[GitHub] wohali commented on issue #1171: couchdb unable to run on FIPS enabled CentOS

[GitBox <gi...@apache.org>]

wohali commented on issue #1171: couchdb unable to run on FIPS enabled CentOS
URL: https://github.com/apache/couchdb/issues/1171#issuecomment-366028487
 
 
   Thanks @Nanonid .
   
   As mentioned on IRC, CouchDB relies on MD5 hashes of documents for consistency guarantees. MD5 is not a FIPS-compliant hash algorithm, so technically CouchDB is not FIPS-compliant.
   
   You may be able to work around this by using erlang's built in md5 function `erlang:md5` instead of our call to `crypto:hash(md5, ...)` which calls out to openssl, causing the failure that you see. However, this is only a workaround that FIPS-mode RHEL doesn't know about - it doesn't actually make CouchDB FIPS-compliant. Only you can know if this is acceptable for your needs! :)
   
   You could similarly do a search-and-replace on the md5 algorithm in the code and substitute one of the FIPS-compliant algorithms, such as `SHA-512` or `SHA-256` (with `SHA-512` testing fastest on modern hardware, due to processor acceleration). However, this will break replication with other CouchDBs, as the `_rev` tokens and the `Content-MD5` header will no longer match.
   
   Improving our hash algorithm is something we'd like to do long-term, but obviously backwards compatibility needs to be thought out in greater detail. We'd probably need to add support for alternate hashing algorithms in a minor release, then move to a new default in a major release.
   
   Big thanks to @rnewson for his brainstorming on this as well.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services