add toggle to use fips

[iamkrillin]

Pulled the code from @mcclouden on issue #190. Added a toggle to BaseClient to enable/disable fips mode

[sunilvijendra]

Any plan to merge the FIPS toggle changes?

[A9G-Data-Droid]

I have tested this and it works!

[daniellangemann]

I'll add my vote - any plans to merge the FIPS toggle changes? This seems like a safe and straightforward solution.

[drieseng]

I'd prefer going for a builder pattern where the "user" explicitly adds whatever algorithms he/she wants.

[epatrick]

Any update on this PR? We've run into conflicts with Windows FIPS turned on as part of AWS' current STIG for Windows 2022 boxes.

[A9G-Data-Droid]

@epatrick My develop branch works on FIPS systems: https://github.com/A9G-Data-Droid/SSH.NET

This library hasn't seen an update since Jan 24, 2021 so I'm not waiting around for the next version to support it.

[mari3728]

Will this PR be included anytime soon?

[Rob-Hague]

It should not be necessary. AFAIK, on .NET Framework the Create methods already return a CryptoServiceProvider instance, and .NET Core forwards implementations to the OS through which FIPS is controlled (.NET Core Federal Information Processing Standard (FIPS) compliance). CryptoServiceProvider and other derived cryptographic types are obsolete (SYSLIB0021).

[WojciechNagorski]

@Rob-Hague So when we release a new version supporting .NET 7, could we close this PR?

[Rob-Hague]

There is maybe still a need to disable MD5, but the rest of the changes (CryptoServiceProvider etc.) should not be needed.

Disclaimer: not an expert

[mari3728]

on .NET Framework the Create methods already return a CryptoServiceProvider instance

I see, and agree for SHA implementations.
From my understanding, on .NET Framework MD5CryptoServiceProvider does not use an alternative implementation if the FIPS policy is enabled, and it uses clr.dll underneath (calling with QCall), which is not validated by NIST for FIPS compliance. Plus, the algorithm itself is not permitted.

So this:

There is still a need to disable MD5, but the rest of the changes (CryptoServiceProvider etc.) should not be needed.

is true from my understanding.

Should there be a PR to treat MD5 only then?

Disclaimer: also not an expert, just trying to understand FIPS enforcement for .NET (and going insane haha)

[Rob-Hague]

Ok I spoke too assertively and you may replace my comments with "I don't know" but what you have said makes sense, and my answer to

Should there be a PR to treat MD5 only then?

is "I guess", but I'm not sure how easy it will be to test

[A9G-Data-Droid]

In relation to this PR, you could eliminate both the bool UseFIPS and the MD5 methods entirely. That would make it work both in and outside of a FIPS mode OS. Some sort of PR is still required. You should be seeing those warnings about the MD5 methods being obsolete. We need to do something to remove them.

[A9G-Data-Droid]

This PR can be closed as the latest version is working on FIPS enabled computers. I think this was closed by #1293