Description

Libgcrypt runs self-check including hmac based binary verification outside FIPS mode and breaks keepassxc. See SUSE bug report [0] and the patch submitted in the pull request [1].

[0] https://bugzilla.opensuse.org/show_bug.cgi?id=1117355
[1] https://github.com/gpg/libgcrypt/pull/5

Details

External Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1117355
Version: libgcrypt-1.8.4

Revisions and Commits

rC libgcrypt
	rCad133fc79757 fips: Only test check_binary_integrity when fips_mode is enabled.

Related Objects
Search...

		Status	Assigned	Task
		Resolved	• gniibe	T4274 Fail selftests when checksum file is missing in FIPS mode only
		Resolved	• werner	T4294 Release Libgcrypt 1.9.0

Event Timeline

pmgdeb created this task.Nov 29 2018, 11:34 AM

• werner added a project: libgcrypt.Nov 29 2018, 2:55 PM

Adding the patch here.

libgcrypt-binary_integrity_in_non-FIPS.patch893 BDownload

• werner added a parent task: T4294: Release Libgcrypt 1.9.0.Dec 17 2018, 10:11 AM

Thanks for your report.
I think that your patch is too generous to run HMAC even if fips_mode is not enabled; Simply, we can stop calling integrity check when fips_mode is not active.