Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenAPI.NET.OData is not FIPS compliant #39

Closed
mispeer opened this issue Aug 2, 2019 · 2 comments
Closed

OpenAPI.NET.OData is not FIPS compliant #39

mispeer opened this issue Aug 2, 2019 · 2 comments
Assignees
Labels
priority:p2 Medium. Generally has a work-around and a smaller sub-set of customers is affected. SLA <=30 days type:enhancement Enhancement request targeting an existing experience.
Milestone

Comments

@mispeer
Copy link
Contributor

mispeer commented Aug 2, 2019

Short summary (3-5 sentences) describing the issue.
Converter uses MD5 hash, which is not FIPS compliant. Full functionality failure in any environment with FIPS compliance enabled.

Assemblies affected

Reader.
Which assemblies and versions are known to be affected?
All.

Steps to reproduce

Enable FIPS compliance on the environment where the converter is executing.
The simplest set of steps to reproduce the issue. If possible, reference a commit that demonstrates the issue.

Expected result

Converter does not crash
What would happen if there wasn't a bug.

Actual result

Converter crashes with FIPS compliance runtime error.
What is actually happening.

Additional detail

Oracle listing FIPS non-compliant algorithms:https://docs.oracle.com/cd/E36784_01/html/E54953/fips-notok-1.html
NIST draft of 2019 FIPS compliant algorithms: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf
*Optional, details of the root cause if known.

@darrelmiller darrelmiller added the type:enhancement Enhancement request targeting an existing experience. label Jan 27, 2021
@darrelmiller
Copy link
Member

Here's a hash using SHA256 https://github.com/microsoft/kiota/blob/main/src/kiota.core/OpenApiUriSpaceNode.cs#L61 However, we should reinvestigate why exactly we need the hash.

@darrelmiller darrelmiller added the priority:p2 Medium. Generally has a work-around and a smaller sub-set of customers is affected. SLA <=30 days label Mar 1, 2022
@darrelmiller darrelmiller added this to the OData:1.2 milestone Sep 8, 2022
@millicentachieng millicentachieng self-assigned this Dec 20, 2022
@millicentachieng millicentachieng modified the milestones: OData:1.2, OData:1.3 Jan 20, 2023
@irvinesunday irvinesunday modified the milestones: OData:1.3, OData:1.4 Mar 29, 2023
@millicentachieng
Copy link
Member

After a review of our codebase, we exclusively use the System.Security.Cryptography library and the SHA-256 algorithm, which adhere to FIPS compliance requirements.

If you have any evidence or concerns indicating non-compliance or using a different hashing algorithm, please feel free to reopen this issue, and we will promptly address it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority:p2 Medium. Generally has a work-around and a smaller sub-set of customers is affected. SLA <=30 days type:enhancement Enhancement request targeting an existing experience.
Projects
None yet
Development

No branches or pull requests

4 participants