[Chr1st0ph3rTurn3r]

No description provided.

[migolnikov]

in 7.2.0-r1 we added https://128technology.atlassian.net/browse/I95-65332 which allows md5 use for BGP even when FIPS is enabled. I am not sure if this is a configurable feature and if this documented elsewhere.

[Chr1st0ph3rTurn3r]

@migolnikov I have a question about this then. I looked up the Jira issue, and it is documented in the release notes. According to Ayan, it is not configurable, so it is not going to prevent auth-password from working. From what I understand though, it will however compromise the FIPS security, so I think the note needs to be reworked to be clearer for that situation. Would you agree?

[Chr1st0ph3rTurn3r]

This comment is for Bob and the folks on his team to review. Here is my proposed wording based on the info I have gathered on the impact of the change in 7.2 to BGP and MD5 on FIPS enabled devices:

:::important
BGP neighbor authentication (the [`auth-password`](config_command_guide.md#configure-authority-router-routing-routing-protocol-neighbor-auth-password) parameter) uses **MD5**. 

SSR4x0 series devices have **FIPS mode enabled by default**, and with versions 7.0.x and 7.1.x FIPS enforcement prevents the use of non-FIPS-compliant cryptographic algorithms such as **MD5** and **SHA-1**. This affects features that rely on these algorithms, so BGP sessions configured with `auth-password` will fail to establish until FIPS is disabled on the affected node.

With the release of software version 7.2.x, MD5 is allowed for devices with FIPS mode enabled. **However, the use of MD5 is strictly prohibited for secure hashing and cryptographic authentication by FIPS 140 because MD5 is vulnerable to collision attacks and considered legacy from a compliance standpoint. The use of these legacy BGP and MSDP protocols with TCP MD5 authentication enabled is outside of the SSR cryptographic module boundary, and is not covered by the FIPS power-on self-tests.**

If your deployment requires FIPS compliance, it is not recommended to use features such as BGP Neighbor Authentication which include MD5 authentication. If your 7.0.x or 7.1.x deployment **does not require FIPS compliance** and you wish to disable FIPS mode, refer to the disable procedure on the [conductor install page](single_conductor_install.mdx#fips-enforcement-mode) or in [Troubleshooting IDP](ts_idp.md#fips-mode-and-idp).
:::

[aayan-AIDE]

Couple things:

1. "BGP sessions configured with auth-password will fail to establish until FIPS is disabled" - BGP sessions will actually come up fine, they just will not use md5 over the tcp connection.
2. "With the release of software version 7.2.x, MD5 is allowed for devices with FIPS mode". I thought we would have two images per version - one which denies MD5 in FIPS (old / current behavior) and one which allows MD5 in FIPS (added in https://128technology.atlassian.net/browse/I95-65332). I may be wrong about this.

[Chr1st0ph3rTurn3r]

I need to know for sure what the reality is - I can't image we are providing multiple images of a single software version that enable different features.

[MichaelBaj]

We are not going to be creating multiple software assets for the same version of software (save for x86 and aarch64)