FIPS: disable DSA for FIPS
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• gniibe
	Dec 2 2021, 1:12 AM

Description

While DSA support is out of support for our scope of FIPS support (to get certified), I'm not sure if it's good to set .fips = 0 in DSA module.

My concern is that, the possibility, some other party would want to get certified including DSA module.

To track things, I created this ticket.

rC libgcrypt
	rCea362090fc11 fips: Disable DSA in FIPS mode.

Mentioned In: T5512: Implement service indicators
Mentioned Here: rCe96980022e5e: Properly enforce disablement in other pubkey API

This is the patch from @Jakuje

libgcrypt-fips-DSA-disable.patch1 KBDownload

I have been convinced disabling DSA makes more sense.

• gniibe changed the task status from Open to Testing.Dec 8 2021, 1:54 AM

• gniibe added a project: Restricted Project.

It turns out together with rCe96980022e5e some tests are failing in FIPS mode. The attached patch should handle the failures.

---removed outdated patch--

Sorry for the noise. There were couple of other places which I missed initially and which are covered in the v2 patch which follows:

libgcrypt-dsa-tests.patch14 KBDownload

Thank you, applied.

• gniibe closed this task as Resolved.Feb 2 2022, 1:21 AM

• gniibe removed a project: Restricted Project.