]> git.proxmox.com Git - mirror_kronosnet.git/commit
[nsscrypto] Use different method to import key
authorJan Friesse <jfriesse@redhat.com>
Fri, 30 Jun 2017 15:38:48 +0000 (17:38 +0200)
committerJan Friesse <jfriesse@redhat.com>
Tue, 11 Jul 2017 15:02:49 +0000 (17:02 +0200)
commitfb5a4b41a3a4738f2b9957d826ced80a662eb4f3
treea66f1165446d30f3ecb4f547926738b0ce0909b8
parentf96d170e28ac12717d834fe7bd45c223bf22c443
[nsscrypto] Use different method to import key

PK11_ImportSymKey doesn't work when FIPS is enabled because NSS is
targeting to FIPS Level 2 where loading of unencrypted symmetric
key is prohibited.

FIPS Level 2 is hard to achieve without breaking compatibility so patch
implements "workaround" to make NSS behave like FIPS Level 1
(where is allowed to load unencrypted symmetric key).

Workaround is about using temporal key to encrypt corosync authkey in
memory and then to unwrap it into valid NSS key.

Also when FIPS is enabled, it's not currently (nss 3.30.2) possible to
unwrap key larger than 256 bytes.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
libknet/nsscrypto.c