Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIPS mode broken when EdDSA algorithm is available #7086

Closed
yarisx opened this issue Apr 3, 2023 · 1 comment · Fixed by #7392
Closed

FIPS mode broken when EdDSA algorithm is available #7086

yarisx opened this issue Apr 3, 2023 · 1 comment · Fixed by #7392
Assignees
Labels
bug Issue is reported as a bug team:VM Assigned to OTP team VM

Comments

@yarisx
Copy link
Contributor

yarisx commented Apr 3, 2023

Describe the bug
In FIPS-enabled mode when EdDSA algorithm is available the crypto:sign() treats any algorithm as "Unsupported algorithm in FIPS mode".

To Reproduce

> ./configure --enable-fips --prefix=$(pwd)/installed
> make && make install
> ~/proj/otp-upstream $ ERL_TOP=installed installed/bin/erl
Erlang/OTP 26 [RELEASE CANDIDATE 2] [erts-13.2] [source-88439d7b75] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [jit:ns]
1> crypto:enable_fips_mode(true).
true
2> crypto:info_fips().
enabled
3> crypto:sign(rsa, sha, <<1,1,1>>, [65537, 1]).
** exception error: {notsup,{"pkey.c",104},"Unsupported algorithm in FIPS mode"}
     in function  crypto:sign/5 (crypto.erl, line 1474)
        *** argument 1: Unsupported algorithm in FIPS mode
        *** (Found in the internal file pkey.c at line 104)


Expected behavior

3> crypto:sign(rsa, sha, <<1,1,1>>, [65537, 1]).
** exception error: {badarg,{"pkey.c",357},"Couldn't get RSA private key"}
     in function  crypto:sign/5 (crypto.erl, line 1474)
        *** argument 4: Couldn't get RSA private key
        *** (Found in the internal file pkey.c at line 357)

Affected versions
OTP-25.3, OTP-26 RC2

Additional context
The patch that can fix the issue:

diff --git a/lib/crypto/c_src/pkey.c b/lib/crypto/c_src/pkey.c
index bfdcfe3553..0d05ffd338 100644
--- a/lib/crypto/c_src/pkey.c
+++ b/lib/crypto/c_src/pkey.c
@@ -100,8 +100,11 @@ static int check_pkey_algorithm_type(ErlNifEnv *env,


 #ifdef HAVE_EDDSA
-    if (FIPS_MODE())
-        assign_goto(*err_return, err, EXCP_NOTSUP_N(env, alg_arg_num, "Unsupported algorithm in FIPS mode"));
+    if (algorithm == atom_eddsa)
+    {
+        if (FIPS_MODE())
+            assign_goto(*err_return, err, EXCP_NOTSUP_N(env, alg_arg_num, "Unsupported algorithm in FIPS mode"));
+    }
 #endif
@yarisx yarisx added the bug Issue is reported as a bug label Apr 3, 2023
@yarisx yarisx changed the title FIPS mode broken when EdDSA algorithm is available (present in OpenSSL) FIPS mode broken when EdDSA algorithm is available Apr 3, 2023
@IngelaAndin IngelaAndin added the team:VM Assigned to OTP team VM label Apr 4, 2023
@sverker
Copy link
Contributor

sverker commented Jun 20, 2023

Fixed by #7392 in 1e04ce9.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Issue is reported as a bug team:VM Assigned to OTP team VM
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants