Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-103983

nss stopped recognizing mlkem768secp256r1

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • No
    • Moderate
    • 1
    • rhel-security-crypto
    • 24
    • 26
    • 0.5
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • Crypto25August
    • Hide

      The following existing NSS tests start passing again:

      • -/Interoperability/Hybrid-ML-KEM-in-TLS
      • -/Interoperability/ML-KEM-interoperability-with-GnuTLS
      • -/Interoperability/ML-KEM-interoperability-with-OpenSSL
      Show
      The following existing NSS tests start passing again: -/Interoperability/Hybrid-ML-KEM-in-TLS -/Interoperability/ML-KEM-interoperability-with-GnuTLS -/Interoperability/ML-KEM-interoperability-with-OpenSSL
    • None
    • Not Needed
    • Automated
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      nss-3.112.0-1.el10_0 has regressed: NSS-POLICY-FAIL allow: unknown identifier: mlkem768secp256r1

      example config enabling both ML-DSA and ML-KEM
      library=p11-kit-proxy.so
name=p11-kit-proxy


library=
name=Policy
NSS=flags=policyOnly,moduleDB
config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:mlkem768x25519:mlkem768secp256r1:CURVE25519:SECP256R1:SECP521R1:SECP384R1:aes256-gcm/ssl:chacha20-poly1305/ssl:aes256-cbc:aes128-gcm/ssl:aes128-cbc:des-ede3-cbc/pkcs12-legacy,smime:rc2/pkcs12-legacy,smime-legacy:rc2-40-cbc/pkcs12-legacy,smime-legacy:rc2-64-cbc/pkcs12-legacy,smime-legacy:rc2-128-cbc/pkcs12-legacy,smime-legacy:SHA256:SHA384:SHA512:SHA3-256:SHA3-384:SHA3-512:SHA224:SHA3-224:SHA1/pkcs12-legacy:ECDHE-RSA/ssl-key-exchange:ECDHE-ECDSA/ssl-key-exchange:DHE-RSA/ssl-key-exchange:RSA-PKCS/smime-key-exchange:RSA-OAEP/smime-key-exchange:DH/smime-key-exchange:ECDH/smime-key-exchange:ML-DSA-44:ML-DSA-65:ML-DSA-87:ECDSA:ED25519:RSA-PSS:RSA-PKCS:tls-version-min=tls1.2:dtls-version-min=dtls1.2:DH-MIN=2048:DSA-MIN=2048:RSA-MIN=2048"
      before, nss-3.101.0-13.el10.x86_64
      [root@rhel-10-1-20250626-1 ~]# nss-policy-check -f identifier -f value cfg
NSS-POLICY-FAIL allow: unknown identifier: ML-DSA-44
NSS-POLICY-FAIL allow: unknown identifier: ML-DSA-65
NSS-POLICY-FAIL allow: unknown identifier: ML-DSA-87
...
      after, nss-3.112.0-1.el10_0.x86_64
      [root@rhel-10-1-20250626-1 ~]# nss-policy-check -f identifier -f value cfg
NSS-POLICY-FAIL allow: unknown identifier: mlkem768secp256r1
...

              rrelyea Robert Relyea
              asosedki@redhat.com Alexander Sosedkin
              Robert Relyea Robert Relyea
              Ondrej Moris Ondrej Moris
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: