[ssh_x509] PKIX-SSH, OpenSSL 3 API, and FIPS mode

[ssh_x509 at roumenpetrov.info]

Hello,

На 11.02.26 г. в 20:33, ssh_x509 at roumenpetrov.info написа:
> Hello,
[SNIP]
> C) issues

> a) dsa
[SNIP]
> In consequence SSH DSA algorithms are not enabled when program code detect loaded fips provider.
[SNIP]

Well for DSA it is easy to exclude. Issue is that fips provider returns as available algorithms (digests, mac, cipher) but operations then fail.
In conclusion when a program uses OpenSSL 3* should consider 3 levels:
1) default provider
2) fips provider
3) fips provider in fips mode

Note that new case "fips provider".
Before it was only cryptographic library either in normal or fips mode.
The new case increase complexity in support.


> b) FIPS flags
[SNIP]
> These flags has to effect even if FIPS provider is run in fips mode.
> It seems to me this is a regression.
[SNIP]

Actually this is not regression. Depending on "context"/"parameters" operation may fail in FIPS mode.
In FIPS 1.2 and 2.0 modules fips flag was used to exclude MD5 digest.
As replacement, in OpenSSL 3* is used additional "exclude" check if fips provider is available.
Remark: the same check is used for DSA keys as well and .

Note difference: fips provider and fips mode.


> c) unit-tests and RSA key size
> This is not new FIPS requirement - the minimum RSA key size is 2048.
[SNIP]

Existing code will not be changed.
It is not only about RSA key size but also used of SHA1 signatures.
OpenSSL documentation is not clear.
RedHat documentation clarify that FIPS allows SHA1 to be used is verification.
Unlike OpenSSL, RedHat disables the use of SHA1 entirely.


> d) 3des-cbc
[SNIP]

The same as MD5 this cipher will be disabled if fips provider is activated.


=====

About RSA+SHA1 - next steps.
Unlike DSA, ssh specifications allows use of RSA keys with different size and SHA2 signatures.

Issue is between "ssh -Q key" query key command as according documentation it returns key types.
Design is misleading as query returns public key algorithms!
Also, due to its flawed design, this query does not return the rsa-sha2-512 and rsa-sha2-256 algorithms.

With other words key type RSA is allowed but public key algorithms ssh-rsa, x509v3-ssh-rsa, and
x509v3-sign-rsa are not allowed when is used fips provider.

In the future, algorithms that use rsa with sha1 will be unconditionally excluded from defaults.
Now this will be done only if fips provider is active.

For compatibility "key" query will return it flawed output.

Perhaps, a new query will be used in regression tests.
I plan these tests to pass when fips provider is active.


Regards,
Roumen