What were you trying to do that didn't work?
Enable mlkem768x25519-sha256 in crypto-policies.
What is the impact of this issue to you?
Blocks me from enabling mlkem768x25519-sha256 in FIPS even though it should work with kryoptic.
It's worse for 9: can't enable it in 9 PQ for fears that someone might be driving FIPS:PQ.
Please provide the package NVR for which the bug is seen:
openssh-9.9p1-19.el10
How reproducible is this bug?:
reliably
Steps to reproduce
- be in FIPS mode
- update-crypto-policies --set FIPS:TEST-PQ
Expected results
the algorithm is skipped, connections happen with a different kex, sshd doesn't just crash
Actual results
your ssh complains that "mlkem768x25519-sha256" is not allowed in FIPS mode, and your sshd is down
- blocks
-
RHEL-151580 openssh explodes with FIPS:PQ in FIPS [rhel-9]
-
- Planning
-