|
 |
82e9c3 |
From 653a7fe02880c168755984133ee143567cc7bb4e Mon Sep 17 00:00:00 2001
|
|
|
82e9c3 |
From: Francisco Trivino <ftrivino@redhat.com>
|
|
|
82e9c3 |
Date: Feb 01 2022 07:57:24 +0000
|
|
|
82e9c3 |
Subject: Custodia: use a stronger encryption algo when exporting keys
|
|
|
82e9c3 |
|
|
|
82e9c3 |
|
|
|
82e9c3 |
The Custodia key export handler is using the default's OpenSSL encryption
|
|
|
82e9c3 |
scheme for PKCS#12.
|
|
|
82e9c3 |
|
|
|
82e9c3 |
This represents an issue when performing a migration from CentOS Stream 8 (C8S)
|
|
|
82e9c3 |
to CentOS Steam 9 (C9S) where the Custodia client running in the new C9S
|
|
|
82e9c3 |
replica talks to the Custodia server on C8S source server. The later creates an
|
|
|
82e9c3 |
encrypted PKCS#12 file that contains the cert and the key using the OpenSSL's
|
|
|
82e9c3 |
default encryption scheme, which is no longer supported on C9S.
|
|
|
82e9c3 |
|
|
|
82e9c3 |
This commit enforces a stronger encryption algorigthm by adding following
|
|
|
82e9c3 |
arguments to the Custodia server handler:
|
|
|
82e9c3 |
|
|
|
82e9c3 |
-keypbe AES-256-CBC -certpbe AES-256-CBC -macalg sha384
|
|
|
82e9c3 |
|
|
|
82e9c3 |
The new arguments enforce stronger PBEv2 instead of the insecure PBEv1.
|
|
|
82e9c3 |
|
|
|
82e9c3 |
Fixes: https://pagure.io/freeipa/issue/9101
|
|
|
82e9c3 |
|
|
|
82e9c3 |
Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
|
|
|
82e9c3 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
82e9c3 |
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
82e9c3 |
|
|
|
82e9c3 |
---
|
|
|
82e9c3 |
|
|
|
82e9c3 |
diff --git a/ipaserver/secrets/handlers/pemfile.py b/ipaserver/secrets/handlers/pemfile.py
|
|
|
82e9c3 |
index 4e8eff0..ad36bd0 100644
|
|
|
82e9c3 |
--- a/ipaserver/secrets/handlers/pemfile.py
|
|
|
82e9c3 |
+++ b/ipaserver/secrets/handlers/pemfile.py
|
|
|
82e9c3 |
@@ -31,6 +31,9 @@ def export_key(args, tmpdir):
|
|
|
82e9c3 |
'-out', pk12file,
|
|
|
82e9c3 |
'-inkey', args.keyfile,
|
|
|
82e9c3 |
'-password', 'file:{pk12pwfile}'.format(pk12pwfile=pk12pwfile),
|
|
|
82e9c3 |
+ '-keypbe', 'AES-256-CBC',
|
|
|
82e9c3 |
+ '-certpbe', 'AES-256-CBC',
|
|
|
82e9c3 |
+ '-macalg', 'sha384',
|
|
|
82e9c3 |
])
|
|
|
82e9c3 |
|
|
|
82e9c3 |
with open(pk12file, 'rb') as f:
|
|
|
82e9c3 |
|