Re: mutual authentication fails when FIPS enabled

Thanks for the information. Do you mean the line

RSA_meth_set_flags(ops, RSA_FLAG_FIPS_METHOD);

will allow the inclusion of non-FIPS compliant algorithms?

  Does this mean I should not be using LIBP11 if I want my code to be 
FIPS-compliant?


Thanks,
George


On 2021-01-27 2:54 a.m., Petr Pisar wrote:
> V Tue, Jan 26, 2021 at 11:25:13PM -0500, George napsal(a):
>>    When I attempt to do mutual authentication with a smart card, it
>> fails. The problem appears to be related to enabling FIPS. I am using
>> OpenSSL 1.0.2u(with FIPS) and LIBP11 0.4.11.
>> The found the following Red Hat bug report, which describes the exact
>> same problem I am seeing:
>> https://bugzilla.redhat.com/show_bug.cgi?id=1827535
>>
>> Is this a known LIBP11 bug? Will it be fixed in future versions of LIBP11?
>>
>> A suggested workaround in the above link is to make a change in the file
>> libp11-libp11-0.4.11\src\p11_rsa.c:
>> Change the line
>>
>>      RSA_meth_set_flags(ops, 0);
>>
>> to
>>
>>      RSA_meth_set_flags(ops, RSA_FLAG_FIPS_METHOD);
>>
>>
>> Once I did this, it fixed my problem. Is this a proper fix?
>>
> The flag disables exclusion of FIPS noncompliant algorithms (e.g. MD5) from
> the OpenSSL routines and leaves the compliance to the application.
>
> In other words your system is not FIPS compliant anymore unless you get FIPS
> certification for your patched libp11.
>
> The questions are:
>
> Do you really need FIPS compliance? If not, then do not enable FIPS mode.
>
> Does the mutual authentication protocol manadate use of noncompliant
> algorithms? If yes, then it's broken by desisign and you simply cannot use the
> authentication in FIPS mode. Otherwise libp11 and your smart card should use
> a different, compliant algorithm instead.
>
> Is smart card mutual authentication subject of FIPS compliance? Technically
> you can use non-compliant algorithms for non-cryprographical purposes even in
> FIPS mode. E.g. MD5 for hash tables or data identification. But in my opinion
> authentication falls into a FIPS realm, so this not the case. You should talk
> to your security auditor about this.
>
> -- Petr
>
>
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel