Re: [radext] Proposed charter text based on IETF-115 BoF

[Paul Wouters <[e-mail]>]

On Tue, Nov 22, 2022 at 11:56 AM Peter Deacon <[e-mail]>
wrote:

>
> Is anyone aware of a specific reference to specific text of either FIPS or
> similar standards that say MD5 can't be used for any purpose?
>
> Here is an implementation guide for FIPS 140-2 that is the closest
> thing I've ever been able to find that speaks to this specific issue.
>
>
> https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/fips140-2/fips1402ig.pdf
>
> pg95 "non-approved cryptographic algorithms may be used in the approved
> mode of operation if the non-approved algorithms are not a security
> function. "
>

Note that the MD5 usage in Radius is a security function.

I've worked a lot with the people from ATsec, a NIST certified lab that
validates FIPS modules.

This is what Stephan Mueller from atsec confirmed to me:

As stated below, MD5 is a non-approved algorithm. Thus, if Radius requires
> MD5, it uses non-approved crypto and may not be used where
> FIPS-jurisdiction
> is in effect (or the crypto officer gave an exception based on his risk
> analysis).
>
> For a FIPS module, however, it is permissible to offer non-approved
> cryptography including MD5, provided the following constraints are met:
>
> - the service indicator references the non-approved algo as non-approved
>
> - the non-approved algo does not share a key / CSP with an approved
> algorithm
>
> As MD5 does not use a key, all that is needed by a FIPS module is to have
> a
> service indicator as mentioned.
>
> The one and only exception for MD5 being allowed is when it is used for
> the
> TLS1.1 KDF where it is used in unison with SHA-1.
>
>
> Bottom line:
>
> - your crypto library may provide MD5 along with the non-approved indicator
>
> - Radius would use non-approved crypto and thus would not be allowed to be
> used [in FIPS mode]
>

This means (and this is what people concluded in the past) is that wrapping
Radius
in TLS, where the TLS layer only uses approved algorithms, is not good
enough for FIPS.
The inner radius packets are still used to make authentication decisions
based on security
methods that uses MD5, which is not allowed for FIPS.

Paul