Feature #6943: pstore in FIPS mode

• Status: Closed
• Assignee: -
• Target version: -

[vo.x (Vit Ondruch)]

Is there any chance to make PStore compatible with FIPS mode? PStore is using MD5 for data checksum, but MD5 is unsupported algorithm in FIPS mode unfortunately. It would be easy to use different hash algorithm, but I am afraid that backward compatibility would be lost. Thank you.

[mame (Yusuke Endoh)]

• Target version set to 2.6

[MartinBosslet (Martin Bosslet)]

• Status changed from Open to Assigned
• Assignee set to MartinBosslet (Martin Bosslet)

[zzak (zzak _)]

• Assignee changed from MartinBosslet (Martin Bosslet) to 7150

[vo.x (Vit Ondruch)]

Ping? Any chance to change the hashing algorithm?

[naruse (Yui NARUSE)]

lib/pstore.rb uses digest/md5, and it uses own implementation (ext/digest/md5/md5.c) if there's no openssl
or it doesn't support MD5, it extconf.rb works correctly.

[vo.x (Vit Ondruch)]

Using internal implementation is just hiding the issue. I don't think this would be acceptable solution for FIPS certification, what would be the point then? It is quite easy to generate colliding hashes these days. It might not be that critical for PStore though ...

[nobu (Nobuyoshi Nakada)]

Seems nothing to block, since md5 seems used just to see if the data is modified.

https://github.com/ruby/ruby/compare/trunk...nobu:feature/6943-pstore-checksum_algorithm

[nobu (Nobuyoshi Nakada)]

• Status changed from Assigned to Closed

Applied in changeset r56284.

---

PStore: select checksum algorithm

• lib/pstore.rb (PStore::CHECKSUM_ALGO): find available hashing
  algorithm for checksum. MD5 is not available in FIPS mode.
  [Feature #6943]