public inbox for [email protected]  

help / color / mirror / Atom feed

From: Michael Paquier <[email protected]>
To: Daniel Gustafsson <[email protected]>
Cc: Joe Conway <[email protected]>
Cc: Tom Lane <[email protected]>
Cc: [email protected]
Cc: [email protected]
Subject: Re: BUG #19457: RE: pgp_sym_encrypt silently accepts non-FIPS ciphers (bf, cast5, 3des) when OpenSSL is in FIPS mod
Date: Sat, 25 Apr 2026 07:32:04 +0900
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>

On Fri, Apr 24, 2026 at 05:27:27PM +0200, Daniel Gustafsson wrote:
> Sounds good, I'll have a look at the two proposed patches.

Thanks, Daniel.

FWIW, the patch sent by Shishir is mostly a copy-paste of what I have
provided in terms of tests (exactly the same) and documentation
(mostly the same).  He has added a paragraph about the set of ciphers
that are allowed in FIPS.  Do we actually need to mention these
explicitely? Perhaps a link to an external source would be more
adapted?  I am not convinced that this is a good addition for
pgcrypto, but feel free to disagree.

The second difference is this diff, impacting the outputs of the
tests and the decision-making:
@@ -162,6 +163,9 @@ pgp_load_cipher(int code, PX_Cipher **res)
     if (i == NULL)
         return PXE_PGP_CORRUPT_DATA;
 
+    if (!i->fips_allowed)
+        CheckBuiltinCryptoMode();

Daniel should have the last word on that, I guess, as it is his
feature, but the semantics I have chosen are harder than that:
- If the GUC is off, block everything.
- If the GUC is on, allow everything.
- If the GUC is fips, block the non-fips ciphers and allow the fips
ciphers.

This behavior would be more consistent and symmetric with the other
functions, at least IMHO.

Thanks,
--
Michael


Attachments:

  [application/pgp-signature] signature.asc (833B, 2-signature.asc)
  download

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: BUG #19457: RE: pgp_sym_encrypt silently accepts non-FIPS ciphers (bf, cast5, 3des) when OpenSSL is in FIPS mod
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox