Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-21125

HMACS-SHA1 enctype is missing in krb5.config when using FIPS:OSPP

XMLWordPrintable

    • None
    • None
    • rhel-sst-security-crypto
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • None

      What were you trying to do that didn't work?

      After 

      update-crypto-policies --set FIPS:OSPP

      /etc/crypto-policies/back-ends/krb5.config does not have HMAC-SHA1 enctypes like

      aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96

      Please provide the package NVR for which bug is seen:

      crypto-policies-20230731-1.git3177e06.el8

      How reproducible:

      Always

      Steps to reproduce

      1. update-crypto-policies --set FIPS:OSPP
      2. grep -i 'hmac-sha1' /etc/crypto-policies/back-ends/krb5.config

      Expected results

      permitted_enctypes = aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96

      Actual results

      permitted_enctypes = aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128

              asosedki@redhat.com Alexander Sosedkin
              rhn-support-dchen Ding Yi Chen
              Alexander Sosedkin Alexander Sosedkin
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: