Skip to content

SSH RSA 1024 keys are allowed for usage when FIPS 140-3 enabled #2274

Description

@JohnEnzinas

We may have found an inconsistency in BCFIPS 2.1.0 when running in approved-only mode.

Expected:

  • 1024-bit RSA keys should be rejected in approved-only/FIPS mode.

Observed:

  • A 1024-bit RSA key is correctly rejected in a signing/authentication flow with:
    FipsUnapprovedOperationError: Attempt to use RSA key with non-approved size: 1024: RSA
  • But a 1024-bit RSA key appears to be accepted in a signature verification / SSH public key authentication flow, with no error thrown.

The verification path reaches:

org.bouncycastle.crypto.fips.FipsRSA$SignatureOperatorFactory.createVerifier
org.bouncycastle.jcajce.provider.ProvRSA$AdaptiveSignatureOperatorFactory.createVerifier
org.bouncycastle.jcajce.provider.BaseSignature.initVerify
java.security.Signature.initVerify

For comparison, the failing signing path reaches:

org.bouncycastle.crypto.fips.FipsRSA$SignatureOperatorFactory.createSigner
org.bouncycastle.jcajce.provider.ProvRSA$AdaptiveSignatureOperatorFactory.createSigner
org.bouncycastle.jcajce.provider.BaseSignature.initSign
java.security.Signature.initSign

We suspect there may be a gap in how RSA key size is enforced for createVerifier(...) versus createSigner(...) in approved-only mode.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    support requestCommunity assistance requested

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions