Re: [DNSOP] FIPS 140-3 mode on RHEL 9 and RSA validation of <2048 keys

[Bjørn Mork <[e-mail]>]

Petr Menšík <[e-mail]> writes:

> Our crypto team is
> responsible for preparing RHEL 9 for FIPS 140-3 certification. They said
> there is legal obligation to stop using all RSA signatures with keys
> shorter than 2048 bits.

Either they're wrong or you're misquoting them by merging "signing" and
"verifying" into the confusing and misleading term "using".  FIPS 140-3
is a bit more specific than that, fortunately.

See table 2 in
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
which shows the status of RSA keys with 1024 ≤ len(n) < 2048 for Digital
Signature Verification as "Legacy use".

The text following that table provides more detail:

  Key lengths providing less than 112 bits of security that were
  previously specified in FIPS 186 are allowed for legacy use when
  verifying digital signatures.

and

  RSA: See FIPS 186-239 and FIPS 186-4,40 which include modulus lengths
  of 1024, 1280, 1536 and 1792 bits, may continue to be used for
  signature verification but not signature generation


Bjørn