OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Using weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
OL 8 utilizes GRUB 2 as the default bootloader. Note that GRUB 2 command-line parameters are defined in the "kernelopts" variable of the /boot/grub2/grubenv file for all kernel boot entries. The command "fips-mode-setup" modifies the "kernelopts" variable, which in turn updates all kernel boot entries.
The fips=1 kernel option must be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users must also ensure the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a nonunique key.
If any algorithms include "SHA1" or a hash value less than "224", this is a finding.
If the "min_rsa_size" is not set to a value of at least "2048", this is a finding.
If these commands do not return any output, this is a finding.
Fix
Configure OL 8 to use a DoW-approved FIPS 140-3-compliant systemwide cryptographic policy.
Set the systemwide crypto-policy to FIPS with the following command:
$ sudo update-crypto-policies --set FIPS Setting system policy to FIPS
Note: Systemwide crypto-policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.