TLSv1.3 and TLS_CHACHA20_POLY1305_SHA256 #208
Comments
|
Hi, could you try running |
|
I've just updated the README.md in #209 accordingly. |
|
@dbenoit17 Thanks for the help. I tried it again with |
|
I suggest making sure that the system is properly switched to FIPS mode. Afaik |
|
I reproduced the same issue in a fedora container ( Here again the full list of commands: |
|
Doing |
|
@dbenoit17 pointed that building in the fedora container results in CGO disabled, as gcc is not installed by default. Maybe you could try installing gcc first with the yum command line. |
|
That does not change anything. |
|
I tried now with RHEL In this case, testssl did not show TLS_CHACHA20_POLY1305_SHA256 cipher, but I see that the http daemon is crashing while testing Also I tried go-toolset directly But this also shows |
|
I tried (on fedora container, gcc installed), and it works for me: # fake kernel FIPS mode
mkdir /tmp/crypto
echo 1 > /tmp/crypto/fips_enabled
podman run -ti -v /tmp/crypto:/proc/sys/crypto:Z fedora bash
yum install -y dnsutils make vim git wget procps gcc
git config --global user.email "[email protected]"
git config --global user.name "Your Name"
cd
wget https://go.dev/dl/go1.21.12.linux-amd64.tar.gz
tar xf go1.21.12.linux-amd64.tar.gz
export PATH=$PATH:/root/go/bin
git clone https://github.com/golang-fips/go.git go-fips
cd go-fips
scripts/full-initialize-repo.sh
export PATH=/root/go-fips/go/bin/:/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
which go
cd
git clone https://github.com/igor-kupczynski/fips-echo-server.git
cd fips-echo-server
go build
./fips-echo-server &
cd
git clone https://github.com/drwetter/testssl.sh.git
cd testssl.sh
bash testssl.sh localhost:8443I also observe some panics though. |
|
Thanks @ueno that sheds some light on the problem. I tried this on ubi and on fedora container: And again on fedora Fedora and ubi use different openssl versions. And the openssl version of fedora does not list TLS_CHACHA20_POLY1305_SHA256 in when fips_enabled = 1. |
|
And I tried the same on ubi 9 But I still see several crashes of the fips-echo-server |
|
Note that Go TLS stack doesn't use libssl.so from OpenSSL, so the output of openssl ciphers is not relevant. As for the panic, it seems to be known in upstream and will be fixed when rebasing to 1.22.5. |
|
@ueno Thanks that helps. So my fault was that I didn't set |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
A server that is compiled with golang-fips (master) and go1.22 still offers TLS_CHACHA20_POLY1305_SHA256 which is not FIPS compliant.
Is this a bug or is it a requirement to turn off TLSv1.3 completely?
Steps to repro on debian:
The text was updated successfully, but these errors were encountered: