Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Current key unsupported in FIPS mode #174

Open
dylan-at-nagios opened this issue Feb 17, 2023 · 0 comments
Open

Current key unsupported in FIPS mode #174

dylan-at-nagios opened this issue Feb 17, 2023 · 0 comments

Comments

@dylan-at-nagios
Copy link

You can enable fips mode on centos 9 with

fips-mode-setup --enable

Running gpg --keyserver hkp://pgpkeys.eu --recv-key 2E66557AB97C19C791AF8E20328DA867450F89EC outputs

gpg: out of core handler ignored in FIPS mode
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: can't check signature with unsupported public-key algorithm (17): Invalid public key algorithm.
gpg: key 328DA867450F89EC: 10 duplicate signatures removed
gpg: key 328DA867450F89EC: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

You can see here https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf that DSA is only acceptable with a FIPS approved hash function until February 2024, when it will no longer be supported. I see in the SIGNATURE file in https://cpan.org/authors/id/A/AN/ANDK/CPAN-2.34.tar.gz that it appears the hash algorithm used is RIPEMD160, which is not a FIPS support hash algorithm. However, I don't see anything about it being insecure, just that it's not approved by FIPS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant