This update for OpenJDK improves the support for when the system is running in FIPS mode. It introduces a key exporter which will allow the export of keys in plain from the NSS Software Token while in FIPS mode.
The scope will be initially constrained to keys of CKO_SECRET_KEY class, as this is what we require for TLS 1.3 key-derivation in FIPS mode (coming soon). In the future, we might extend the exporter functionality to support keys of CKO_PRIVATE_KEY class.
As with the importer functionality, the exporter can be disabled by means of the 'com.redhat.fips.plainKeySupport' system property: -Dcom.redhat.fips.plainKeySupport=false. The default behaviour is enabled.
This update also fixes a permissions bug which was found with the importer code.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2022-e0a81e06baPlease log in to add feedback.
This update has been submitted for testing by ahughes.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
Works.
works
This update can be pushed to stable now if the maintainer wishes
Working fine.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.