Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gnutls for openSUSE:Factory checked in at 2026-08-15 22:40:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gnutls (Old) and /work/SRC/openSUSE:Factory/.gnutls.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gnutls" Sat Aug 15 22:40:25 2026 rev:171 rq:1371036 version:3.8.13 Changes: -------- --- /work/SRC/openSUSE:Factory/gnutls/gnutls.changes 2026-07-15 16:25:04.064610782 +0200 +++ /work/SRC/openSUSE:Factory/.gnutls.new.1258/gnutls.changes 2026-08-15 22:40:45.774875250 +0200 @@ -1,0 +2,32 @@ +Sat Jul 25 15:15:41 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Deprecate ECDSA siggen with less than 128-bit (bsc#1265613) + * NIST SP 800-131Arev3 marked ECDSA siggen < 128-bit of security + strength as deprecated after the deadline of 31 dic 2030. + * Add gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch + +------------------------------------------------------------------- +Sat Jul 25 15:12:18 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Mark SHA-224 and SHA3-224 as legacy (bsc#1265609, bsc#1265611) + * NIST SP 800-131Arev3 has marked SHA-224 and SHA3-224 as legacy + after the deadline of 31 dic 2030. + * Add gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch + +------------------------------------------------------------------- +Sat Jul 25 15:10:25 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Deprecate HMAC with keys less than 128-bit (bsc#1265610) + * NIST SP 800-131Arev3 marked HMAC with keys less than 128-bits + as disallowed after the deadline of 31 dic 2030. + * Add gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch + +------------------------------------------------------------------- +Sat Jul 25 14:50:16 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Deprecate RSA Signatures with less than 128-bit (bsc#1265612) + * NIST SP 800-131Arev3 has marked RSA Signatures with less than + 128-bit as deprecated after the deadline of 31 dic 2030. + * Add gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch + +------------------------------------------------------------------- @@ -266 +298 @@ - kernel’s key update mechanism when kTLS is enabled, allowing uninterrupted + kernel's key update mechanism when kTLS is enabled, allowing uninterrupted @@ -694 +726 @@ - through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml’s + through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml's New: ---- gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch ----------(New B)---------- New: strength as deprecated after the deadline of 31 dic 2030. * Add gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch New: as disallowed after the deadline of 31 dic 2030. * Add gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch New: 128-bit as deprecated after the deadline of 31 dic 2030. * Add gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch New: after the deadline of 31 dic 2030. * Add gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gnutls.spec ++++++ --- /var/tmp/diff_new_pack.L7K3NP/_old 2026-08-15 22:40:48.170959593 +0200 +++ /var/tmp/diff_new_pack.L7K3NP/_new 2026-08-15 22:40:48.175959769 +0200 @@ -76,6 +76,14 @@ Patch8: gnutls-FIPS-HMAC-leancrypto.patch #PATCH-FIX-SUSE bsc#1262397 Add NIST SP800-56Brev2 6.4.2.2 check: Partial public-key validation for RSA OAEP Patch9: gnutls-FIPS-RSA-OAEP-PK-validation.patch +# PATCH-FIX-SUSE bsc#1265612 FIPS: Deprecate RSA Signatures with less than 128-bit +Patch10: gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch +# PATCH-FIX-SUSE bsc#1265610 FIPS: Deprecate HMAC with keys less than 128-bit +Patch11: gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch +# PATCH-FIX-SUSE bsc#1265609 bsc#1265611 FIPS: Mark SHA-224 and SHA3-224 as legacy +Patch12: gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch +# PATCH-FIX-SUSE bsc#1265613 FIPS: Deprecate ECDSA siggen with less than 128-bit +Patch13: gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch BuildRequires: autogen BuildRequires: automake ++++++ gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch ++++++ FIPS: mark ECDSA signature generation below 128-bit security strength as non-approved in the service indicator Index: gnutls-3.8.10/lib/nettle/pk.c =================================================================== --- gnutls-3.8.10.orig/lib/nettle/pk.c +++ gnutls-3.8.10/lib/nettle/pk.c @@ -1983,8 +1983,10 @@ static int _wrap_nettle_pk_sign(gnutls_p goto cleanup; } - /* P-192 is not supported in FIPS 140-3 */ - if (curve_id == GNUTLS_ECC_CURVE_SECP192R1) { + /* P-192 (FIPS 140-3) and P-224 (< 128-bit security, NIST + * SP 800-131A rev3, after 2030-12-31) are not approved */ + if (curve_id == GNUTLS_ECC_CURVE_SECP192R1 || + curve_id == GNUTLS_ECC_CURVE_SECP224R1) { not_approved = true; } Index: gnutls-3.8.10/tests/privkey-keygen.c =================================================================== --- gnutls-3.8.10.orig/tests/privkey-keygen.c +++ gnutls-3.8.10/tests/privkey-keygen.c @@ -134,6 +134,18 @@ static bool is_supported_pk_algo(gnutls_ return false; } +static bool is_approved_sig_pkey(gnutls_pk_algorithm_t algorithm, + gnutls_x509_privkey_t pkey, unsigned bits) +{ + if (!is_approved_pk_algo(algorithm, bits)) + return false; + + if (algorithm != GNUTLS_PK_EC) + return true; + + return gnutls_x509_privkey_sec_param(pkey) >= GNUTLS_SEC_PARAM_HIGH; +} + void doit(void) { gnutls_x509_privkey_t pkey, dst; @@ -211,7 +223,7 @@ void doit(void) gnutls_pk_algorithm_get_name(algorithm), ret); } - if (is_approved_pk_algo(algorithm, + if (is_approved_sig_pkey(algorithm, pkey, gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { @@ -247,7 +259,7 @@ void doit(void) FIPS_PUSH_CONTEXT(); sign_verify_data(algorithm, pkey); - if (is_approved_pk_algo(algorithm, + if (is_approved_sig_pkey(algorithm, pkey, gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { @@ -256,7 +268,7 @@ void doit(void) FIPS_PUSH_CONTEXT(); sign_verify_data(algorithm, dst); - if (is_approved_pk_algo(algorithm, + if (is_approved_sig_pkey(algorithm, dst, gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { ++++++ gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch ++++++ FIPS: mark HMAC with keys shorter than 128 bits as non-approved in the service indicator --- a/lib/crypto-api.c +++ b/lib/crypto-api.c @@ -607,8 +607,9 @@ not_approved = true; } - /* Key lengths of less than 112 bits are not approved */ - if (keylen < 14) { + /* Key lengths of less than 128 bits are not approved + * (NIST SP 800-131A rev3, after 2030-12-31) */ + if (keylen < 16) { not_approved = true; } @@ -769,8 +770,9 @@ not_approved = true; } - /* Key lengths of less than 112 bits are not approved */ - if (keylen < 14) { + /* Key lengths of less than 128 bits are not approved + * (NIST SP 800-131A rev3, after 2030-12-31) */ + if (keylen < 16) { not_approved = true; } --- a/tests/fips-test.c +++ b/tests/fips-test.c @@ -409,7 +409,7 @@ fail("gnutls_hmac_init succeeded for md5\n"); } - /* HMAC with key equal to or longer than 112 bits: approved */ + /* HMAC with key equal to or longer than 128 bits: approved */ FIPS_PUSH_CONTEXT(); ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA256, key.data, key.size); if (ret < 0) { @@ -418,16 +418,16 @@ gnutls_hmac_deinit(mh, NULL); FIPS_POP_CONTEXT(APPROVED); - /* HMAC with key shorter than 112 bits: not approved */ + /* HMAC with key shorter than 128 bits: not approved */ FIPS_PUSH_CONTEXT(); - ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA256, key.data, 13); + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA256, key.data, 15); if (ret < 0) { fail("gnutls_hmac_init failed\n"); } gnutls_hmac_deinit(mh, NULL); FIPS_POP_CONTEXT(NOT_APPROVED); - /* HMAC with key equal to or longer than 112 bits: approved */ + /* HMAC with key equal to or longer than 128 bits: approved */ FIPS_PUSH_CONTEXT(); ret = gnutls_hmac_fast(GNUTLS_MAC_SHA256, key.data, key.size, data.data, data.size, hmac); @@ -436,9 +436,9 @@ } FIPS_POP_CONTEXT(APPROVED); - /* HMAC with key shorter than 112 bits: not approved */ + /* HMAC with key shorter than 128 bits: not approved */ FIPS_PUSH_CONTEXT(); - ret = gnutls_hmac_fast(GNUTLS_MAC_SHA256, key.data, 13, data.data, + ret = gnutls_hmac_fast(GNUTLS_MAC_SHA256, key.data, 15, data.data, data.size, hmac); if (ret < 0) { fail("gnutls_hmac_fast failed\n"); ++++++ gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch ++++++ FIPS: mark RSA signature generation below 128-bit security strength as non-approved in the service indicator Index: gnutls-3.8.13/lib/nettle/pk.c =================================================================== --- gnutls-3.8.13.orig/lib/nettle/pk.c +++ gnutls-3.8.13/lib/nettle/pk.c @@ -2343,11 +2343,13 @@ static int _wrap_nettle_pk_sign(gnutls_p bits = mpz_sizeinbase(pub.n, 2); - /* RSA modulus size should be 2048-bit or larger in FIPS - * 140-3. In addition to this, only SHA-2 is allowed - * for SigGen; it is checked in pk_prepare_hash lib/pk.c - */ - if (unlikely(bits < 2048)) { + /* RSA modulus size should be 3072-bit or larger for + * 128-bit security strength (NIST SP 800-131A rev3, + * after 2030-12-31). In addition to this, only SHA-2 + * is allowed for SigGen; it is checked in + * pk_prepare_hash lib/pk.c + */ + if (unlikely(bits < 3072)) { not_approved = true; } @@ -2396,13 +2398,13 @@ static int _wrap_nettle_pk_sign(gnutls_p bits = mpz_sizeinbase(pub.n, 2); - /* RSA modulus size should be 2048-bit or larger in FIPS - * 140-3. In addition to this, only SHA-2 is allowed - * for SigGen; however, Nettle only support SHA256, - * SHA384, and SHA512 for RSA-PSS (see - * _rsa_pss_sign_digest_tr in this file for details). - */ - if (unlikely(bits < 2048)) { + /* RSA modulus size should be 3072-bit or larger for + * 128-bit security strength (NIST SP 800-131A rev3, + * after 2030-12-31). In addition to this, only SHA-2 + * is allowed for SigGen; however, Nettle only support + * SHA256, SHA384, and SHA512 for RSA-PSS (see + */ + if (unlikely(bits < 3072)) { not_approved = true; } Index: gnutls-3.8.13/lib/crypto-selftests-pk.c =================================================================== --- gnutls-3.8.13.orig/lib/crypto-selftests-pk.c +++ gnutls-3.8.13/lib/crypto-selftests-pk.c @@ -39,7 +39,7 @@ static const gnutls_datum_t signed_data static const gnutls_datum_t bad_data = { .data = (void *)DATASTR, .size = sizeof(DATASTR) - 2 }; -/* RSA 2048 private key and signature */ +/* RSA 2048 private key */ static const char rsa_2048_privkey[] = "-----BEGIN RSA PRIVATE KEY-----\n" "MIIEogIBAAKCAQEA6yCv+BLrRP/dMPBXJWK21c0aqxIX6JkODL4K+zlyEURt8/Wp\n" @@ -69,24 +69,6 @@ static const char rsa_2048_privkey[] = "jG0M4UZm5P9STL09nZuWH0wfpr/eg+9+A6yOVfnADI13v+Ygk7k=\n" "-----END RSA PRIVATE KEY-----\n"; -static const char rsa_2048_sig[] = - "\x7a\xb3\xf8\xb0\xf9\xf0\x52\x88\x37\x17\x97\x9f\xbe\x61\xb4\xd2" - "\x43\x78\x9f\x79\x92\xd0\xad\x08\xdb\xbd\x3c\x72\x7a\xb5\x51\x59" - "\x63\xd6\x7d\xf1\x9c\x1e\x10\x7b\x27\xab\xf8\xd4\x9d\xcd\xc5\xf9" - "\xae\xf7\x09\x6b\x40\x93\xc5\xe9\x1c\x0f\xb4\x82\xa1\x47\x86\x54" - "\x63\xd2\x4d\x40\x9a\x80\xb9\x38\x45\x69\xa2\xd6\x92\xb6\x69\x7f" - "\x3f\xf3\x5b\xa5\x1d\xac\x06\xad\xdf\x4e\xbb\xe6\xda\x68\x0d\xe5" - "\xab\xef\xd2\xf0\xc5\xd8\xc0\xed\x80\xe2\xd4\x76\x98\xec\x44\xa2" - "\xfc\x3f\xce\x2e\x8b\xc4\x4b\xab\xb0\x70\x24\x52\x85\x2a\x36\xcd" - "\x9a\xb5\x05\x00\xea\x98\x7c\x72\x06\x68\xb1\x38\x44\x16\x80\x6a" - "\x3b\x64\x72\xbb\xfd\x4b\xc9\xdd\xda\x2a\x68\xde\x7f\x6e\x48\x28" - "\xc1\x63\x57\x2b\xde\x83\xa3\x27\x34\xd7\xa6\x87\x18\x35\x10\xff" - "\x31\xd9\x47\xc9\x84\x35\xe1\xaa\xe2\xf7\x98\xfa\x19\xd3\xf1\x94" - "\x25\x2a\x96\xe4\xa8\xa7\x05\x10\x93\x87\xde\x96\x85\xe5\x68\xb8" - "\xe5\x4e\xbf\x66\x85\x91\xbd\x52\x5b\x3d\x9f\x1b\x79\xea\xe3\x8b" - "\xef\x62\x18\x39\x7a\x50\x01\x46\x1b\xde\x8d\x37\xbc\x90\x6c\x07" - "\xc0\x07\xed\x60\xce\x2e\x31\xd6\x8f\xe8\x75\xdb\x45\x21\xc6\xcb"; - static const char rsa_pss_2048_sig[] = "\x28\x77\x99\x8b\xc6\xe2\x59\x5c\xa5\x5c\x30\x78\x13\xe2\xca\xe1" "\x13\xf5\x5d\xd5\x9a\xd7\x71\xff\x41\x82\xf4\x61\xda\x3a\xb6\x10" @@ -105,6 +87,74 @@ static const char rsa_pss_2048_sig[] = "\xc2\x26\x7c\xd6\x38\x5d\xba\x9b\x50\x38\x44\x63\x91\x2a\x98\xd2" "\x30\x3f\xfb\x79\x15\x5f\x2e\xd2\x3f\xb7\xc4\x69\xc2\x2d\x79\x8d"; +static const char rsa_3072_privkey[] = + "-----BEGIN PRIVATE KEY-----\n" + "MIIG/wIBADANBgkqhkiG9w0BAQEFAASCBukwggblAgEAAoIBgQC/wVIS64d7H/gF\n" + "asi4im6eWEVFivHsQKG7vmrDtrWHnVIYfP5QaJQPwsvUdtti1ZRRVkpU8dVfB5JR\n" + "D7KeIgFzuTnxyw+PpLfV6ElniCdgysNvuPik2kfKeTMFAI+ktbs2S/czXt6kOTjk\n" + "Qx/GT/n572uU3X1VghZjRZpgwBIBRVcMEbCm33VOfxDlLBCT4aHIcTf/Apc1ZjgF\n" + "30yBriUXJ/O82PEGqNaskgZjYXd/Aj2ZruSgFTYeg3UMNwi92nczpg3I/wOTA73Z\n" + "RBpiL2B4qDR7DkPpgQYmc4nGjRXBlF40ZhYF3yGfLmK15XGC5iXM3rJ+p3KzSokB\n" + "itN+9KrCCAwcUDjB5aZ/Nwa4pEWEMsIVNpFXP9M3yvaf80TDuQRaPQKOvzEEMmCW\n" + "9EOyJP8DbpzYQDtquHHC0OB98ZXnLdGRXXP7yRFZmyJghx16StcdbfJpDTkkHVo+\n" + "0QJ/QB6w1lzq6GdG/+cdTs9l5ryXgJFePSHxWFaP5uvHKYWMaN8CAwEAAQKCAYAR\n" + "EBsaiI96BaKPRiztkZE9poMmKLKq9XwEIHHlpR4gHtVNoom1Y/47giJFxKce81G1\n" + "ryUBdrIoOPHseVDJQM4Pmx2B24eF86qmw9BhqxGTS6z6Ww5HtQ4LAUqTQ7UvJeYD\n" + "yIdgWy0aleZEbDNT9Tfm5UbAbLkYtnEBjRGrUaFd2uq1Azn3Og55Lqtf3nzse85m\n" + "mf8ul5oW7AKeMHw2qeVZBdAVhNm7CvkXSrh7eBJ8YG7/fDrnLRwEuRPdmLlpaMVn\n" + "iTtJBc5jZIyKQ13YR2+qFFzti+ifHWIbOa/Uag7OT3cHCTU4CRr32fRsZw0LoZCb\n" + "dGsX4jRsduGn8n5GFQK2t1a5is2mgD2D6t8Sy0LyIHEvKmbA9MND0krCTjzE2J0M\n" + "mg/Ua66ZLG/BzzyCmeW+wBXDWULiZOMVAiA04RzLyzqXrM/tk6l367o6zfvpj3XS\n" + "g6ZGalwWQjlIOpkIKBB4KoY9NJrLmxv/bBCSbn5iE+4ll5ceTozYFVS5wXVwwjEC\n" + "gcEA/IynNPoikQ0IL6cd9AVxTNDMEZi8R4qHzQQwitizxWLuQUJP0ntWD3XjDnEM\n" + "aC6ceasH+ZhOO19VR6+cbpCR5xLmhxNwab6QT9SvePabcHq4fBO3MKRB09GMnQQa\n" + "nxLsog+VwDWeldDnuyAmzPd3LxNRPihhwfdhxmlj0AKilXwsclScreojDQqyNwwU\n" + "eY3vhSFjsL1+63q/SthDZS16fng2B7GWSm1uL+DbQsJNVfLXYZRN3pN34w3yV6U0\n" + "4QdHAoHBAMJgBrU3fX8IWFQWwUzgaDwRZao7GAcTMXxuUmUxgyuxmvoycI8m93Yp\n" + "ISed422g6xmma90bILjrLqBuwxa+Z57qyDdylCpMZkNigI6bfL4KryudEYUkUODa\n" + "4RxHQCHsyb8nAvYnsVPG4U+lp4w1HBqhbBUNFb3k1VAuqJtSN/rn7iDUy404KM3z\n" + "+mdPKfnQnOGWo0LxiyoXWdT/2LhOozENFVNSj102BoFZaNdIgzCnVq5IiwB6Xiv7\n" + "3gKRY2ANqQKBwQDs3ZK5ul0PRHTIFOqgAzbHwBGV83Wrd790xxgsMaEyYV5q8KHj\n" + "HPCToZKq6dakJAt4hbP+Ih5Fy1011fxXKtrdKjnyuIW3eBbr+OP3BPy22zMKlIc9\n" + "ZOGkpCZI4h+B0QMF4K4oT2IEy6F8PWSG2xb6nRiWvtMpVDdtG02VO9N3drZNKRSm\n" + "fTIQulZ6EKdndnsOl0lj6+cNPtwJe5qCW8xGr8KlJqd5+Pbeivu6unhEQ3ZEvA7o\n" + "0dEgsOT51SYqZGMCgcEAvTSgEvJK9Mb4xBHKY7zleeMtZUFUqD5ko0z4Y4yItJWT\n" + "2AwVSSOTKq/qmBe29FX5w+QdhwMLHTXBE2X9/TumviiocGDWHT51JQ7TOP3dtVfN\n" + "H9Uq4sFxAQ/OpKouoVdPIwUketw0XupvFAqaR37DNqD/BpbQHSKNChoBAgBMga4W\n" + "PFsnMPYDskbV7o4+u+/3ZhguH9Hjtzs3tIC/Qtk5PVwQ8CSjbQZT2sFfrn/lRAz/\n" + "8XKn6/UxifsIJtPDOhLRAoHBANdP3iAdgbCKmpldMx5sG+he6jKu+9hoUIVAtnmc\n" + "42e+IcXySrk1M1AVkhcqi2PKYnNvCOjbv5fhdg7F5RJ4MRx6jhugJ2APFwNJqs21\n" + "25LAKg9qeK+7LZhpdUR6ybyE2zgWatepQV9DNAng5IIwEfbVvOuhWdicdnMmHCMR\n" + "Kc2RI60znTkyNuynCe7KTRkG3sbYzKjqnZwx1OX+tVqkptDxtimDOhZLihKeR16t\n" + "Bckaw82db26aBUMs5l7stG9HRg==\n" + "-----END PRIVATE KEY-----\n"; + +static const char rsa_3072_sig[] = + "\x18\x0f\x87\xa0\x14\x8d\x78\x08\x8e\xe0\xa1\x32\xad\xb9\x8a\xee" + "\x6e\xf0\xeb\x12\x35\x2d\x51\x97\x0b\xb5\x94\x75\xd3\x9b\x2d\x05" + "\x44\xee\x17\xc4\xa3\x92\xf8\x3a\x23\xfb\xeb\x80\x79\x81\xce\x18" + "\x46\x53\x31\x20\x8b\x8e\x94\x83\x49\xee\xc6\x07\xf2\x0b\xf3\x4c" + "\xd3\xf5\xd9\x18\xd6\x96\xdf\xac\xc9\x8b\xa0\xbe\xab\xf0\x0c\x14" + "\x40\xe8\xfe\xa4\xd1\x14\x94\x2c\xe6\xe6\xf0\xd3\x9a\x1f\x53\x35" + "\x9b\x26\x00\x64\xd4\xec\xc8\x1b\x89\xff\x60\xfb\x51\x48\xd2\xa2" + "\x40\xf2\xfd\x75\x3d\xcb\x96\x3d\x37\xc2\x0c\xf2\xf4\xb2\x2e\x54" + "\xf5\x32\xcb\xff\x8b\xcc\x8c\x99\x41\x50\x6e\x8d\x8e\x07\x10\xb2" + "\xe9\xb7\x4a\x3c\xf6\x19\xaf\x7d\xea\xb8\xbb\xec\xbf\x5c\x73\x17" + "\x20\x94\xbd\xfc\xe4\x2a\xff\x47\x88\xa3\x6b\x71\x78\x8d\xed\xca" + "\xc7\xbe\x8d\xbb\x21\xcd\xb3\x2b\x69\x4b\x14\x2d\x12\x99\x24\x31" + "\x70\xe0\xb6\x7c\x3e\x5e\x19\x33\x39\x5e\x8a\x24\x66\xe4\xc6\x95" + "\x6d\x17\x75\xaf\xb8\x12\x03\x00\xda\xae\x32\xba\x3d\xea\xfb\xf2" + "\xcb\xc8\xe6\x4d\xe3\xad\x41\x01\xec\x95\x7c\x0b\x7b\xc3\xb5\x02" + "\x2c\xb0\xcc\x05\x26\x68\xba\xe9\x8f\xc9\x9f\x3b\xcf\x70\x05\x83" + "\xd8\x3b\xef\x9b\x7c\x85\xa8\xc6\xa4\xbc\x03\x84\xaf\xbc\x65\x63" + "\xc6\xd8\xd4\xa5\x84\x51\x31\x94\x4f\x94\x99\x4b\xfb\x6d\xd5\xe5" + "\x07\x46\x2d\x86\xf3\xf9\x4b\x34\x62\x79\x95\x86\xd4\xfd\x76\x33" + "\x1e\x93\xa1\x99\xae\x9b\x79\xee\xfd\x2c\xb7\x5c\x9f\x4b\x7b\xa5" + "\x84\xfc\x9d\x55\x4a\x39\x21\x90\x2d\x96\x68\xb4\x29\x76\x6e\x8d" + "\x8b\xae\x09\xf7\x3a\x91\xf6\xd8\xd6\x37\x7f\xed\x86\x91\x97\x8e" + "\x73\x7a\x26\x5c\x50\x42\xee\xcf\x72\x65\x8a\xbc\xb4\x99\xba\x06" + "\xd2\x65\xaa\xdf\x02\x42\xaa\x1f\x33\xbe\xf1\xb1\xcd\xab\x27\x1b"; + #ifdef ENABLE_DSA /* DSA 2048 private key and signature */ static const char dsa_2048_privkey[] = @@ -413,13 +463,13 @@ static int test_sig(gnutls_pk_algorithm_ switch (pk) { case GNUTLS_PK_RSA: - raw_key.data = (void *)rsa_2048_privkey; - raw_key.size = sizeof(rsa_2048_privkey) - 1; + raw_key.data = (void *)rsa_3072_privkey; + raw_key.size = sizeof(rsa_3072_privkey) - 1; snprintf(param_name, sizeof(param_name), "%u", bits); break; case GNUTLS_PK_RSA_PSS: - raw_key.data = (void *)rsa_2048_privkey; - raw_key.size = sizeof(rsa_2048_privkey) - 1; + raw_key.data = (void *)rsa_3072_privkey; + raw_key.size = sizeof(rsa_3072_privkey) - 1; snprintf(param_name, sizeof(param_name), "%u", bits); break; #ifdef ENABLE_DSA @@ -1057,8 +1107,8 @@ int gnutls_pk_self_test(unsigned flags, return 0; FALLTHROUGH; case GNUTLS_PK_RSA: - PK_KNOWN_TEST(GNUTLS_PK_RSA, 2048, GNUTLS_DIG_SHA256, - rsa_2048_privkey, rsa_2048_sig, 0); + PK_KNOWN_TEST(GNUTLS_PK_RSA, 3072, GNUTLS_DIG_SHA256, + rsa_3072_privkey, rsa_3072_sig, 0); PK_TEST(GNUTLS_PK_RSA, test_rsa_enc, 2048, 0); @@ -1075,7 +1125,7 @@ int gnutls_pk_self_test(unsigned flags, rsa_pss_2048_sig, GNUTLS_PRIVKEY_SIGN_FLAG_RSA_PSS); } else { - PK_TEST(GNUTLS_PK_RSA_PSS, test_sig, 2048, + PK_TEST(GNUTLS_PK_RSA_PSS, test_sig, 3072, GNUTLS_SIGN_RSA_PSS_RSAE_SHA256); } Index: gnutls-3.8.13/lib/pk.c =================================================================== --- gnutls-3.8.13.orig/lib/pk.c +++ gnutls-3.8.13/lib/pk.c @@ -1186,7 +1186,6 @@ int pk_prepare_hash(gnutls_pk_algorithm_ case GNUTLS_MAC_SHA256: case GNUTLS_MAC_SHA384: case GNUTLS_MAC_SHA512: - case GNUTLS_MAC_SHA224: break; default: _gnutls_switch_fips_state( Index: gnutls-3.8.13/tests/fips-test.c =================================================================== --- gnutls-3.8.13.orig/tests/fips-test.c +++ gnutls-3.8.13/tests/fips-test.c @@ -551,7 +551,7 @@ void doit(void) ret, bits); } gnutls_x509_privkey_deinit(xprivkey); - FIPS_POP_CONTEXT(APPROVED); + FIPS_POP_CONTEXT(NOT_APPROVED); /* Generate 512-bit RSA key */ FIPS_PUSH_CONTEXT(); @@ -572,14 +572,14 @@ void doit(void) import_keypair(&privkey, &pubkey, "rsa-2432.pem"); FIPS_POP_CONTEXT(INITIAL); - /* Create a signature with 2432-bit RSA and SHA256; approved */ + /* Create a signature with 2432-bit RSA and SHA256; not approved */ FIPS_PUSH_CONTEXT(); ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0, &data, &signature); if (ret < 0) { fail("gnutls_privkey_sign_data failed\n"); } - FIPS_POP_CONTEXT(APPROVED); + FIPS_POP_CONTEXT(NOT_APPROVED); /* Verify a signature with 2432-bit RSA and SHA256; approved */ FIPS_PUSH_CONTEXT(); Index: gnutls-3.8.13/tests/fips-rsa-sizes.c =================================================================== --- gnutls-3.8.13.orig/tests/fips-rsa-sizes.c +++ gnutls-3.8.13/tests/fips-rsa-sizes.c @@ -51,7 +51,10 @@ void generate_successfully(gnutls_privke ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0); if (ret != GNUTLS_E_SUCCESS) fail("%d-bit x509_privkey_init (%d)\n", size, ret); - FIPS_POP_CONTEXT(APPROVED); + if (size < 3072) + FIPS_POP_CONTEXT(NOT_APPROVED); + else + FIPS_POP_CONTEXT(APPROVED); gnutls_x509_privkey_deinit(xprivkey); FIPS_PUSH_CONTEXT(); @@ -59,7 +62,10 @@ void generate_successfully(gnutls_privke ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0); if (ret != GNUTLS_E_SUCCESS) fail("%d-bit privkey_init (%d)\n", size, ret); - FIPS_POP_CONTEXT(APPROVED); + if (size < 3072) + FIPS_POP_CONTEXT(NOT_APPROVED); + else + FIPS_POP_CONTEXT(APPROVED); assert(gnutls_pubkey_init(pubkey) == 0); FIPS_PUSH_CONTEXT(); @@ -130,6 +136,7 @@ void generate_unsuccessfully(gnutls_priv void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) { int ret; + unsigned int bits; gnutls_fips140_context_t fips_context; gnutls_datum_t signature; @@ -138,13 +145,19 @@ void sign_verify_successfully(gnutls_pri }; assert(gnutls_fips140_context_init(&fips_context) == 0); - /* RSA sign: approved */ + gnutls_pubkey_get_pk_algorithm(pubkey, &bits); + + /* RSA sign: not approved below 3072-bit + * (NIST SP 800-131A rev3, after 2030-12-31) */ FIPS_PUSH_CONTEXT(); ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0, &plaintext, &signature); if (ret < 0) fail("gnutls_privkey_sign_data failed\n"); - FIPS_POP_CONTEXT(APPROVED); + if (bits < 3072) + FIPS_POP_CONTEXT(NOT_APPROVED); + else + FIPS_POP_CONTEXT(APPROVED); /* RSA verify: approved */ FIPS_PUSH_CONTEXT(); Index: gnutls-3.8.13/tests/privkey-keygen.c =================================================================== --- gnutls-3.8.13.orig/tests/privkey-keygen.c +++ gnutls-3.8.13/tests/privkey-keygen.c @@ -104,11 +104,14 @@ static void sign_verify_data(gnutls_pk_a gnutls_free(signature.data); } -static bool is_approved_pk_algo(gnutls_pk_algorithm_t algo) +static bool is_approved_pk_algo(gnutls_pk_algorithm_t algo, unsigned bits) { switch (algo) { case GNUTLS_PK_RSA: case GNUTLS_PK_RSA_PSS: + /* not approved below 3072-bit + * (NIST SP 800-131A rev3, after 2030-12-31) */ + return bits >= 3072; case GNUTLS_PK_RSA_OAEP: case GNUTLS_PK_EC: case GNUTLS_PK_EDDSA_ED25519: @@ -208,7 +211,8 @@ void doit(void) gnutls_pk_algorithm_get_name(algorithm), ret); } - if (is_approved_pk_algo(algorithm)) { + if (is_approved_pk_algo(algorithm, + gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { FIPS_POP_CONTEXT(NOT_APPROVED); @@ -243,7 +247,8 @@ void doit(void) FIPS_PUSH_CONTEXT(); sign_verify_data(algorithm, pkey); - if (is_approved_pk_algo(algorithm)) { + if (is_approved_pk_algo(algorithm, + gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { FIPS_POP_CONTEXT(NOT_APPROVED); @@ -251,7 +256,8 @@ void doit(void) FIPS_PUSH_CONTEXT(); sign_verify_data(algorithm, dst); - if (is_approved_pk_algo(algorithm)) { + if (is_approved_pk_algo(algorithm, + gnutls_sec_param_to_pk_bits(algorithm, sec_param[i]))) { FIPS_POP_CONTEXT(APPROVED); } else { FIPS_POP_CONTEXT(NOT_APPROVED); Index: gnutls-3.8.13/tests/rsa-rsa-pss.c =================================================================== --- gnutls-3.8.13.orig/tests/rsa-rsa-pss.c +++ gnutls-3.8.13/tests/rsa-rsa-pss.c @@ -190,11 +190,11 @@ void doit(void) prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 32); sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0, - GNUTLS_FIPS140_OP_APPROVED); + GNUTLS_FIPS140_OP_NOT_APPROVED); sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0, - GNUTLS_FIPS140_OP_APPROVED); + GNUTLS_FIPS140_OP_NOT_APPROVED); sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa, 0, 0, 0, 0, - GNUTLS_FIPS140_OP_APPROVED); + GNUTLS_FIPS140_OP_NOT_APPROVED); if (debug) success("success signing with RSA-PSS-SHA256\n"); ++++++ gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch ++++++ FIPS: mark SHA-224 and SHA3-224 as non-approved in the service indicator Index: gnutls-3.8.10/lib/fips.h =================================================================== --- gnutls-3.8.10.orig/lib/fips.h +++ gnutls-3.8.10/lib/fips.h @@ -82,8 +82,6 @@ is_mac_algo_hmac_approved_in_fips(gnutls case GNUTLS_MAC_SHA256: case GNUTLS_MAC_SHA384: case GNUTLS_MAC_SHA512: - case GNUTLS_MAC_SHA224: - case GNUTLS_MAC_SHA3_224: case GNUTLS_MAC_SHA3_256: case GNUTLS_MAC_SHA3_384: case GNUTLS_MAC_SHA3_512: @@ -116,7 +114,19 @@ inline static bool is_mac_algo_approved_ inline static bool is_mac_algo_allowed_in_fips(gnutls_mac_algorithm_t algo) { - return is_mac_algo_approved_in_fips(algo); + if (is_mac_algo_approved_in_fips(algo)) { + return true; + } + + /* SHA-224 and SHA3-224 are usable but not approved + * (NIST SP 800-131A rev3, after 2030-12-31) */ + switch (algo) { + case GNUTLS_MAC_SHA224: + case GNUTLS_MAC_SHA3_224: + return true; + default: + return false; + } } inline static bool Index: gnutls-3.8.10/lib/crypto-selftests.c =================================================================== --- gnutls-3.8.10.orig/lib/crypto-selftests.c +++ gnutls-3.8.10/lib/crypto-selftests.c @@ -2893,7 +2893,7 @@ int gnutls_mac_self_test(unsigned flags, FALLTHROUGH; NON_FIPS_CASE(GNUTLS_MAC_SHA1, test_mac, hmac_sha1_vectors); FALLTHROUGH; - CASE(GNUTLS_MAC_SHA224, test_mac, hmac_sha224_vectors); + NON_FIPS_CASE(GNUTLS_MAC_SHA224, test_mac, hmac_sha224_vectors); FALLTHROUGH; CASE(GNUTLS_MAC_SHA256, test_mac, hmac_sha256_vectors); FALLTHROUGH; @@ -2965,7 +2965,7 @@ int gnutls_digest_self_test(unsigned fla FALLTHROUGH; CASE(GNUTLS_DIG_SHA1, test_digest, sha1_vectors); FALLTHROUGH; - CASE(GNUTLS_DIG_SHA224, test_digest, sha224_vectors); + NON_FIPS_CASE(GNUTLS_DIG_SHA224, test_digest, sha224_vectors); FALLTHROUGH; CASE(GNUTLS_DIG_SHA256, test_digest, sha256_vectors); FALLTHROUGH; @@ -2974,7 +2974,7 @@ int gnutls_digest_self_test(unsigned fla CASE(GNUTLS_DIG_SHA512, test_digest, sha512_vectors); #ifdef NETTLE_SHA3_FIPS202 FALLTHROUGH; - CASE(GNUTLS_DIG_SHA3_224, test_digest, sha3_224_vectors); + NON_FIPS_CASE(GNUTLS_DIG_SHA3_224, test_digest, sha3_224_vectors); FALLTHROUGH; CASE(GNUTLS_DIG_SHA3_256, test_digest, sha3_256_vectors); FALLTHROUGH; Index: gnutls-3.8.10/lib/fips.c =================================================================== --- gnutls-3.8.10.orig/lib/fips.c +++ gnutls-3.8.10/lib/fips.c @@ -696,11 +696,6 @@ int _gnutls_fips_perform_self_checks2(vo } /* Digest tests */ - ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_224); - if (ret < 0) { - return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR); - } - ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_256); if (ret < 0) { return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR); @@ -727,11 +722,6 @@ int _gnutls_fips_perform_self_checks2(vo } /* MAC (includes message digest test) */ - ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA224); - if (ret < 0) { - return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR); - } - ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA256); if (ret < 0) { return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR); Index: gnutls-3.8.10/lib/nettle/pk.c =================================================================== --- gnutls-3.8.10.orig/lib/nettle/pk.c +++ gnutls-3.8.10/lib/nettle/pk.c @@ -2011,7 +2011,6 @@ static int _wrap_nettle_pk_sign(gnutls_p case GNUTLS_MAC_SHA256: case GNUTLS_MAC_SHA384: case GNUTLS_MAC_SHA512: - case GNUTLS_MAC_SHA224: break; default: not_approved = true; @@ -2485,7 +2484,6 @@ static int _wrap_nettle_pk_verify(gnutls case GNUTLS_MAC_SHA256: case GNUTLS_MAC_SHA384: case GNUTLS_MAC_SHA512: - case GNUTLS_MAC_SHA224: break; default: not_approved = true; Index: gnutls-3.8.10/lib/pubkey.c =================================================================== --- gnutls-3.8.10.orig/lib/pubkey.c +++ gnutls-3.8.10/lib/pubkey.c @@ -2520,7 +2520,6 @@ static int _pkcs1_rsa_verify_sig(gnutls_ case GNUTLS_MAC_SHA256: case GNUTLS_MAC_SHA384: case GNUTLS_MAC_SHA512: - case GNUTLS_MAC_SHA224: break; default: _gnutls_switch_fips_state( Index: gnutls-3.8.10/tests/fips-test.c =================================================================== --- gnutls-3.8.10.orig/tests/fips-test.c +++ gnutls-3.8.10/tests/fips-test.c @@ -445,6 +445,15 @@ void doit(void) } FIPS_POP_CONTEXT(NOT_APPROVED); + /* HMAC with SHA-224 is not approved */ + FIPS_PUSH_CONTEXT(); + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA224, key.data, key.size); + if (ret < 0) { + fail("gnutls_hmac_init failed for sha224\n"); + } + gnutls_hmac_deinit(mh, NULL); + FIPS_POP_CONTEXT(NOT_APPROVED); + /* PBKDF2 with key equal to or longer than 112 bits: approved */ FIPS_PUSH_CONTEXT(); ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 1000, &pbkdf2, @@ -493,6 +502,31 @@ void doit(void) } FIPS_POP_CONTEXT(NOT_APPROVED); + /* PBKDF2 with SHA-224 is not approved */ + FIPS_PUSH_CONTEXT(); + ret = gnutls_pbkdf2(GNUTLS_MAC_SHA224, &key, &iv, 1000, &pbkdf2, + sizeof(pbkdf2)); + if (ret < 0) { + fail("gnutls_pbkdf2 failed\n"); + } + FIPS_POP_CONTEXT(NOT_APPROVED); + + /* Message digest with SHA-224 is not approved */ + FIPS_PUSH_CONTEXT(); + ret = gnutls_hash_fast(GNUTLS_DIG_SHA224, data.data, data.size, hash); + if (ret < 0) { + fail("gnutls_hash_fast failed for sha224\n"); + } + FIPS_POP_CONTEXT(NOT_APPROVED); + + /* Message digest with SHA3-224 is not approved */ + FIPS_PUSH_CONTEXT(); + ret = gnutls_hash_fast(GNUTLS_DIG_SHA3_224, data.data, data.size, hash); + if (ret < 0) { + fail("gnutls_hash_fast failed for sha3-224\n"); + } + FIPS_POP_CONTEXT(NOT_APPROVED); + ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16)); if (ret < 0) { fail("gnutls_rnd failed\n");
