Chapter 3. Using system-wide cryptographic policies
Crypto policies is a system component that configures the core cryptographic subsystems, covering the TLS, IPSec, SSH, DNSSec, and Kerberos protocols. It provides a small set of policies, which the administrator can select.
3.1. System-wide cryptographic policies
Once a system-wide policy is set up, applications in RHEL follow it and refuse to use algorithms and protocols that do not meet the policy, unless you explicitly request the application to do so. That is, the policy applies to the default behavior of applications when running with the system-provided configuration but you can override it if required so.
Red Hat Enterprise Linux 8 contains the following policy levels:
| The default system-wide cryptographic policy level offers secure settings for current threat models. It allows the TLS 1.2 and 1.3 protocols, as well as the IKEv2 and SSH2 protocols. The RSA keys and Diffie-Hellman parameters are accepted if they are at least 2048 bits long. |
|
This policy ensures maximum compatibility with Red Hat Enterprise Linux 5 and earlier; it is less secure due to an increased attack surface. In addition to the |
| A conservative security level that is believed to withstand any near-term future attacks. This level does not allow the use of SHA-1 in signature algorithms. The RSA keys and Diffie-Hellman parameters are accepted if they are at least 3072 bits long. |
|
A policy level that conforms with the FIPS 140-2 requirements. This is used internally by the |
Red Hat continuously adjusts all policy levels so that all libraries, except when using the LEGACY policy, provide secure defaults. Even though the LEGACY profile does not provide secure defaults, it does not include any algorithms that are easily exploitable. As such, the set of enabled algorithms or acceptable key sizes in any provided policy may change during the lifetime of the RHEL 8.
Such changes reflect new security standards and new security research. If you must ensure interoperability with a specific system for the whole lifetime of RHEL 8, you should opt-out from cryptographic-policies for components that interact with that system.
Because a cryptographic key used by a certificate on the Customer Portal API does not meet the requirements by the FUTURE
system-wide cryptographic policy, the redhat-support-tool
utility does not work with this policy level at the moment.
To work around this problem, use the DEFAULT
crypto policy while connecting to the Customer Portal API.
The specific algorithms and ciphers described in the policy levels as allowed are available only if an application supports them.
Tool for managing crypto policies
To view or change the current system-wide cryptographic policy, use the update-crypto-policies
tool, for example:
$ update-crypto-policies --show DEFAULT # update-crypto-policies --set FUTURE Setting system policy to FUTURE
To ensure that the change of the cryptographic policy is applied, restart the system.
Strong crypto defaults by removing insecure cipher suites and protocols
The following list contains cipher suites and protocols removed from the core cryptographic libraries in RHEL 8. They are not present in the sources, or their support is disabled during the build, so applications cannot use them.
- DES (since RHEL 7)
- All export grade cipher suites (since RHEL 7)
- MD5 in signatures (since RHEL 7)
- SSLv2 (since RHEL 7)
- SSLv3 (since RHEL 8)
- All ECC curves < 224 bits (since RHEL 6)
- All binary field ECC curves (since RHEL 6)
Cipher suites and protocols disabled in all policy levels
The following cipher suites and protocols are disabled in all crypto policy levels. They can be enabled only by an explicit configuration of individual applications.
- DH with parameters < 1024 bits
- RSA with key size < 1024 bits
- Camellia
- ARIA
- SEED
- IDEA
- Integrity-only cipher suites
- TLS CBC mode cipher suites using SHA-384 HMAC
- AES-CCM8
- All ECC curves incompatible with TLS 1.3, including secp256k1
- IKEv1 (since RHEL 8)
Cipher suites and protocols enabled in the crypto-policies levels
The following table shows the enabled cipher suites and protocols in all four crypto-policies levels.
LEGACY | DEFAULT | FIPS | FUTURE | |
---|---|---|---|---|
IKEv1 | no | no | no | no |
3DES | yes | no | no | no |
RC4 | yes | no | no | no |
DH | min. 1024-bit | min. 2048-bit | min. 2048-bit | min. 3072-bit |
RSA | min. 1024-bit | min. 2048-bit | min. 2048-bit | min. 3072-bit |
DSA | yes | no | no | no |
TLS v1.0 | yes | no | no | no |
TLS v1.1 | yes | no | no | no |
SHA-1 in digital signatures | yes | yes | no | no |
CBC mode ciphers | yes | yes | yes | no |
Symmetric ciphers with keys < 256 bits | yes | yes | yes | no |
SHA-1 and SHA-224 signatures in certificates | yes | yes | yes | no |
Additional resources
-
For more details, see the
update-crypto-policies(8)
man page.
3.2. Switching the system-wide cryptographic policy to mode compatible with earlier releases
The default system-wide cryptographic policy in Red Hat Enterprise Linux 8 does not allow communication using older, insecure protocols. For environments that require to be compatible with Red Hat Enterprise Linux 5 and in some cases also with earlier releases, the less secure LEGACY
policy level is available.
Switching to the LEGACY
policy level results in a less secure system and applications.
Procedure
To switch the system-wide cryptographic policy to the
LEGACY
level, enter the following command asroot
:# update-crypto-policies --set LEGACY Setting system policy to LEGACY
Additional resources
-
For the list of available cryptographic policy levels, see the
update-crypto-policies(8)
man page.
3.3. Switching the system to FIPS mode
The system-wide cryptographic policies contain a policy level that enables cryptographic modules self-checks in accordance with the requirements by the Federal Information Processing Standard (FIPS) Publication 140-2. The fips-mode-setup
tool that enables or disables FIPS mode internally uses the FIPS
system-wide cryptographic policy level.
Red Hat recommends installing Red Hat Enterprise Linux 8 with FIPS mode enabled, as opposed to enabling FIPS mode later. Enabling FIPS mode during the installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.
Procedure
To switch the system to FIPS mode in RHEL 8:
# fips-mode-setup --enable Setting system policy to FIPS FIPS mode will be enabled. Please reboot the system for the setting to take effect.
Restart your system to allow the kernel to switch to FIPS mode:
# reboot
Verification steps
After the restart, you can check the current state of FIPS mode:
# fips-mode-setup --check FIPS mode is enabled.
Additional resources
-
The
fips-mode-setup(8)
man page. - List of RHEL 8 applications using cryptography that are not compliant with FIPS 140-2
- For more details on FIPS 140-2, see the Security Requirements for Cryptographic Modules on the National Institute of Standards and Technology (NIST) web site.
3.4. Enabling FIPS mode in a container
To enable cryptographic modules self-checks in accordance with the requirements by Federal Information Processing Standard (FIPS) Publication 140-2 in a container:
Prerequisites
- The host system must be switched in FIPS mode first, see Switching the system to FIPS mode.
Procedure
-
Mount the
/etc/system-fips
file on the container from the host. Set the FIPS cryptographic policy level in the container:
$ update-crypto-policies --set FIPS
RHEL 8.2 introduced an alternative method for switching a container to FIPS mode. It requires only using the following command in the container:
# mount --bind /usr/share/crypto-policies/back-ends/FIPS /etc/crypto-policies/back-ends
In RHEL 8, the fips-mode-setup
command does not work properly in a container and it cannot be used to enable or check FIPS mode in this scenario.
3.5. List of RHEL applications using cryptography that is not compliant with FIPS 140-2
Red Hat recommends to utilize libraries from the core crypto components set, as they are guaranteed to pass all relevant crypto certifications, such as FIPS 140-2, and also follow the RHEL system-wide crypto policies.
See the RHEL 8 core crypto components article for an overview of the RHEL 8 core crypto components, the information on how are they selected, how are they integrated into the operating system, how do they support hardware security modules and smart cards, and how do crypto certifications apply to them.
In addition to the following table, in some RHEL 8 Z-stream releases (for example, 8.1.1), the Firefox browser packages have been updated, and they contain a separate copy of the NSS cryptography library. This way, Red Hat wants to avoid the disruption of rebasing such a low-level component in a patch release. As a result, these Firefox packages do not use a FIPS 140-2-validated module.
Table 3.1. List of RHEL 8 applications using cryptography that is not compliant with FIPS 140-2
Application | Details |
---|---|
FreeRADIUS | The RADIUS protocol uses MD5 |
ghostscript | Own crypto (MD5, RC4, SHA-2, AES) to encrypt and decrypt documents |
ipxe | Crypto stack for TLS is compiled in, however, it is unused |
java-1.8.0-openjdk | Full crypto stack[a] |
libica | Software fallbacks for various algorithms such as RSA and ECDH through CPACF instructions |
Ovmf (UEFI firmware), Edk2, shim | Full crypto stack (an embedded copy of the OpenSSL library) |
perl-Digest-HMAC | HMAC, HMAC-SHA1, HMAC-MD5 |
perl-Digest-SHA | SHA-1, SHA-224, … |
pidgin | DES, RC4 |
samba[b] | AES, DES, RC4 |
valgrind | AES, hashes[c] |
[a]
On RHEL 8.1, java-1.8.0-openjdk requires additional manual configuration to be FIPS-compliant.
[b]
Starting with RHEL 8.3, samba uses FIPS-compliant cryptography.
[c]
Re-implements in software hardware-offload operations, such as AES-NI.
|
3.6. Excluding an application from following system-wide crypto policies
You can customize cryptographic settings used by your application preferably by configuring supported cipher suites and protocols directly in the application.
You can also remove a symlink related to your application from the /etc/crypto-policies/back-ends
directory and replace it with your customized cryptographic settings. This configuration prevents the use of system-wide cryptographic policies for applications that use the excluded back end. Furthermore, this modification is not supported by Red Hat.
3.6.1. Examples of opting out of system-wide crypto policies
wget
To customize cryptographic settings used by the wget
network downloader, use --secure-protocol
and --ciphers
options. For example:
$ wget --secure-protocol=TLSv1_1 --ciphers="SECURE128" https://example.com
See the HTTPS (SSL/TLS) Options section of the wget(1)
man page for more information.
curl
To specify ciphers used by the curl
tool, use the --ciphers
option and provide a colon-separated list of ciphers as a value. For example:
$ curl https://example.com --ciphers '@SECLEVEL=0:DES-CBC3-SHA:RSA-DES-CBC3-SHA'
See the curl(1)
man page for more information.
Firefox
Even though you cannot opt out of system-wide cryptographic policies in the Firefox
web browser, you can further restrict supported ciphers and TLS versions in Firefox’s Configuration Editor. Type about:config
in the address bar and change the value of the security.tls.version.min
option as required. Setting security.tls.version.min
to 1
allows TLS 1.0 as the minimum required, security.tls.version.min 2
enables TLS 1.1, and so on.
OpenSSH
To opt out of the system-wide crypto policies for your OpenSSH
server, uncomment the line with the CRYPTO_POLICY=
variable in the /etc/sysconfig/sshd
file. After this change, values that you specify in the Ciphers
, MACs
, KexAlgoritms
, and GSSAPIKexAlgorithms
sections in the /etc/ssh/sshd_config
file are not overridden. See the sshd_config(5)
man page for more information.
Libreswan
See the Configuring IPsec connections that opt out of the system-wide crypto policies in the Securing networks document for detailed information.
Additional resources
-
For more details, see the
update-crypto-policies(8)
man page.
3.7. Customizing system-wide cryptographic policies with policy modifiers
Use this procedure to adjust certain algorithms or protocols of any system-wide cryptographic policy level or a full custom policy.
Customization of system-wide cryptographic policies is available from RHEL 8.2.
Procedure
Checkout to the
/etc/crypto-policies/policies/modules/
directory:# cd /etc/crypto-policies/policies/modules/
Create policy modules for your adjustments, for example:
# touch MYCRYPTO1.pmod # touch NO-AES128.pmod
ImportantUse upper-case letters in file names of policy modules.
Open the policy modules in a text editor of your choice and insert options that modify the system-wide cryptographic policy, for example:
# vi MYCRYPTO1.pmod
sha1_in_certs = 0 min_rsa_size = 3072
# vi NO-AES128.pmod
cipher = -AES-128-GCM -AES-128-CCM -AES-128-CTR -AES-128-CBC
- Save the changes in the module files.
Apply your policy adjustments to the
DEFAULT
system-wide cryptographic policy level:# update-crypto-policies --set DEFAULT:MYCRYPTO1:NO-AES128
To make your cryptographic settings effective for already running services and applications, restart the system:
# reboot
Additional resources
-
For more details, see the
Custom Policies
section in theupdate-crypto-policies(8)
man page and theCrypto Policy Definition Format
section in thecrypto-policies(7)
man page. - The How to customize crypto policies in RHEL 8.2 article provides additional examples of customizing system-wide cryptographic policies.
3.8. Disabling SHA-1 by customizing a system-wide cryptographic policy
The SHA-1 hash function has an inherently weak design and advancing cryptanalysis has made it vulnerable to attacks. By default, RHEL 8 does not use SHA-1 but some third party applications, for example public signatures, still use SHA-1. To disable the use of SHA-1 in signature algorithms on your system, you can use the NO-SHA1
policy module.
The module for disabling SHA-1 is available from RHEL 8.3. Customization of system-wide cryptographic policies is available from RHEL 8.2.
Procedure
Apply your policy adjustments to the
DEFAULT
system-wide cryptographic policy level:# update-crypto-policies --set DEFAULT:NO-SHA1
To make your cryptographic settings effective for already running services and applications, restart the system:
# reboot
Additional resources
-
For more details, see the
Custom Policies
section in theupdate-crypto-policies(8)
man page and theCrypto Policy Definition Format
section in thecrypto-policies(7)
man page. - The How to customize crypto policies in RHEL 8.2 blog post provides additional examples of customizing system-wide cryptographic policies.
3.9. Creating and setting a custom system-wide cryptographic policy
The following steps demonstrate customizing the system-wide cryptographic policies by a complete policy file.
Customization of system-wide cryptographic policies is available from RHEL 8.2.
Procedure
Create a policy file for your customizations:
# cd /etc/crypto-policies/policies/ # touch MYPOLICY.pol
Alternatively, start by copying one of the four predefined policy levels:
# cp /usr/share/crypto-policies/policies/DEFAULT.pol /etc/crypto-policies/policies/MYPOLICY.pol
Edit the file with your custom cryptographic policy in a text editor of your choice to fit your requirements, for example:
# vi /etc/crypto-policies/policies/MYPOLICY.pol
Switch the system-wide cryptographic policy to your custom level:
# update-crypto-policies --set MYPOLICY
To make your cryptographic settings effective for already running services and applications, restart the system:
# reboot
Additional resources
-
For more details, see the
Custom Policies
section in theupdate-crypto-policies(8)
man page and theCrypto Policy Definition Format
section in thecrypto-policies(7)
man page. - The How to customize crypto policies in RHEL 8.2 article provides additional examples of customizing system-wide cryptographic policies.