FIPS compliant cryptography

[cmleigh]

I deployed WebJea only changing site specific info (node,cert). Everything completed with no errors at that point. Opened up browser to https://fqdn/webjea and received: "There was an error."

*note - I had to sanitize hostname and account names

FIPS does not support SHA256Managed. Can you support FIPS compliant cryptography other than System.Security.Cryptography.SHA256Managed..ctor() ? Or is there a workaround other than disabling FIPS?

The logs from the web event:

`Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 9/28/2021 11:57:39 AM
Event time (UTC): 9/28/2021 3:57:39 PM
Event ID: a5d420a67a8f4db2aebd9b624d4dbea9
Event sequence: 8
Event occurrence: 1
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1/ROOT/WebJEA-1-132773182583222319
Trust level: Full
Application Virtual Path: /WebJEA
Application Path: S:\inetpub\wwwroot\webjea\
Machine name: hostname

Process information:
Process ID: 4244
Process name: w3wp.exe
Account name: service account

Exception information:
Exception type: InvalidOperationException
Exception message: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
at System.Security.Cryptography.SHA256Managed..ctor()
at WebJEA.Helpers.StringHash256(String strin) in C:\prj\WebJEA\WebJEA\Helpers.vb:line 42
at WebJEA._default.Page_Load(Object sender, EventArgs e) in C:\prj\WebJEA\WebJEA\default.aspx.vb:line 19
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Request information:
Request URL: https://fqdn:443/webjea/default.aspx
Request path: /webjea/default.aspx
User host address: xxxxxxxxx
User: user
Is authenticated: True
Authentication Type: Negotiate
Thread account name: service account

Thread information:
Thread ID: 12
Thread account name: service account
Is impersonating: False
Stack trace: at System.Security.Cryptography.SHA256Managed..ctor()
at WebJEA.Helpers.StringHash256(String strin) in C:\prj\WebJEA\WebJEA\Helpers.vb:line 42
at WebJEA._default.Page_Load(Object sender, EventArgs e) in C:\prj\WebJEA\WebJEA\default.aspx.vb:line 19
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)`

[markdomansky]

This is an interesting question. I've not worked with FIPS. A brief search indicates that .NET should automatically manage SHA256 FIPS compliance but maybe I've not called it in a way .NET handles it correctly. Give me some time to look into this.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[cmleigh]

https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.sha256managed.-ctor?view=net-6.0
SHA256Managed Constructor
InvalidOperationException
The Federal Information Processing Standards (FIPS) security setting is enabled. This implementation is not part of the Windows Platform FIPS-validated cryptographic algorithms.

What about SHA256Create()?