WIP go v1.24.0 changes to crypto with FIPS settings #7148
Conversation
michel-laterman
added
enhancement
|
This pull request does not have a backport label. Could you fix it @michel-laterman? 🙏
|
| "github.com/elastic/elastic-agent/internal/pkg/agent/vault/aesgcm" | ||
| "github.com/elastic/elastic-agent/pkg/utils" | ||
| ) | ||
|
|
||
| const ( | ||
| saltSize = 8 | ||
| saltSize int = 128 / 8 |
There was a problem hiding this comment.
This gave an error message of crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode if it was not changed.
This occurs in the crypto/pbkdf2 when it compares len(salt) < 128/8.
If we don't change to go 1.24.0, we will need to make this change for the FIPS distributions, i'm not sure if this is a change we can easily make to existing agents (as far as upgrade paths go)
| @@ -53,6 +56,7 @@ func NewCA() (*CertificateAuthority, error) { | |||
| } | |||
|
|
|||
| privateKey, _ := rsa.GenerateKey(rand.Reader, 2048) | |||
| ca.SubjectKeyId = generateSubjectKeyID(privateKey) | |||
There was a problem hiding this comment.
If we don't generate the SubjectKeyId go will attempt to use SHA1
| @@ -62,7 +62,7 @@ func Encrypt(key, data []byte) ([]byte, error) { | |||
| return nil, err | |||
| } | |||
|
|
|||
| aesGCM, err := cipher.NewGCM(block) | |||
| aesGCM, err := cipher.NewGCMWithRandomNonce(block) | |||
There was a problem hiding this comment.
This is the very early stages of trying to use the new method (documented here).
We will probably need to do a bit more here as the returned aesGCM behaves differently then the current one.
|
Closing this as it was just an exploratory attempt. Using |
What does this PR do?
WIP of changes needed for new go 1.24.0 crypto primatives with FIPS mode tested
Currently I'm able to install an agent, but if I restart the service it fails with:
Error: could not load agent info: could not get agent info from store: fail to read configuration /opt/Elastic/Agent/fleet.enc for the agent: fail to decode bytes: cipher: message authentication failedWhy is it important?
Checklist
./changelog/fragmentsusing the changelog toolDisruptive User Impact
How to test this PR locally