FIPS-related Error: Password Must Be at Least 112 Bits on Postgres 14, Unlike in Postgres 11

From: Abhishek Dasgupta <abhishekdasgupta005(at)gmail(dot)com>
To: pgsql-general(at)lists(dot)postgresql(dot)org
Subject: FIPS-related Error: Password Must Be at Least 112 Bits on Postgres 14, Unlike in Postgres 11
Date: 2023-06-22 13:46:21
Message-ID: CAA93efm3bgqfyaR0YmaQ1N=uNhjMx8SA-UPXNPV6j669c9eGYQ@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Hey PostgreSQL experts,

I have encountered an issue related to FIPS mode while setting up two
different configurations. The first configuration consists of PostgreSQL 11
with MD5 password encryption and FIPS mode enabled. The second
configuration involves PostgreSQL 14 with scram-sha-256 password encryption
and FIPS mode enabled. Both configurations can be used as a database in a
cluster.

The OpenSSL version I am using is OpenSSL 1.0.2zd-fips, released on 15th
March 2022.

During the cluster setup, specifically the database setup, I have observed
that the first configuration sets up successfully. However, the second
configuration with PostgreSQL 14 fails with the following error:

Exception in thread "main"
com.safelogic.cryptocomply.crypto.fips.FipsUnapprovedOperationError:
password must be at least 112 bits
at com.safelogic.cryptocomply.crypto.fips.FipsPBKD$Parameters.<init>(FipsPBKD.java:90)
at com.safelogic.cryptocomply.crypto.fips.FipsPBKD$Parameters.<init>(FipsPBKD.java:63)
at com.safelogic.cryptocomply.crypto.fips.FipsPBKD$ParametersBuilder.using(FipsPBKD.java:56)
at com.safelogic.cryptocomply.jcajce.provider.ProvPBEPBKDF2$BasePBKDF2.engineGenerateSecret(ProvPBEPBKDF2.java:249)
at javax.crypto.SecretKeyFactory.generateSecret(SecretKeyFactory.java:336)
at org.postgresql.shaded.com.ongres.scram.common.util.CryptoUtil.hi(CryptoUtil.java:120)
at org.postgresql.shaded.com.ongres.scram.common.ScramMechanisms.saltedPassword(ScramMechanisms.java:154)
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.saltedPassword(ScramFunctions.java:59)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:196)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:163)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ServerFirstProcessor.clientFinalProcessor(ScramSession.java:130)
at org.postgresql.jre7.sasl.ScramAuthenticator.processServerFirstMessage(ScramAuthenticator.java:147)
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:778)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:161)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:225)

I am puzzled as to why this error occurs only with PostgreSQL 14 and not
with PostgreSQL 11.

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Dominique Devienne 2023-06-22 14:16:03 Re: Catalog for LISTEN'ed to notification channels?
Previous Message Tom Lane 2023-06-22 13:29:59 Re: Catalog for LISTEN'ed to notification channels?