DAOSSDE-112 Security: Modifications to use of Cryptography by dpquigl · Pull Request #3923 · daos-stack/daos

dpquigl · 2020-11-21T19:06:35Z

After peer review the following modifications were requested.

Remove cipher suite AES128-GCM-SHA256 and just offer AES256-GCM-SHA384 as
default.
Reduce certificates to one year lifetime (currently three years)
Replace PKCS Adding a .travis.yml file to trigger CI builds. #1 v1.2 with PKCS Adding a .travis.yml file to trigger CI builds. #1 v2.1/2 if possible. The golang core library
is being used and may not support it yet. Team to verify if it does and, if so,
will try to update.
Add to documentation recommending to customer to use the latest version of
OpenSSL >= 1.1.1h. For this project, the customer is responsible for generating
keys/certs.
Reduce key sizes to 3072 based on expected lifetime of this product

Signed-off-by: David Quigley david.quigley@intel.com

After peer review the following modifications were requested. * Remove cipher suite AES128-GCM-SHA256 and just offer AES256-GCM-SHA384 as default. * Reduce certificates to one year lifetime (currently three years) * Replace PKCS #1 v1.2 with PKCS #1 v2.1/2 if possible. The golang core library is being used and may not support it yet. Team to verify if it does and, if so, will try to update. * Add to documentation recommending to customer to use the latest version of OpenSSL >= 1.1.1h. For this project, the customer is responsible for generating keys/certs. * Reduce key sizes to 3072 based on expected lifetime of this product Signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1

LGTM. No errors found by checkpatch.

daosbuild1 · 2020-11-21T19:34:04Z

Test stage Build DEB on Ubuntu 20.04 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/2/execution/node/273/log

daosbuild1 · 2020-11-21T19:36:11Z

Test stage Build RPM on CentOS 7 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/2/execution/node/329/log

daosbuild1 · 2020-11-21T19:42:09Z

Test stage Build RPM on Leap 15 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/2/execution/node/280/log

daosbuild1 · 2020-11-21T20:11:55Z

Test stage Unit Test completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/2/execution/node/652/log

mjmac

The switch to PSS makes sense, as does the removal of support for the smaller cipher suites. I'm wondering what the motivation is behind decreasing the key size and CA validity period, though.

mjmac · 2020-11-23T12:38:55Z

    echo "Generating Private CA Root Certificate"
    # Generate Private key and set permissions
-    openssl genrsa -out "${PRIVATE}/daosCA.key" 4096
+    openssl genrsa -out "${PRIVATE}/daosCA.key" 3072


Why the drop in key size?

To be honest I'm not entirely sure. This was the guidance from the crypto team. I'd imagine its due to the fact that 3072 bit keys are computationally difficult enough to break and since its software not hardware that we can update the number if that turns out not to be true in the future.

I think probably a balance between performance and security.
This is what I got on boro-59, there is no option for rsa 3072 size, but it shows the CPU time for the key size:

[boro-59:/home/huakuang]$ openssl speed rsa2048 rsa4096
sign verify sign/s verify/s
rsa 2048 bits 0.000791s 0.000033s 1264.8 30152.7
rsa 4096 bits 0.007899s 0.000121s 126.6 8276.1

mjmac · 2020-11-23T12:52:13Z

    chmod 0400 "${PRIVATE}/daosCA.key"
    # Generate CA Certificate
-    openssl req -new -x509 -config "${CA_HOME}/ca.cnf" -days 1095  -sha512 \
+    openssl req -new -x509 -config "${CA_HOME}/ca.cnf" -days 365  -sha512 \


Why is the CA cert only valid for a year?

I believe this is considered best practice for internally run and managed CAs.

…different. Signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1

LGTM. No errors found by checkpatch.

daosbuild1 · 2020-11-23T15:25:39Z

Test stage Build DEB on Ubuntu 20.04 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/3/execution/node/342/log

daosbuild1 · 2020-11-23T15:29:04Z

Test stage Build RPM on Leap 15 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/3/execution/node/287/log

daosbuild1 · 2020-11-23T16:01:45Z

Test stage Unit Test completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/3/execution/node/647/log

GitHuaKuang

grep found some TLS_RSA_WITH_AES_128_GCM_SHA256 usage in src/control/vendor, wonder if we need to change these possibly "vendor" files?
./control/vendor/golang.org/x/net/http2/ciphers.go: cipher_TLS_RSA_WITH_AES_128_GCM_SHA256 uint16 = 0x009C
./control/vendor/golang.org/x/net/http2/ciphers.go: cipher_TLS_RSA_WITH_AES_128_GCM_SHA256,
./control/vendor/google.golang.org/grpc/credentials/tls.go: tls.TLS_RSA_WITH_AES_128_GCM_SHA256: TLS_RSA_WITH_AES_128_GCM_SHA256",

…ning hashes. This uses a seeded PRNG to generate the same salt every time. Signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1

LGTM. No errors found by checkpatch.

daosbuild1 · 2020-11-23T17:22:05Z

Test stage Build DEB on Ubuntu 20.04 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/5/execution/node/299/log

daosbuild1 · 2020-11-23T17:23:00Z

Test stage Build RPM on CentOS 7 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/5/execution/node/270/log

daosbuild1 · 2020-11-23T17:27:04Z

Test stage Build RPM on Leap 15 completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/5/execution/node/303/log

dpquigl · 2020-11-23T18:28:54Z

@GitHuaKuang We dont have to be concerned with what is in vendor. Those are just supported by those libraries but in our code we say we're only advertising that we support that one cipher suite.

Skip-func-test-leap15:true signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1

LGTM. No errors found by checkpatch.

daosbuild1 · 2020-11-24T07:33:20Z

Test stage Functional_Hardware_Medium completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/6/execution/node/1062/log

daosbuild1 · 2020-11-24T14:46:41Z

Test stage Functional_Hardware_Large completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-3923/6/execution/node/1137/log

mjmac · 2020-11-24T17:33:13Z

Failures are not related to crypto changes.

dpquigl requested review from dinghwah, kjacque and mjmac November 21, 2020 19:06

dpquigl force-pushed the dpquigl/DAOSDE-112 branch from 7cc11d9 to a1bba2d Compare November 21, 2020 19:08

daosbuild1 reviewed Nov 21, 2020

View reviewed changes

mjmac reviewed Nov 23, 2020

View reviewed changes

Regenerate golden files since padding for the RSA signatures will be …

52c3b90

…different. Signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1 reviewed Nov 23, 2020

View reviewed changes

GitHuaKuang reviewed Nov 23, 2020

View reviewed changes

dpquigl added 2 commits November 23, 2020 09:54

Fix golden file generation since PSS will create random salts for sig…

079b443

…ning hashes. This uses a seeded PRNG to generate the same salt every time. Signed-off-by: David Quigley <david.quigley@intel.com>

Merge branch 'master' into dpquigl/DAOSSDE-112

7a3a961

daosbuild1 reviewed Nov 23, 2020

View reviewed changes

Merge branch 'master' into dpquigl/DAOSSDE-112

23baa93

Skip-func-test-leap15:true signed-off-by: David Quigley <david.quigley@intel.com>

daosbuild1 reviewed Nov 23, 2020

View reviewed changes

dpquigl requested review from GitHuaKuang and mjmac November 24, 2020 17:28

mjmac merged commit 5d7c051 into master Nov 24, 2020

mjmac deleted the dpquigl/DAOSDE-112 branch November 24, 2020 17:35

Conversation

dpquigl commented Nov 21, 2020

Uh oh!

daosbuild1 left a comment

Choose a reason for hiding this comment

Uh oh!

daosbuild1 commented Nov 21, 2020

Uh oh!

daosbuild1 commented Nov 21, 2020

Uh oh!

daosbuild1 commented Nov 21, 2020

Uh oh!

daosbuild1 commented Nov 21, 2020

Uh oh!

mjmac left a comment

Choose a reason for hiding this comment

Uh oh!

mjmac Nov 23, 2020

Choose a reason for hiding this comment

Uh oh!

dpquigl Nov 23, 2020

Choose a reason for hiding this comment

Uh oh!

GitHuaKuang Nov 23, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mjmac Nov 23, 2020

Choose a reason for hiding this comment

Uh oh!

dpquigl Nov 23, 2020

Choose a reason for hiding this comment

Uh oh!

daosbuild1 left a comment

Choose a reason for hiding this comment

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

GitHuaKuang left a comment

Choose a reason for hiding this comment

Uh oh!

daosbuild1 left a comment

Choose a reason for hiding this comment

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

daosbuild1 commented Nov 23, 2020

Uh oh!

dpquigl commented Nov 23, 2020

Uh oh!

daosbuild1 left a comment

Choose a reason for hiding this comment

Uh oh!

daosbuild1 commented Nov 24, 2020

Uh oh!

daosbuild1 commented Nov 24, 2020

Uh oh!

mjmac commented Nov 24, 2020

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

GitHuaKuang Nov 23, 2020 •

edited

Loading