Maniphest T6191

FIPS: Supporting running FIPS enabled machine
Open, WishlistPublic
Actions

Assigned To

None

Authored By

	• gniibe
	Sep 7 2022, 4:46 AM

Tags

Subscribers

Description

This ticket is to collect possible issues to be fixed for running GnuPG on FIPS enabled machine.

Related Objects
Search...

		Status	Assigned	Task
		Open	None	T6191 FIPS: Supporting running FIPS enabled machine
		Open	None	T5930 Use the FIPS-compatible digest&sign API
		Resolved	• gniibe	T5964 gnupg should use the KDFs implemented in libgcrypt

Event Timeline

• gniibe triaged this task as Wishlist priority.Sep 7 2022, 4:46 AM

• gniibe created this task.

• gniibe added projects: gnupg (gpg23), FIPS.

• gniibe added subtasks: T5930: Use the FIPS-compatible digest&sign API, T5964: gnupg should use the KDFs implemented in libgcrypt.Sep 7 2022, 4:48 AM

Here is a list of possible issues:

OpenPGP format for encrypted secret keys
- S2K uses SHA-1
gpg-agent private key format
- using SHA-1 for KDF
- using OCB for encryption

pmgdeb mentioned this in T6291: FIPS: dirmngr CRL hash uses MD5.Nov 29 2022, 2:13 PM

• werner added a project: gnupg24.Dec 13 2022, 11:21 AM

• werner removed a project: gnupg (gpg23).Jan 19 2023, 4:45 PM

• gniibe changed the status of subtask T5964: gnupg should use the KDFs implemented in libgcrypt from Open to Testing.May 26 2025, 6:32 AM

• gniibe closed subtask T5964: gnupg should use the KDFs implemented in libgcrypt as Resolved.Jun 17 2025, 2:38 AM

• gniibe mentioned this in Unknown Object (Maniphest Task).Mar 23 2026, 3:43 AM