freeipa

#7243 Implement OTP and RADIUS authentication in FIPS
Closed: fixed Opened by stlaz.

Closed: fixed
Reopen Issue

RADIUS, which is being used internally by ipa-otpd daemon for OTP authentication, uses MD5 checksums during the authentication process.

A possible solution to this would be to implement EAP for RADIUS so that MD5 does not have to be used.

Metadata Update from @stlaz:
- Issue tagged with: rfe

Metadata Update from @pvoborni:
- Issue priority set to: normal
- Issue set to the milestone: Future Releases

This BZ could be linked with https://bugzilla.redhat.com/show_bug.cgi?id=1544679 which has further context. Note that thanks to https://github.com/freeipa/freeipa/pull/1621 it seems that we can make OTP&Radius "work in FIPS mode", though not being necessarily FIPS compliant - see https://github.com/freeipa/freeipa/pull/1621 for details.

master:

  • c9c58f2d35dfb8a6d1e187d260013812dcfdfd90 Fix OTP validation in FIPS mode
  • a01a24ce5aded934095ea428d539ca30850f72e3 Increase the default token key size
  • d498d7272d8de3e24afc442a3b001518fd98ebff Revert "Don't allow OTP or RADIUS in FIPS mode"

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • acb59fcbb65a9c19925fe213c45499a6b959eb9c Fix OTP validation in FIPS mode
  • 6d4ce796c9ddcba5b9ac777d15155f28aac609f3 Increase the default token key size
  • 1df9767df811963d6cab52a18c62ea54ed275125 Revert "Don't allow OTP or RADIUS in FIPS mode"

ipa-4-5:

  • 52c59982f03936d150b0ac468c8e7df8a12168b5 Fix OTP validation in FIPS mode
  • c7d383c124db7f405d03a4b00f21560c9272557c Increase the default token key size
  • 98efe7cf6a561313b5f7f8a7c2085d81739a4bb4 Revert "Don't allow OTP or RADIUS in FIPS mode"
Metadata
None

rfe

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.