From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58456) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPs2m-0001FJ-S0 for qemu-devel@nongnu.org; Thu, 03 May 2012 05:09:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SPs2g-0003S8-Nb for qemu-devel@nongnu.org; Thu, 03 May 2012 05:09:48 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58091) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPs2g-0003RH-FR for qemu-devel@nongnu.org; Thu, 03 May 2012 05:09:42 -0400 Date: Thu, 3 May 2012 10:09:37 +0100 From: "Daniel P. Berrange" Message-ID: <20120503090937.GI24747@redhat.com> References: <20120502193256.6508.86360.stgit@sifl> <20120503082915.GF24747@redhat.com> <20120503085712.GG24747@redhat.com> <20120503090306.GH24747@redhat.com> <4FE1F453-EFDF-4126-8CC2-BD68A36A8053@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <4FE1F453-EFDF-4126-8CC2-BD68A36A8053@suse.de> Subject: Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alexander Graf Cc: Paul Moore , qemu-devel@nongnu.org On Thu, May 03, 2012 at 11:06:18AM +0200, Alexander Graf wrote: > > On 03.05.2012, at 11:03, Daniel P. Berrange wrote: > > > On Thu, May 03, 2012 at 11:01:29AM +0200, Alexander Graf wrote: > >> > >> On 03.05.2012, at 10:57, Daniel P. Berrange wrote: > >> > >>> On Thu, May 03, 2012 at 10:51:15AM +0200, Alexander Graf wrote: > >>>> > >>>> On 03.05.2012, at 10:29, Daniel P. Berrange wrote: > >>>> > >>>>> On Wed, May 02, 2012 at 03:32:56PM -0400, Paul Moore wrote: > >>>>>> FIPS 140-2 requires disabling certain ciphers, including DES, which is used > >>>>>> by VNC to obscure passwords when they are sent over the network. The > >>>>>> solution for FIPS users is to disable the use of VNC password auth when the > >>>>>> host system is operating in FIPS mode. > >>>> > >>>> So that means "no password" is more secure according to FIPS than > >>>> "DES encrypted password"? > >>> > >>> No, FIPS is not making statements about the choice of auth methods. > >>> FIPS is concerned with what encryption algorithms an application uses. > >>> The requirements about whether authentication is required & what sort, > >>> is upto other specifications (eg Common Criteria) to decide. > >> > >> Hrm, so short-term this fixes things. But long-term, I think the > >> better solution would be to implement the tight security model and > >> use a real cipher: > > > > That is certainly possible, but shouldn't have any bearing on whether > > this patch is accepted. Note that QEMU already implements VeNCrypt > > and SASL extensions both of which provide strong security > > Hmm. Isn't the syslog message misleading then? Also, why would the > whole password parameter be blocked then? The password parameter is irrelevant for VeNCrypt & SASL authentication types. They are configured via other parameters. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|