FIPS restrictions bypass

[fmulero]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

Having a Linux FIPS compliance system, just download and install latest version of PowerShell following these steps:

mkdir -p /app
mkdir -p /opt/powershell/bin
mkdir -p /tmp/pkg/cache/ ; cd /tmp/pkg/cache/ || exit 1 ;
curl -SsLf "https://github.com/PowerShell/PowerShell/releases/download/v7.5.3/powershell-7.5.3-linux-arm64.tar.gz" -O 
tar -zxf "powershell-7.5.3-linux-arm64.tar.gz" -C /opt/powershell/bin --no-same-owner
chmod +x "/opt/powershell/bin/pwsh"
rm -rf "powershell-7.5.3-linux-arm64.tar.gz"
export PS_INSTALL_FOLDER="/opt/powershell/bin"

Expected behavior

An error occurs when I try to use forbidden algorithms.

Actual behavior

root [ ~ ]# openssl version
OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)
root [ ~ ]# openssl md5 /etc/ssl/openssl.cnf
Error setting digest
20C06785FFFF0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (MD5 : 102), Properties ()
20C06785FFFF0000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:crypto/evp/digest.c:254:
root [ ~ ]# pwsh -C "Get-FileHash -Path /etc/ssl/openssl.cnf -Algorithm MD5"

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
MD5             62FBD4A7041201E791A582AF31E7BB14                                       /etc/ssl/openssl.cnf

root [ ~ ]# echo $OPENSSL_FIPS
yes

Error details

Environment data

PowerShell 7.5.3
PS /app> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.5.3
PSEdition                      Core
GitCommitId                    7.5.3
OS                             VMware Photon OS/Linux
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

No response

[fmulero]

Not sure if I am missing any configuration in PowerShell side

[eabase]

Looks like you're confused (or managed to confuse me) as to what is supposed to happen.

An error occurs when I try to use forbidden algorithms.

Why do you think there should be an error for calculating MD5?
("Using" and calculating, is not the same thing!)

[fmulero]

Sorry @eabase but I don't understand what you mean. Please amend me if I am wrong.

According to this documentation, .NET relies on system libraries for cryptographic operations. I have assumed the same approach for PowerShell, because official documentation says that libssl3 libraries are required in Linux systems. Joining all, PowerShell should fail if we use any forbidden algorithm (like in the example with openssl).

After following the installation steps described above, I've just figured out there is no real dependency with libssl or libcrypto:

# find . -name "*.so" -exec echo {} \; -exec ldd {} \;           
./libmscordbi.so
        linux-vdso.so.1 (0x0000ffff871e9000)
        libmscordaccore.so => /opt/powershell/bin/./libmscordaccore.so (0x0000ffff86c00000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffff86800000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffff86f20000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffff86bc0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff86650000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff871ac000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffff86ef0000)
        librt.so.1 => /usr/lib/librt.so.1 (0x0000ffff86b90000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffff86b60000)
./libcoreclrtraceptprovider.so
        linux-vdso.so.1 (0x0000ffffbe37e000)
        liblttng-ust.so.0 => not found
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffbe000000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffbdf50000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffbdf10000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffbdd60000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffbe341000)
./libhostpolicy.so
        linux-vdso.so.1 (0x0000ffffb99ea000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffffb9900000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffffb98d0000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffb9600000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffb9550000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffb9890000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffb93a0000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffb99ad000)
./libcoreclr.so
        linux-vdso.so.1 (0x0000ffff8e83a000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffff8e7c0000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffff8e790000)
        librt.so.1 => /usr/lib/librt.so.1 (0x0000ffff8e760000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffff8dfd0000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffff8dc00000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffff8df20000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff8da50000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff8e7fd000)
./libSystem.Globalization.Native.so
        linux-vdso.so.1 (0x0000ffff8e6b9000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffff8e600000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff8e450000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff8e67c000)
./libclrgcexp.so
        linux-vdso.so.1 (0x0000ffff9e74b000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffff9e200000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffff9e550000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffff9e510000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff9e050000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff9e70e000)
./libSystem.Net.Security.Native.so
        linux-vdso.so.1 (0x0000ffffae186000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffffae0e0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffadf30000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffae149000)
./libhostfxr.so
        linux-vdso.so.1 (0x0000ffffbaedd000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffffbadf0000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffffbadc0000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffbaa00000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffbad10000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffbacd0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffba850000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffbaea0000)
./libclrgc.so
        linux-vdso.so.1 (0x0000ffffa3246000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffa2e00000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffa3060000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffa2dc0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffa2c10000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffa3209000)
./libSystem.Security.Cryptography.Native.OpenSsl.so
        linux-vdso.so.1 (0x0000ffffa42e2000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffffa4210000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffffa41e0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffa4030000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffa42a5000)
./libmscordaccore.so
        linux-vdso.so.1 (0x0000ffff975c1000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffff97550000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffff97520000)
        librt.so.1 => /usr/lib/librt.so.1 (0x0000ffff974f0000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffff971d0000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffff96e00000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffff97120000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff96c50000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff97584000)
./libpsl-native.so
        linux-vdso.so.1 (0x0000ffffb92ad000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffb9000000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffb8fc0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffb8e10000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffb9270000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffb8d60000)
./libSystem.IO.Compression.Native.so
        linux-vdso.so.1 (0x0000ffffbf20f000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffbef10000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffbf1d2000)
./libSystem.Native.so
        linux-vdso.so.1 (0x0000ffffbd5a9000)
        librt.so.1 => /usr/lib/librt.so.1 (0x0000ffffbd4f0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffbd340000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffbd56c000)
./libclrjit.so
        linux-vdso.so.1 (0x0000ffffa6774000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x0000ffffa6700000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x0000ffffa66d0000)
        librt.so.1 => /usr/lib/librt.so.1 (0x0000ffffa66a0000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x0000ffffa6670000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x0000ffffa5e00000)
        libm.so.6 => /usr/lib/libm.so.6 (0x0000ffffa65c0000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffffa6050000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffffa6737000)
./libSystem.IO.Ports.Native.so
        linux-vdso.so.1 (0x0000ffff868f6000)
        libc.so.6 => /usr/lib/libc.so.6 (0x0000ffff866d0000)
        /usr/lib/ld-linux-aarch64.so.1 (0x0000ffff868b9000)

[fmulero]

Any clue? Am I doing something wrong?

[TravisEz13]

We don't have a FIPS mode in Linux.

You would need to enable the .NET FIPS mode here. Please note that we have not tested this:
https://learn.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/runtime/enforcefipspolicy-element

[TravisEz13]

#26244

[fmulero]

Thanks a lot @TravisEz13 for your response!

Please amend me if I am wrong. We should try adding a configuration file pwsh.runtimeconfig.json in the installation path with a content like:

{
  "runtimeOptions": {
    "configProperties": {
      "System.Security.Cryptography.UseFipsAlgorithm": true
    }
  }
}

I don't see any link to libcrypto or libssl in the distributed binary is there any way to tell PowerShell or .NET to use them?