Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use SHA256 instead of MD5 for /proc/mounts hash calculation #825

Merged

Conversation

vojtechtrefny
Copy link
Member

MD5 is not available in the FIPS mode.

Resolves: rhbz#1792340

MD5 is not available in the FIPS mode.

Resolves: rhbz#1792340
@vojtechtrefny vojtechtrefny changed the title Use SHA1 instead of MD5 for /proc/mounts hash calculation Use SHA256 instead of MD5 for /proc/mounts hash calculation Jan 22, 2020
Copy link
Contributor

@dwlehman dwlehman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me with the assumption that SHA256 will always be available.

@vojtechtrefny
Copy link
Member Author

Looks good to me with the assumption that SHA256 will always be available.

Both SHA1 and SHA256 are currently available in FIPS mode on RHEL 8:

>>> import hashlib
>>> hashlib.md5()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS
>>> hashlib.sha1()
<sha1 HASH object @ 0x7fb7abf409b8>
>>> hashlib.sha256()
<sha256 HASH object @ 0x7fb7abf40a80>

but SHA256 is probably "safer" for the future given recently discovered issues with SHA1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants