[gnutls-devel] GnuTLS | DES-CBC bag is decryptable under FIPS (#1392)

[Read-only notification of GnuTLS library development activities]

Alexander Sosedkin created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1392



```
$ fips-mode-setup --check
FIPS mode is enabled.
 
$ wget -q 'https://github.com/redhat-qe-security/keyfile-corpus/raw/master/rsa(2048,sha256),cert&key(pbeWithMD5AndDES-CBC,salt(8),iter(2048)),mac(sha1,salt(8),iter(2048)),pass(ascii).p12'
 
$ certtool --p12-info --inder --infile 'rsa(2048,sha256),cert&key(pbeWithMD5AndDES-CBC,salt(8),iter(2048)),mac(sha1,salt(8),iter(2048)),pass(ascii).p12' --password 'Red Hat Enterprise Linux 7.4'
MAC info:
        MAC: SHA1 (1.3.14.3.2.26)
        Salt: 052281f5da42b212
        Salt size: 8
        Iteration count: 2048
 
BAG #0
        Type: Encrypted
        Cipher: DES-CBC
        Schema: PBES1-DES-CBC-MD5 (1.2.840.113549.1.5.3)
        Salt:
        Salt size: 0
        Iteration count: 2048
 
        Decrypting...
        Elements: 1
        Type: Certificate
        Friendly name: localhost
        Key ID: E3:76:B4:62:05:2B:2F:D4:B9:12:5B:B0:EA:E0:4F:10:C8:C0:C5:B0
-----BEGIN CERTIFICATE-----
MIIC+zCCAeOgAwIBAgIJALcX+trIX5ynMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
BAMMCWxvY2FsaG9zdDAeFw0xNzAzMTYxMTAzMTBaFw0xNzA0MTUxMTAzMTBaMBQx
EjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBANykRgfq8TW1B6NNUaR3cG0OW0nzy1RW74k4pfg/3CxOh/JBk6YX9TJ2GJ2j
mE9el3mMgItrCAv6cduWvYkl7H/B/iLpLO/8ie5bwL6IDC/s107uxTMBJwE83gwt
jE1bgJ02rf602BKqTB9COuCLQAM46u3liukOPOAFhiF6dGSOX7wGm36EqS11EZiO
UHRLJeIV6ruLf35Sme26Lzefd1Pj6J5T/vYlrd54QcBqRRL3jBw2j4DUphG4LroR
eVCNMiYTx9+kqlqHrz4NWNFsms7r6LYTA1Q3KcwjuDVq7aznVKXRxnI09e919Txk
veYoK+E7e4M+X4o/Mc41IUZguAkCAwEAAaNQME4wHQYDVR0OBBYEFJ2pF/DIt1Gf
DHgXypnHtptyeghoMB8GA1UdIwQYMBaAFJ2pF/DIt1GfDHgXypnHtptyeghoMAwG
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFO29MmqGIBwP4F3ehNlIBnv
pSZiLraBN9HKOCJKOJxSJ69KL4FFV/pqXegdXDHebdx3YfRV0tC+nF0izUtNC+kO
8XKU/sFwwMG4bP+rU1cl2mZZK8vVWA0mippphOe3Jwr/cZWK5rMja6OIGsIQieWx
Ot5vBruOYOfoNAOIms7ezEKCIhgi7lhT06Voe8DlVM2/dxmyIgxenl0i45WRVd9u
4C+a2HQULDbBS2GdqHkyD8guY6HFLkeDZrymKZDYDsH6P+qUqK97/WhFqgTCSTQy
XcMXQPzfo2bP7KqY/WvwAbekZ4psv22fRs3g6NPxQvMSpqoRZ0sHHvnM40NoBWQ=
-----END CERTIFICATE-----
 
BAG #1
        Elements: 1
        Type: PKCS #8 Encrypted key
        PKCS #8 information:
                Cipher: DES-CBC
                Schema: PBES1-DES-CBC-MD5 (1.2.840.113549.1.5.3)
                Salt:
                Salt size: 0
                Iteration count: 2048
 
        Friendly name: localhost
        Key ID: E3:76:B4:62:05:2B:2F:D4:B9:12:5B:B0:EA:E0:4F:10:C8:C0:C5:B0
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIE6TAbBgkqhkiG9w0BBQMwDgQIxOUh2dwiYk8CAggABIIEyG7fO0wGc6GveVQX
1sHnirPDSxMF39c9Aj4tIK/1x4eul+KGwQ4hZIDgNq4nwp+BHG8Cna5uTi/mpy/v
XOeWFlf2kicPMmJkR4hLiMij+rSuAox28ChFNIvn2y1zyTP6MTXIDrNg3WQ2hFR6
tnO/Lhs+YHA5Zt386lN3DH/SxarRpCCaS6TOcRCfuuEdQNROMPNaPO1AekssjOcF
LOCqg2Xi2pc4ZsTT2066OVjFKaeRV/Libg7buTx2l0cR+B+0GovUm42wvwNitGq3
QvkSjiMiQ+OFt81R7xcQmGHbz2CF22FMjYpkjbrtC5Rc1dqW1NA1Y83eoYhJzJhR
x4W/Y8BvOaPDfCSvBXDDFHr8nOqscs9xxKCpFb6Vh4TlytrbcWKc8bNurNLxfEwS
89LXif+jphZ12A3biqjNNQHXMk/TdA7vAb/Xk7xpg7R8LBpV34+mwX+7k0tXARDq
Ck377vijd4mvHX65ol8FQuC3ggkeZrk3lmj8FUC4nSzacvS3kXQNr8MtblyvhhJE
4FerJdYPNWsnDxqimaUI+c+bjbotaDTUWeJcxJdAki0brgPCeWcak3oCEBNWuLu8
BsMAx6Iuw7ECcGKitaIc+zkxokcJZe4rjSOc9bMXuTOpkukpzZ9JZVDh+z/n4ALN
uvUbA2/alAVoWZO/OL4BST65uUZxM7nOHR63tTd5HgroxkZHlOlG4p919kqe7s1S
XE8nmjIa0ruFHqHg/FjiwL4rUTcg3OLeo7MVUQfqjI0rSL1XKWDgrpWEcVp5pPuu
NtDH6gQO0t5t3JBxGVYiZ4A3rLIZeIavz51A/2OwNFHKxXdJGgskv/Xk4vsFL/EB
VCThi2c5S2z/jQtP493faKSSHGsK9cJXfOmTv24YqisO/JYQg1/d7srCcYkgmmFh
LKJMTYdARuGFs2UtcUubqve/UJp4Zg6FuG51Ga47qJBwS79SqKBeXeC23vf3USn1
szInO5WBSCKinFmA9AXnuFDS2gxDi/fJgq9untjg+cqonmPd4pn1vHCibICoyO8V
qzELqXasmjSimzzC8WQkEfHln/YqiPonYtvW9Iqf/gjaf1XDwCYSzclIzHT+/E7q
j+kY1iJiJU65vvjUmdB+T7h4IqEiAwZhNiqe1RQp7QWThwdefL6THZGEudQarj3z
J73buBtY2zf8GfB2b2lmFYzp6MjJQpnT5WLnxBQl2l8/r6ms57ds+avC50CXWf/J
Z4I6cN8Q0RKax2Y7nUcNXqrzIHk25cGMn1HPY02F/h9h70JsxrKBHJEFBXXLnZ21
72NjT8fGSUgoQ0Qh9epOfaKfQqRiquYkMHiT7ksnIuHF+4x4JYze2HVSYs36Wu3y
l7/8cZmH2f356trgcycOLve32xZkx6edcbIWHNWNW2gXsP4LmGxtP58uFtwTxN6v
RUmzb9XOWfBCsk4wGF3OGfQpM6pWulxMtjXr8URpyUquCR3E8hzBHg/UJPSkQBIb
WSmrZHQH1zRoK7RxPWqjWD5s99fZlPmRTmirVfKynq/5dbsCNIdPPW+qwhGHLlHX
jAQwxW5sqEE6m2ENmECrHm5mHjmAUShlu/x55rQuKrQvWwGZXCVOH3NKt8rum/tg
Iw3Jj8IrAn8/Do/4vQ==
-----END ENCRYPTED PRIVATE KEY-----
```

I expect DES-CBC bag decryption to fail with `bag_decrypt: An algorithm that is not enabled was negotiated.`

Related: https://gitlab.com/gnutls/gnutls/-/merge_requests/1626

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1392
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20220804/17e523a2/attachment.html>