Bug ID 711562: TLS1.3 handshake fails for RSA PSS SHA512 with netHSM RSA 1024-bit key

Last Modified: Sep 27, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.4, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1

Opened: Mar 23, 2018
Severity: 4-Minor

Symptoms

TLS1.3 handshake fails 1024-bit netHSM key with error message of "C_Sign with pss: pkcs11_rv=0x00000006, CKR_FUNCTION_FAILED".

Impact

C_Sign operation failed which leads to TLS1.3 handshake failed.

Conditions

netHSM 1024-bit RSA key is used

Workaround

Don't use netHSM 1024-bit RSA key, it is not safe and should not be recommended.

Fix Information

None

Behavior Change