Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-44995

Deprecate DSA and SEED in NSS in RHEL 10

XMLWordPrintable

    • None
    • Moderate
    • 1
    • sst_security_crypto
    • ssg_security
    • 24
    • 27
    • 3
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto24Q3
    • Deprecated Functionality
    • Hide
      .DSA and SEED algorithms have been deprecated in NSS

      The DSA signing algorithm, which was created by NIST and is now completely deprecated by NIST, is deprecated in the Network Security Services (NSS) cryptographic library. You can instead use algorithms such as RSA, ECDSA, SHB-DSA, ML-DSA, and FN-DSA.

      The SEED algorithm, which was created by the Korea Information Security Agency (KISA) and has been previously disabled upstream, is deprecated in the Network Security Services (NSS) cryptographic library.
      Show
      .DSA and SEED algorithms have been deprecated in NSS The DSA signing algorithm, which was created by NIST and is now completely deprecated by NIST, is deprecated in the Network Security Services (NSS) cryptographic library. You can instead use algorithms such as RSA, ECDSA, SHB-DSA, ML-DSA, and FN-DSA. The SEED algorithm, which was created by the Korea Information Security Agency (KISA) and has been previously disabled upstream, is deprecated in the Network Security Services (NSS) cryptographic library.
    • In Progress
    • All
    • None

      Several old algorithms that have little to no use and are disabled by default need to be disabled completely:

      1) SEED, the former national cipher of Korea. This has been disabled upstream for several years. A single #define in the SPEC file will disable it for NSS.
      2) DSA, this is a signing aglorithm, created by NIST and now completely deprecated by NIST in favor of RSA and ECDSA (and eventually SHB-DSA, ML-DSA and FN-DSA). This requires disabling CKM_DSA_XXX in PKCS #11 (under a #define) and including that #define in the SPEC. It will also require dropping or modifying tests in NSS upstream tests of DSA.

      NOTE: DSA parameter gen is used extensively in testing of weak Diffie-Helman code (mostly to make sure we properly reject weak Diffie-Helman by default, so it will stay until we deprecate DH.

            rrelyea@redhat.com Robert Relyea
            rrelyea@redhat.com Robert Relyea
            Robert Relyea
            Robert Relyea Robert Relyea
            Ondrej Moris Ondrej Moris
            Jan Fiala Jan Fiala
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated: