1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Robert Relyea]

Attachment: nss-3.66-no-small-primes.patch

When NSS is in FIPS mode, it should reject all primes smaller than 2048. The ike 1536 prime is in the accepted primes table. In FIPS mode it should be rejected.

The attach patch rejects that prime only in FIPS mode. The test cases were update to verify this. I'll submit this patch as a phabricator patch as well.

Comment 1

[Benjamin Beurdouche [:beurdouche]]

Would there be problematic consequences in rejecting even in non-fips mode?

Comment 2

[Robert Relyea]

Attachment: Bug 1720228 NSS incorrectly accepting 1536 bit DH primes in FIPS mode

When NSS is in FIPS mode, it should reject all primes smaller than 2048. The ike 1536 prime is in the accepted primes table. In FIPS mode it should be rejected.

Comment 3

[Robert Relyea]

Probably not in ssl because I think we already reject them in SSL, but old IKE servers wouldn't connect. In general we only do this check if we are 1) in FIPS mode, or 2) the application triggers it by setting CKA_SUBPRIME on the imported key we are checking.

bob

Comment 4

[Benjamin Beurdouche [:beurdouche]]

https://hg.mozilla.org/projects/nss/rev/d2ec946e601afb2d2406c7b5ab9cb713dccb8ae7