Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-76526

openssl Ciphersuites are controlled by ciphers crypto-policy option alone

XMLWordPrintable

    • crypto-policies-20250128-1.git22421d3.el10
    • No
    • Low
    • 1
    • rhel-sst-security-crypto
    • ssg_security
    • 26
    • 0.2
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto25Q1
    • Bug Fix
    • Hide
      Cause/Consequence: due to mapping Ciphersuites option of openssl to ciphers crypto-policies option alone, applying custom crypto-policies could leave certain TLS 1.3 Ciphersuites enabled even if their hashes/MACs were disabled
      Fix: crypto-policies takes more algorithms into account when deciding whether to enable a ciphersuite
      Result: users of custom crypto-policies might have openssl refusing to negotiate some of the previously enabled TLS 1.3 ciphersuites in better accordance to the system configuration
      Show
      Cause/Consequence: due to mapping Ciphersuites option of openssl to ciphers crypto-policies option alone, applying custom crypto-policies could leave certain TLS 1.3 Ciphersuites enabled even if their hashes/MACs were disabled Fix: crypto-policies takes more algorithms into account when deciding whether to enable a ciphersuite Result: users of custom crypto-policies might have openssl refusing to negotiate some of the previously enabled TLS 1.3 ciphersuites in better accordance to the system configuration
    • Proposed
    • None

      Currently, openssl TLS 1.3 specific Ciphersuites option values
      are controlled by the ciphers crypto-policy option alone,
      without taking into account that security of a ciphersuite relies on use multiple algorithms,
      such as hash functions and MACs in addition to the ciphers,
      and distrusting them should distrust the entire ciphersuite as well.

      This ticket is a request to backport this functionality from Fedora
      (https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/222).

      The impact of the change on the existing policies should be next to nonexistent.
      Out of the policies we ship,
      FIPS:OSPP will have all Ciphersuites disabled due to OSPP subpolicy disabling TLS 1.3 altogether,
      the rest should see no change.

              asosedki@redhat.com Alexander Sosedkin
              asosedki@redhat.com Alexander Sosedkin
              Alexander Sosedkin Alexander Sosedkin
              Ondrej Moris Ondrej Moris
              Mirek Jahoda Mirek Jahoda
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: