336629 - no error feedback if the PK11_InitPin call in nsPK11Token::InitPassword fails (e.g. a weak password in FIPS mode)

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Wan-Teh Chang]

The NSS function PK11_InitPin sets the initial master
password.

If the NSS software crypto module is in FIPS mode, it
enforces a minimum password quality (e.g., there is a
minimum length, and it must be a mixture of uppercase,
lowercase, and digits).  So PK11_InitPin may fail with
the error code SEC_ERROR_INVALID_PASSWORD if the initial
master password is too weak.

However, if I try to set the initial master password to
a weak password (e.g., "abc"), there is no error dialog.

How to reproduce:
1. Enable FIPS mode.
2. Shut down Firefox.
3. Go to your Firefox profile directory, rename key3.db
   as key3.db.save and cert8.db as cert8.db.save.  Leave
   secmod.db alone (because secmod.db contains the FIPS
   mode setting).
4. Start up Firefox.
5. Try to set the master password to "abc".  When you
   press the "OK" button, nothing happens.

Comment 1

[Wan-Teh Chang]

I forgot to add the following to "How to reproduce":

6. Then, set the master password to "1Mozilla".  It
   works.
7. Shut down Firefox.
8. Go to your Firefox profile directory and restore
   key3.db and cert8.db from key3.db.save and cert8.db.save.

Comment 2

[Kai Engert [:KaiE:]]

reassign bug owner.
mass-update-kaie-20120918

Comment 3

[Dana Keeler (she/her) [:keeler]]

Backlog => P3