Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qoVNq-001Vo9-69 for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Oct 2023 20:55:46 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qoVNo-000Q1L-0U for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Oct 2023 20:55:44 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qoVNn-000Q11-Mz for pgsql-hackers@lists.postgresql.org; Thu, 05 Oct 2023 20:55:44 +0000 Received: from sss.pgh.pa.us ([68.162.161.243]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qoVNl-000Cnw-UG for pgsql-hackers@postgresql.org; Thu, 05 Oct 2023 20:55:43 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 395KtdXJ2825089; Thu, 5 Oct 2023 16:55:39 -0400 From: Tom Lane To: Peter Eisentraut cc: pgsql-hackers Subject: Re: Allow tests to pass in OpenSSL FIPS mode In-reply-to: <2818708.1696536244@sss.pgh.pa.us> References: <2818708.1696536244@sss.pgh.pa.us> Comments: In-reply-to Tom Lane message dated "Thu, 05 Oct 2023 16:04:04 -0400" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-ID: <2825058.1696539315.0@sss.pgh.pa.us> Date: Thu, 05 Oct 2023 16:55:39 -0400 Message-ID: <2825088.1696539339@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2825058.1696539315.1@sss.pgh.pa.us> I found another bit of fun we'll need to deal with: on my F38 platform, pgcrypto/3des fails as attached. Some googling finds this relevant info: https://github.com/pyca/cryptography/issues/6875 That is, FIPS deprecation of 3DES is happening even as we speak. So apparently we'll have little choice but to deal with two different behaviors for that. As before, I'm not too pleased with the user-friendliness of the error: +ERROR: encrypt error: Cipher cannot be initialized That's even less useful to a user than "unsupported". FWIW, everything else seems to pass with this patchset. I ran check-world as well as the various "must run manually" test suites. regards, tom lane ------- =_aaaaaaaaaa0 Content-Type: text/x-diff; name="pgcrypto-regression.diffs"; charset="us-ascii" Content-ID: <2825058.1696539315.2@sss.pgh.pa.us> Content-Description: pgcrypto-regression.diffs Content-Transfer-Encoding: quoted-printable diff -U3 /home/tgl/pgsql/contrib/pgcrypto/expected/3des.out /home/tgl/pgsq= l/contrib/pgcrypto/results/3des.out --- /home/tgl/pgsql/contrib/pgcrypto/expected/3des.out 2023-10-05 15:25:46= .922080156 -0400 +++ /home/tgl/pgsql/contrib/pgcrypto/results/3des.out 2023-10-05 16:29:32.= 416972002 -0400 @@ -5,61 +5,25 @@ SELECT encrypt('\x8000000000000000', '\x010101010101010101010101010101010101010101010101', '3des-ecb/pad:none'); - encrypt = --------------------- - \x95f8a5e5dd31d900 -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized select encrypt('', 'foo', '3des'); - encrypt = --------------------- - \x752111e37a2d7ac3 -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized -- 10 bytes key select encrypt('foo', '0123456789', '3des'); - encrypt = --------------------- - \xd2fb8baa1717cb02 -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized -- 22 bytes key select encrypt('foo', '0123456789012345678901', '3des'); - encrypt = --------------------- - \xa44360e699269817 -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized -- decrypt select encode(decrypt(encrypt('foo', '0123456', '3des'), '0123456', '3des= '), 'escape'); - encode = --------- - foo -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized -- iv select encrypt_iv('foo', '0123456', 'abcd', '3des'); - encrypt_iv = --------------------- - \x50735067b073bb93 -(1 row) - +ERROR: encrypt_iv error: Cipher cannot be initialized select encode(decrypt_iv('\x50735067b073bb93', '0123456', 'abcd', '3des')= , 'escape'); - encode = --------- - foo -(1 row) - +ERROR: decrypt_iv error: Cipher cannot be initialized -- long message select encrypt('Lets try a longer message.', '0123456789012345678901', '3= des'); - encrypt = --------------------------------------------------------------------- - \xb71e3422269d0ded19468f33d65cd663c28e0871984792a7b3ba0ddcecec8d2c -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized select encode(decrypt(encrypt('Lets try a longer message.', '012345678901= 2345678901', '3des'), '0123456789012345678901', '3des'), 'escape'); - encode = ----------------------------- - Lets try a longer message. -(1 row) - +ERROR: encrypt error: Cipher cannot be initialized ------- =_aaaaaaaaaa0--