usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Tweak SSH rules for FIPS 186-5 addition of curve25519-sha256 #195

New Issue
Closed
opened 2026-01-19 18:29:36 +00:00 by michael · 5 comments
michael commented 2026-01-19 18:29:36 +00:00
Owner
Copy Link

Originally created by @GaryGapinski on GitHub.

Summary

FIPS 186-5 adds Ed25519 curve in §7. See also NIST SP 800-186.

Steps to reproduce

That curve was previously not an approved algorithm.

Operating System version

Any current or subsequent macOS version with old (older than FIPS 186-5) CMVP validation should exclude curve25519-sha256 in KexAlgorithms in /etc/ssh/sshd/config.

Any macOS version after FIPS 186-5 publication should probably† allow curve25519-sha256 in KexAlgorithms in /etc/ssh/sshd/config.

† Though the macOS version may not have been validated with that algorithm, so perhaps there is a need to wait for a novel validation.

Intel or Apple Silicon

CMVP module validations can be hardware-specific.

What is the current bug behavior?

Not tested.

What is the expected correct behavior?

curve25519-sha256 should be allowed in KexAlgorithmsin /etc/ssh/sshd/config.

Possible fixes

macOS CMVP validation-tracking versions for os_sshd_fips_compliant.yaml (e.g.).

Originally created by @GaryGapinski on GitHub. ### Summary [FIPS 186-5](https://csrc.nist.gov/publications/detail/fips/186/5/final) adds Ed25519 curve in §7. See also NIST [SP 800-186](https://csrc.nist.gov/publications/detail/sp/800-186/final). ### Steps to reproduce That curve was previously not an approved algorithm. ### Operating System version Any current or subsequent macOS version with old (older than FIPS 186-5) CMVP validation should exclude `curve25519-sha256` in `KexAlgorithms` in `/etc/ssh/sshd/config`. Any macOS version after FIPS 186-5 publication should probably† allow `curve25519-sha256` in `KexAlgorithms` in `/etc/ssh/sshd/config`. † Though the macOS version may not have been validated with that algorithm, so perhaps there is a need to wait for a novel validation. ### Intel or Apple Silicon [CMVP module validations](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search?SearchMode=Basic&Vendor=Apple&CertificateStatus=Active&ValidationYear=0) can be hardware-specific. ### What is the current *bug* behavior? Not tested. ### What is the expected *correct* behavior? `curve25519-sha256 `should be allowed in `KexAlgorithms`in `/etc/ssh/sshd/config`. ### Possible fixes macOS CMVP validation-tracking versions for `os_sshd_fips_compliant.yaml` ([e.g.](https://github.com/usnistgov/macos_security/blob/10705d95975fedf195d73ca1f0200ecc1b5c6158/rules/os/os_sshd_fips_compliant.yaml#L12)).
michael commented 2026-01-19 18:29:36 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Closing for now. It's up to Apple to add it to it's approved algorithms in SSH.

@robertgendler commented on GitHub: Closing for now. It's up to Apple to add it to it's approved algorithms in SSH.
michael commented 2026-01-19 18:29:36 +00:00
Author
Owner
Copy Link

@GaryGapinski commented on GitHub:

Also, ditch all finite field Diffie-Hellman algorithms (diffie-hellman-*) since they are unnecessary and no one bothers to recompute /etc/ssh/moduli. Ignore any with an @.

@GaryGapinski commented on GitHub: Also, ditch all finite field Diffie-Hellman algorithms (`diffie-hellman-*`) since they are unnecessary and no one bothers to recompute `/etc/ssh/moduli`. Ignore any with an `@`.
michael commented 2026-01-19 18:29:36 +00:00
Author
Owner
Copy Link

@GaryGapinski commented on GitHub:

I agree. I think that means another CMVP validation (in which proper operation is tested). I am not in a position to test macOS FIPS mode but until FIPS 186-5 came out curve25519-sha256 should have been rejected. There are likely other algorithm changes but I haven't had time to closely read 186-5 (which is not an easy read; neither is SP 800-186). But it is usable despite being not previously allowed. Perhaps not in strict FIPS mode.

gapinski@flexion-mac-C02FCBVSMD6N macos_security % ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
curve25519-sha256@libssh.org
sntrup761x25519-sha512@openssh.com
gapinski@flexion-mac-C02FCBVSMD6N macos_security %
@GaryGapinski commented on GitHub: I agree. I think that means another CMVP validation (in which proper operation is tested). I am not in a position to test macOS FIPS mode but until FIPS 186-5 came out curve25519-sha256 should have been rejected. There are likely other algorithm changes but I haven't had time to closely read 186-5 (which is not an easy read; neither is SP 800-186). But it is usable despite being not previously allowed. Perhaps not in strict FIPS mode. ``` gapinski@flexion-mac-C02FCBVSMD6N macos_security % ssh -Q kex diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 curve25519-sha256 curve25519-sha256@libssh.org sntrup761x25519-sha512@openssh.com gapinski@flexion-mac-C02FCBVSMD6N macos_security % ```
michael commented 2026-01-19 18:29:36 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@GaryGapinski I believe Apple is going to have to update their validated algorithms.

@robertgendler commented on GitHub: @GaryGapinski I believe Apple is going to have to update their validated algorithms.
michael commented 2026-01-19 18:29:36 +00:00
Author
Owner
Copy Link

@GaryGapinski commented on GitHub:

https://support.apple.com/guide/certifications/macos-security-certifications-apc35eb3dc4fa/1/web/1.0 has some interesting information.

@GaryGapinski commented on GitHub: https://support.apple.com/guide/certifications/macos-security-certifications-apc35eb3dc4fa/1/web/1.0 has some interesting information.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#195
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?