has traditionally beenstripped off to remove ecc and this code  needs to be included from now on. ECC will be supported on RHEL-6.5 and will also be part of the planned FIPS-140 revalidation.

Version-Release number of selected component (if applicable): 
6.5

How reproducible:
Always


Steps to Reproduce:
Unpack the upstream source tar ball and the one we use for the build and compare them as follows:
1. Download the upstrem sources from 
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_3_RTM/src/nss-3.14.3.tar.gz
2. rhpk clone nss --branch rhel-6.5; cd nss
3. cd nss; rhpkg sources
4. mkdir -p compare/upstream
5. mkdir -p compare/downstream
6. cd upstream; tar xzf ${PATH_TO}/nss-3.14.3.tar.gz
7. cd ../downstream; tar xjf ${PATH_TO}/nss-3.14.3-stripped.tar.bz
  (the embedded "-stripped" in the name is a clue
8. cd ..
9. Use you favorite diffing tool
   meld upstram downstream fora visual display or diff to save a textual file

Actual results:
downtream/nss-3.14.3mozilla/security/nss/freebl 
is missing the ecc related sources
which are present on
upntream/nss-3.14.3/mozilla/security/nss/freebl

Expected results:
downtream's contents is identical upstream's

A similar compare can be done using the nss-softokn package.

Additional info: 
1) This needs fixing on both the nss and nss-softoken packages.
2) This needs fixinf on rhel-5.10 also. We will do a FIPS=140 reval of nss for rhel-6.5 and a vendor affirmation on rhel-5.10 whic requires that the code inside the crypto boundary be the same on 5.10 as it is on 6.5.
Comment 1 Elio Maldonado Batiz 2013-05-06 12:39:37 EDT
Created attachment 744260 [details]
Required nss changes for ecc in patch format
Comment 2 Bob Relyea 2013-05-07 18:11:28 EDT
Comment on attachment 744260 [details]
Required nss changes for ecc in patch format

r+ assuming your are using the latest upstream sources that have no MORE_THAN_SUITE_B defines in nss proper.
Comment 3 Elio Maldonado Batiz 2013-05-07 18:50:01 EDT
I'm using using sources from NSS_3.14.3-RTM sources. Looking at the latest usptream sources it doesn't seem that the NSS_ECC_MORE_THAN_SUITE_B change has been made yet.
Comment 4 Elio Maldonado Batiz 2013-05-18 17:20:10 EDT
Upon close isnpection the changes to support only SUITE B have already been made upstream. Sone on the mucurila source repositories and some had already been made in the ole cvs source repository post nss-3.4.3.
Comment 5 Elio Maldonado Batiz 2013-05-20 11:27:13 EDT
Created attachment 750633 [details]
Part 1: add support ecc suite-b only - libraries

same patch as was submitted for rhel-5.10.
Comment 6 Elio Maldonado Batiz 2013-05-20 11:28:48 EDT
Created attachment 750634 [details]
Part 2: add support ecc suite-b only - test scripts

same patch as submitted for rhel-5.10.
Comment 7 Elio Maldonado Batiz 2013-05-20 11:31:11 EDT
Comment on attachment 750633 [details]
Part 1: add support ecc suite-b only - libraries

I attached the wrong patch.
Comment 8 Elio Maldonado Batiz 2013-05-20 11:41:56 EDT
Created attachment 750635 [details]
Part 3: limit the ecc support to suite-b only - spec file

Includes into one patch: 
1) patch for the libraries     --- same 5.10
2) patch for the tests sripts  --- same 5.10
3) changes to the spec file
Comment 9 Elio Maldonado Batiz 2013-05-20 11:45:53 EDT
Comment on attachment 750635 [details]
Part 3: limit the ecc support to suite-b only - spec file

When I click on diff it doesn't show the 1) libraries patch nor the 2) test patches, only the spec file changes. I'll submit those separately.
Comment 10 Elio Maldonado Batiz 2013-05-20 11:53:40 EDT
Created attachment 750639 [details]
Part 1: limit the ecc support to suite-b only - libraries
Comment 11 Elio Maldonado Batiz 2013-05-20 11:55:29 EDT
Created attachment 750640 [details]
Part 2: limit the ecc support to suite-b only - test scripts
Comment 12 Bob Relyea 2013-05-20 13:23:44 EDT
Comment on attachment 750639 [details]
Part 1: limit the ecc support to suite-b only - libraries

r+ rrelyea
Comment 18 errata-xmlrpc 2013-11-21 01:14:01 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1558.html

Note You need to log in before you can comment on or make changes to this bug.