AWS cloudhsm high security documentation change
Summary
Added documentation for new issue: ECDSA signing fails with 'invalid mechanism' error due to FIPS 186-5 hash strength requirements
Security assessment
The change documents a security compliance requirement (FIPS 186-5) that enforces cryptographic strength matching between hash functions and ECDSA keys. This prevents the use of weak hash algorithms that could compromise signature security. The error message explicitly references security strength validation failures.
Diff
diff --git a/cloudhsm/latest/userguide/ki-all.md b/cloudhsm/latest/userguide/ki-all.md index 77b2289a0..f3688565f 100644 --- a//cloudhsm/latest/userguide/ki-all.md +++ b//cloudhsm/latest/userguide/ki-all.md @@ -5 +5 @@ -Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8" +Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8"Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16 @@ -34,0 +35,2 @@ The following issues impact all AWS CloudHSM users regardless of whether they us + * Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16 + @@ -148,0 +151,15 @@ This error is caused by an update to Instance Metadata Service Version 2 (IMDSv2 +## Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16 + + * **Impact:** ECDSA signing operations fail when using hash functions that are too weak compared to the key strength. This failure occurs because [FIPS 186-5](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf) requires the hash function to be at least as strong as the key strength. + +You might see an error similar to this in your client logs: + + [cloudhsm_provider::hsm1::session::ecdsa::sign::common][][] Digest security strength (80) is weaker than the key security strength (128) + + * **Workaround:** If you can't update your hash functions, you can migrate to non-FIPS clusters, which don't enforce the hash strength requirement. However, we recommend updating your hash functions to maintain FIPS compliance. + + * **Resolution:** Use a hash function that is at least as strong as your ECDSA key. For information about hash function and ECDSA key strengths, see Tables 2 and 3 in [NIST SP 800-57 Part 1 Rev 5](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf). + + + +