Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication (security type 2) when in FIPS mode

[Daniel P. Berrange]

On Tue, May 01, 2012 at 06:45:47PM -0500, Anthony Liguori wrote:
> On 05/01/2012 06:43 PM, George Wilson wrote:
> >
> >Anthony Liguori<address@hidden>  wrote on 05/01/2012 06:26:05 PM:
> >
> >>Anthony Liguori<address@hidden>
> >>05/01/2012 06:26 PM
> >>
> >>To
> >>
> >>Paul Moore<address@hidden>
> >>
> >>cc
> >>
> >>address@hidden, George Wilson/Austin/address@hidden
> >>
> >>Subject
> >>
> >>Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication
> >>(security type 2) when in FIPS mode
> >>
> >>On 05/01/2012 04:20 PM, Paul Moore wrote:
> >>>FIPS 140-2 requires disabling certain ciphers, including DES, which is
> >used
> >>>by VNC to obscure passwords when they are sent over the network.  The
> >>>solution for FIPS users is to disable the use of VNC password auth when
> >the
> >>>host system is operating in FIPS mode.
> >>
> >>Sorry, what?
> >>
> >>Does FIPS really require software to detect when FIPS is enabled
> >andactively
> >>disable features???  That's absurd.
> >>
> >>Can you point to another software package that does something like this?
> >
> >Yes, it's true that only FIPS-approved algorithms are permitted for use in
> >FIPS
> >mode.  The kernel and all other FIPS 140-2 validated crypto modules like
> >OpenSSL
> >and NSS are required to restrict algorithms to the approved set.  The
> >kernel
> >sets /proc/sys/crypto/fips_enabled so that programs can detect FIPS mode
> >and
> >behave in accordance with the standard.
> 
> But this is nonsensical. It would allow no-password to be configured
> for the VNC server but not DES?  Why is that okay?  It's not like we
> enable DES passwords by default.  A user has to explicitly configure
> it.

In the wonderful world of security certifications,  "sensible" is
rarely a relevant factor. To answer your point though, FIPS itself
is just about restricting use of insecure algorithms. Whether an
application uses authentication or not, is outside the scope of
that.  Other security standards are responsible for dictating whether
authentication is mandatory or not.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|