Horton

Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Joe Conway <mail@joeconway.com>
Cc: Robert Haas <robertmhaas@gmail.com>, Peter Eisentraut <peter@eisentraut.org>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2024-12-09T21:37:58Z
Lists: pgsql-hackers

Attachments

> On 9 Dec 2024, at 15:11, Joe Conway <mail@joeconway.com> wrote:
> 
> On 12/9/24 07:23, Daniel Gustafsson wrote:
>>> On 4 Dec 2024, at 16:57, Joe Conway <mail@joeconway.com> wrote:
>>> I can send you the source RPM for openssl 1.1.1c which was an earlier FIPS validated version, but the main FIPS patch contains:
>> AFAICT the forks of 1.1.1 which offer FIPS certification all patch the common
>> OpenSSL API FIPS_mode() rather than invent a new one, so the earlier approach
>> should work fine. PFA an updated version which I propose we go ahead with.
> 
> That sounds correct from my memory of it.
> 
> I have not done any actual testing (yet), but on quick scan this part looks suspicious:

Not only suspicious but plain wrong, fixed in the attached, thanks!

--
Daniel Gustafsson

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support