Public bug reported: On Ubuntu 24.04 LTS amd64, certmonger `0.79.19-1build4` fails to generate or rekey a PIN-encrypted FILE private key with OpenSSL/libssl3t64 `3.0.13-0ubuntu3.16` and active FIPS provider `3.0.13-0ubuntu3.15+Fips2`:
```text error:1C800070:Provider routines::invalid salt length ``` Reproduced by requesting a new RSA-3072 FILE key with a fresh 32-character random PIN in an isolated certmonger instance. The request remains in `NEED_KEY_PAIR` before enrollment-helper invocation, so no external CA is needed. A compatible precreated encrypted key can be read, but rekey encounters the same writer failure. For password-based storage encryption, [NIST SP 800-132 ยง5.1](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf#page=10) requires at least **128 random salt bits (16 bytes)** from an approved random-bit generator. [OpenSSL's PBKDF2 checks](https://docs.openssl.org/3.0/man7/EVP_KDF-PBKDF2/) enforce that salt minimum by default in the FIPS provider. In Ubuntu's [`0.79.19-1build4` source package](https://archive.ubuntu.com/ubuntu/pool/universe/c/certmonger/certmonger_0.79.19-1build4.dsc), `src/keygen-o.c` calls `PEM_write_PKCS8PrivateKey()` without selecting the salt length. The affected OpenSSL 3.0 PBES2 path supplies only **8 bytes (64 bits)**. The provider therefore rejects the key write before certificate enrollment. Please backport a fix to Noble that explicitly supplies a fresh random salt of at least 16 bytes while preserving the configured cipher, PIN handling, and provider checks. The defect is reported in [certmonger issue #340](https://codeberg.org/freeipa/certmonger/issues/340), with a proposed fix in [upstream PR #341](https://codeberg.org/freeipa/certmonger/pulls/341) and a [0.79.19 backport](https://codeberg.org/karlg100/certmonger/commit/e600f6de18d0570bb95d554d0aef597946f9277a). A local `0.79.19-1build4+pkcs8fix1` build from Ubuntu's source package, retaining its four existing patches, passes all eleven focused regression groups without skips. Native validation passes nine phases, including baseline controls. Candidate AES-128/AES-256 generation, manual same-key resubmission, rekey, and failed-write preservation pass with sixteen-byte salts and 2,048 iterations. Testing used package- extracted binaries and an offline synthetic CA; package installation/upgrade was not tested. The full automatic suite timed out during the chain-ordering test after 26 passes; further details are in PR #341. OpenSSL changed the default in [3.2](https://docs.openssl.org/3.2/man3/PKCS5_PBE_keyivgen/#history) through [PR #21858](https://github.com/openssl/openssl/pull/21858); its [maintainer discussion](https://github.com/openssl/openssl/pull/21858#issuecomment-1694946855) records the decision against backporting to 3.0/3.1. [Launchpad #2107773](https://bugs.launchpad.net/bugs/2107773) documents a related application-side salt fix in Dovecot; it does not repair certmonger's writer. ** Affects: certmonger (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172958 Title: Noble FIPS: certmonger encrypted FILE key generation and rekey fail To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/certmonger/+bug/2172958/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
