Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.2\))
Subject: Re: BUG #19457: RE: pgp_sym_encrypt silently accepts non-FIPS ciphers
 (bf, cast5, 3des) when OpenSSL is in FIPS mod
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <71c66a3b-4c0d-447b-8b84-ef15ac047561@joeconway.com>
Date: Fri, 24 Apr 2026 17:27:27 +0200
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
 Michael Paquier <michael@paquier.xyz>,
 ansh01072001@gmail.com,
 pgsql-bugs@lists.postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <98BDEEAC-A401-41D8-B9C0-A1EBEBF2E08E@yesql.se>
References: <19457-4bab15c17aea36c7@postgresql.org>
 <3A2299BC-1684-4CEB-BD65-1DEBFB446F24@yesql.se>
 <aervokmPnxlO6Oqs@paquier.xyz>
 <99F0B98C-2276-4C01-B553-BDD0806CAEEF@yesql.se>
 <1612210.1777041534@sss.pgh.pa.us>
 <71c66a3b-4c0d-447b-8b84-ef15ac047561@joeconway.com>
To: Joe Conway <mail@joeconway.com>
Archived-At: <https://www.postgresql.org/message-id/98BDEEAC-A401-41D8-B9C0-A1EBEBF2E08E%40yesql.se>
Precedence: bulk

> On 24 Apr 2026, at 17:18, Joe Conway <mail@joeconway.com> wrote:
>=20
> On 4/24/26 10:38, Tom Lane wrote:
>> Daniel Gustafsson <daniel@yesql.se> writes:
>>>> On 24 Apr 2026, at 06:20, Michael Paquier <michael@paquier.xyz> =
wrote:
>>>> I am interesting in getting that fixed for the next point release, =
so
>>>> I have given it a try, finishing with the attached.  This would =
cause
>>>> pgp_sym_encrypt() and pgp_sym_decrypt() to complain when the =
builtin
>>>> mode is disabled, making things more consistent with the =
surroundings.
>>> I'm not convinced this is material for a minor release, the feature =
works as
>>> documented and it was never documented to cover PGP.  Re-reading the =
thread PGP
>>> was never discussed, and while that admittedly seem like an =
oversight doing
>>> this in a minor release will alter documented behaviour which is =
generally not
>>> what we want to do.
>> I sympathize with that argument, but ... people who are running in
>> FIPS mode are probably doing so because they have contractual or =
legal
>> obligations to meet that standard.  A person who could be in hot =
water
>> if they are accidentally running disallowed crypto would see this as =
a
>> dangerous bug.  A person who does not care should not be using FIPS
>> mode.
>=20
> +1 I think we should consider this as a backpatchable bug.

Sounds good, I'll have a look at the two proposed patches.

--
Daniel Gustafsson