dogtagpki

#2664 PKCS12: upgrade to at least AES and SHA2 (FIPS)
Closed: fixed Opened by mharmsen.

Closed: fixed
Reopen Issue

This bug should address upgrade of the crypto and hashing mechanisms
implementing PKCS12. It will involve JSS, and/or CS server, and/or client(s)
when the system is in FIPS mode.

Metadata Update from @mharmsen:
- Custom field blockedby adjusted to https://pagure.io/dogtagpki/issue/2610
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to Community
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field type adjusted to defect
- Custom field version adjusted to ''
- Issue assigned to ftweedal
- Issue priority set to: critical
- Issue set to the milestone: 10.4

Hi Christina,

Ade has reviewed my PKCS #12 AES patches for CC effort (thanks Ade!)
We have one main area where we need your feedback (https://pagure.io/dogtagpki/issue/2610).

The KRA PKCS #12 recovery process for encrypted (cf. wrapped) keys
previously performed the encryption and assembled the
EncryptedPrivateKeyInfo structure in a rather "manual" way (~80
LOC). In my patch to convert this code path to use AES encrypted, I
take an alternative (and much fewer LOC) approach: importing the
private key to the internal key storage token, as a temporary
key, and then invoking the same routine as is used for the wrapped
key case.

Our question: is this fine to do when the system is in FIPS mode?
The assumption is that the internal crypto token is always available
and that it can do raw (unencrypted) private key import, and
wrapping private keys to a symmetric key, while in FIPS mode. We
just need to check this assumption.

The gerrit review of the patch involved is here:
https://review.gerrithub.io/#/c/359027/

Thanks,
Fraser

Metadata Update from @mharmsen:
- Custom field blockedby reset (from https://pagure.io/dogtagpki/issue/2610)

Metadata Update from @mharmsen:
- Custom field blockedby adjusted to https://pagure.io/dogtagpki/issue/2610

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1446786

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1446786

Issue linked to Bugzilla: Bug 1446786

Upstream JSS Check-ins:

cfu checked-in the following changes provided by ftweedal:

changeset:   2204:87dca07f7529
tag:         tip
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:56:04 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2203:b3b653faef84
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:53:36 2017 -0700
summary:     bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2202:0b8a6e84b6c7
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:50:21 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2201:d39e9b373798
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:32:32 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2200:890216599f21
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:21:22 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2199:bada1409d2bb
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:15:29 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -
changeset:   2198:3629b598a9ce
user:        Fraser Tweedale<ftweedale@redhat.com>
date:        Fri Sep 08 11:09:23 2017 -0700
summary:     Bug 1370778 PBE and padded block cipher enhancements and fixes -

Upstream pki check-in:

commit ae97f21bf8d2ec83a410127872dd196a46f9dbbd
Author: Fraser Tweedale <ftweedal@redhat.com>
Date:   Thu Apr 6 13:27:56 2017 +1000
    KRA: use AES in PKCS #12 recovery for encrypted keys

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed

Metadata Update from @ftweedal:
- Issue set to the milestone: 10.4.10 (was: 10.4)

PKI seems to be failing to build because of commit ae97f21bf8d2ec83a410127872dd196a46f9dbbd.

[ 29%] Built target pki-server-test-classes
com/netscape/kra/RecoveryService.java:667: error: cannot find symbol
                epki = EncryptedPrivateKeyInfo.createPBES2(
                                              ^
  symbol:   method createPBES2(int,int,EncryptionAlgorithm,Password,PasswordConverter,PrivateKeyInfo)
  location: class EncryptedPrivateKeyInfo
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
1 error

Is it because of dependency on the new JSS code? If that's the case we should provide a COPR build for the new JSS, or wait until the official JSS build is available before checking in the PKI changes to master. Also, the required JSS version in the spec file needs to be updated.

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.4.8-6.fc27

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2784

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
defect
General
''
''
Community
''
''
''
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.