Should a linux system in FIPS mode throw failures for unsupported functions?

user_1578031 0
Viewed 34

I have a RHEL 8.6 system in FIPS mode that I'm testing what happens with containers and their runtimes when the host has FIPS=1. My expectation is that calling an unsupported cipher or method should throw some sort of error.

In my testing, I have built a NodeJS image that's been compiled with OpenSSL3.0.3 and can start the node runtime with or without fips using:

/opt/node/bin/node --force-fips test.js

or

/opt/node/bin/node test.js

When the code runs with --force-fips the program throws an error that I expect such as Error: error:0308010C:digital envelope routines::unsupported.

However, removing the --force-fips the code runs successfully and outputs an md5 hash /opt/node/bin/node md5.js b10a8db164e0754105b7a99be72e3fe5

Since the Host is in FIPS, I thought this would be passed through and block those unsupported mechanisms like MD5 being old/unsupported in FIPS or ChaCha20 being too new and unsupported/non-validated cryptography.

What benefit does the Host FIPS mode present if the runtime can still be using ciphers and cryptography that should ultimately fail?

fips node.js runtime cryptography linux
2 Answers

The FIPS mode in the OS tells the OS-provided cryptographic libraries, such as OpenSSL, to use only FIPS-compatible ciphers and to perform additional tasks, such as a self-test on startup.

What it doesn't affect is third-party cryptographic libraries. For example, RHEL 8.6 comes with OpenSSL 1.1.1, but your Node version is likely using a statically-compiled 3.0.3 (which, given the history of necessary security updates to OpenSSL, seems like a bad idea). Thus, the OS didn't ship that cryptographic library and the FIPS mode of the OS wouldn't affect it.

Similarly, if you were writing Rust and used a Rust-based implementation of cryptography, or using the Go standard library for Go, then those also wouldn't be affected by the OS's FIPS mode.

user_87054320

What I expect to be happening here is that the host / OS is indeed just using FIPS ciphers. However, please understand that algorithms implemented in software are not detected by the OS in any way. Neither does it know about the force-fips option. So you need to configure them explicitly.

user_5892590
Related