Skip to content

SSH RSA 1024 keys are allowed for usage when FIPS 140-3 enabled #2274

@JohnEnzinas

Description

@JohnEnzinas

We may have found an inconsistency in BCFIPS 2.1.0 when running in approved-only mode.

Expected:

  • 1024-bit RSA keys should be rejected in approved-only/FIPS mode.

Observed:

  • A 1024-bit RSA key is correctly rejected in a signing/authentication flow with:
    FipsUnapprovedOperationError: Attempt to use RSA key with non-approved size: 1024: RSA
  • But a 1024-bit RSA key appears to be accepted in a signature verification / SSH public key authentication flow, with no error thrown.

The verification path reaches:

org.bouncycastle.crypto.fips.FipsRSA$SignatureOperatorFactory.createVerifier
org.bouncycastle.jcajce.provider.ProvRSA$AdaptiveSignatureOperatorFactory.createVerifier
org.bouncycastle.jcajce.provider.BaseSignature.initVerify
java.security.Signature.initVerify

For comparison, the failing signing path reaches:

org.bouncycastle.crypto.fips.FipsRSA$SignatureOperatorFactory.createSigner
org.bouncycastle.jcajce.provider.ProvRSA$AdaptiveSignatureOperatorFactory.createSigner
org.bouncycastle.jcajce.provider.BaseSignature.initSign
java.security.Signature.initSign

We suspect there may be a gap in how RSA key size is enforced for createVerifier(...) versus createSigner(...) in approved-only mode.

Metadata

Metadata

Assignees

No one assigned

    Labels

    support requestCommunity assistance requested

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions