Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode

["Daniel P. Berrange" <berrange@redhat.com>]

On Thu, May 03, 2012 at 11:06:18AM +0200, Alexander Graf wrote:
> 
> On 03.05.2012, at 11:03, Daniel P. Berrange wrote:
> 
> > On Thu, May 03, 2012 at 11:01:29AM +0200, Alexander Graf wrote:
> >> 
> >> On 03.05.2012, at 10:57, Daniel P. Berrange wrote:
> >> 
> >>> On Thu, May 03, 2012 at 10:51:15AM +0200, Alexander Graf wrote:
> >>>> 
> >>>> On 03.05.2012, at 10:29, Daniel P. Berrange wrote:
> >>>> 
> >>>>> On Wed, May 02, 2012 at 03:32:56PM -0400, Paul Moore wrote:
> >>>>>> FIPS 140-2 requires disabling certain ciphers, including DES, which is used
> >>>>>> by VNC to obscure passwords when they are sent over the network.  The
> >>>>>> solution for FIPS users is to disable the use of VNC password auth when the
> >>>>>> host system is operating in FIPS mode.
> >>>> 
> >>>> So that means "no password" is more secure according to FIPS than
> >>>> "DES encrypted password"?
> >>> 
> >>> No, FIPS is not making statements about the choice of auth methods.
> >>> FIPS is concerned with what encryption algorithms an application uses.
> >>> The requirements about whether authentication is required & what sort,
> >>> is upto other specifications (eg Common Criteria) to decide.
> >> 
> >> Hrm, so short-term this fixes things. But long-term, I think the 
> >> better solution would be to implement the tight security model and
> >> use a real cipher:
> > 
> > That is certainly possible, but shouldn't have any bearing on whether
> > this patch is accepted. Note that QEMU already implements VeNCrypt
> > and SASL extensions both of which provide strong security
> 
> Hmm. Isn't the syslog message misleading then? Also, why would the
> whole password parameter be blocked then?

The password parameter is irrelevant for VeNCrypt & SASL authentication
types. They are configured via other parameters.


Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|