[jboss-jira] [JBoss JIRA] (ELY-1369) FIPS mode, Elytron HTTP DIGEST authentication mechanism not fips compliant

[Martin Choma (JIRA)]

    [ https://issues.jboss.org/browse/ELY-1369?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13512658#comment-13512658 ] 

Martin Choma edited comment on ELY-1369 at 1/10/18 11:57 AM:
-------------------------------------------------------------

Curl has [1]. There is some long-termly proposed patch for Firefox [2]. Customer using Python script - found one PR from Python world [3]. But yes this does not seem as priority for clients.  Still there can be some in future.
 
[1] https://github.com/curl/curl/pull/1934
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=472823
[3] https://github.com/httplib2/httplib2/pull/23


was (Author: mchoma):
Curl has [1]. There is some long-termly proposed patch for Firefox. But yes this does not seem as priority for browser.  Still there can be some in future.
 
[1] https://github.com/curl/curl/pull/1934
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=472823

> FIPS mode, Elytron HTTP DIGEST authentication mechanism not fips compliant
> --------------------------------------------------------------------------
>
>                 Key: ELY-1369
>                 URL: https://issues.jboss.org/browse/ELY-1369
>             Project: WildFly Elytron
>          Issue Type: Bug
>          Components: HTTP
>    Affects Versions: 1.2.0.Beta3
>            Reporter: Jan Kalina
>            Assignee: Jan Kalina
>             Fix For: 1.2.0.Beta11
>
>
> Elytron HTTP DIGEST authentication comply to rfc2617 - which means MD5 is used by default (it means it is hardcode, with no way to configure another hash algorithm). But MD5 could make troubles in fips environment [5].
> {code:java|title=DigestAuthenticationMechanism.java}
>         String algorithm = convertToken(ALGORITHM, responseTokens.get(ALGORITHM));
>         if (MD5.equals(algorithm) == false) {
>             throw log.mechUnsupportedAlgorithm(getMechanismName(), algorithm);
>         }
> {code}
> There exists proposed rfc7616 which makes algorithm configurable, work on new DIGEST features are covered by [1]. [~dlofthouse] is it planned for [1] to target 7.1? 
> [1] https://issues.jboss.org/browse/ELY-286
> [2] https://developer.jboss.org/wiki/ElytronHTTPDigestNonceHandling-Design
> [3] https://tools.ietf.org/html/rfc2617
> [4] https://tools.ietf.org/html/rfc7616
> [5] https://access.redhat.com/support/cases/#/case/01761455



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)