Re: Allow tests to pass in OpenSSL FIPS mode

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Daniel Gustafsson <daniel(at)yesql(dot)se>
Cc: Peter Eisentraut <peter(at)eisentraut(dot)org>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Allow tests to pass in OpenSSL FIPS mode
Date: 2023-11-15 20:29:16
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers

Daniel Gustafsson <daniel(at)yesql(dot)se> writes:
> Since the 3DES/DES deprecations aren't limited to FIPS, do we want to do
> anything for pgcrypto where we have DES/3DES encryption? Maybe a doc patch
> which mentions the deprecation with a link to the SP could be in order?

A docs patch that marks both MD5 and 3DES as deprecated is probably
appropriate, but it seems like a matter for a separate thread and patch.

In the meantime, I've done a pass of review of Peter's v4 patches.
v4-0001 is already committed, so that's not considered here.

v4-0002: I think it is worth splitting up contrib/pgcrypto's
pgp-encrypt test, which has only one test case whose output changes,
and a bunch of others that don't. v5-0002, attached, does it
like that. It's otherwise the same as v4.

(It might be worth doing something similar for uuid_ossp's test,
but I have not bothered here. That test script is stable enough
that I'm not too worried about future maintenance.)

The attached 0003, 0004, 0005 patches are identical to Peter's.
I think that it is possibly worth modifying the password test so that
we don't fail to create the roles, so as to reduce the delta between
password.out and password_1.out (and thereby ease future maintenance
of those files). However you might disagree, so I split my proposal
out as a separate patch v5-0007-password-test-delta.patch; you can
drop that from the set if you don't like it.

v5-0006-allow-for-disabled-3DES.patch adds the necessary expected
file to make that pass on my Fedora 38 system.

With or without 0007, as you choose, I think it's committable.

regards, tom lane

Attachment Content-Type Size
v5-0002-pgcrypto-Allow-tests-to-pass-in-OpenSSL-FIPS-mode.patch text/x-diff 6.8 KB
v5-0003-Allow-tests-to-pass-in-OpenSSL-FIPS-mode-TAP-test.patch text/x-diff 12.9 KB
v5-0004-Allow-tests-to-pass-in-OpenSSL-FIPS-mode-rest.patch text/x-diff 16.6 KB
v5-0005-WIP-Use-fipshash-in-brin_multi-test.patch text/x-diff 5.1 KB
v5-0006-allow-for-disabled-3DES.patch text/x-diff 1.5 KB
v5-0007-password-test-delta.patch text/x-diff 5.3 KB

In response to


Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2023-11-15 20:51:38 Re: On non-Windows, hard depend on uselocale(3)
Previous Message Shankaran, Akash 2023-11-15 20:27:57 RE: Popcount optimization using AVX512