FIPS mode breaks AzureRM

[pburkholder]

Cmdlet(s)

Almost all

PowerShell Version

5.1.14409.1005

Module Version

2.7.0 AzureRM.profile

3.7.0 AzureRM.Resources

OS Version

Windows 10
Windows 2012R2

Description

This works: Add-AzureRmAccount -EnvironmentName AzureUSGovernment

Then pretty much every other command fails like this:

PS C:\Users\peterb> Get-AzureRmResourceGroup
Get-AzureRmResourceGroup : Exception has been thrown by the target of an invocation.
At line:1 char:1
+ Get-AzureRmResourceGroup
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-AzureRmResourceGroup], TargetInvocationException
    + FullyQualifiedErrorId : System.Reflection.TargetInvocationException,Microsoft.Azure.Commands.ResourceManager.Cmd
   lets.Implementation.GetAzureResourceGroupCmdlet

Debug Output

Using $DebugPreference="Continue" or -Verbose or -Debug results in the same output

Script/Steps for Reproduction

Set-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy -Name Enabled -Value 1
Restart-Computer -Force

New session:

# confirm FIPS setting:
Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

# Login -- this works
Add-AzureRmAccount -EnvironmentName AzureUSGovernment

# Try any other AzureRM command
> Get-AzureRmResourceGroup
Get-AzureRmResourceGroup : Exception has been thrown by the target of an invocation.
At line:1 char:1
+ Get-AzureRmResourceGroup
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-AzureRmResourceGroup], TargetInvocationException
    + FullyQualifiedErrorId : System.Reflection.TargetInvocationException,Microsoft.Azure.Commands.ResourceManager.Cmd
   lets.Implementation.GetAzureResourceGroupCmdlet

[cormacpayne]

@pburkholder Hey Peter, thanks for filing this issue - we will look into this.

As a follow up, would you mind sending us the debug log you get when you run Get-AzureRmResourceGroup (or any of the failing cmdlets) in the session after you enable FIPS? You can get this log by setting $DebugPreference="Continue".

[markcowl]

@pburkholder Please also try this script to get the exact error details:

function Resolve-Error ($ErrorRecord=$Error[0])
{
   $ErrorRecord | Format-List * -Force
   $ErrorRecord.InvocationInfo |Format-List *
   $Exception = $ErrorRecord.Exception
   for ($i = 0; $Exception; $i++, ($Exception = $Exception.InnerException))
   {   "$i" * 80
       $Exception |Format-List * -Force
   }
}

Then simply execute ResolveError to get full exception details

[pburkholder]

Resolve-Error output follows. As noted in the original ticket, $DebugPreference="Continue" has no effect:

PSMessageDetails      : 
Exception             : System.Reflection.TargetInvocationException: Exception has been thrown by the target of an 
                        invocation. ---> System.InvalidOperationException: This implementation is not part of the 
                        Windows Platform FIPS validated cryptographic algorithms.
                           at System.Security.Cryptography.SHA256Managed..ctor()
                           --- End of inner exception stack trace ---
                           at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature 
                        sig, Boolean constructor)
                           at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, 
                        Object[] parameters, CultureInfo culture)
                           at System.Security.Cryptography.CryptoConfig.CreateFromName(String name, Object[] args)
                           at System.Security.Cryptography.SHA256.Create()
                           at Microsoft.WindowsAzure.Commands.Common.MetricHelper.GenerateSha256HashString(String 
                        originInput)
                           at Microsoft.Azure.Commands.ResourceManager.Common.AzureRMCmdlet.InitializeQosEvent()
                           at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.BeginProcessing()
                           at Microsoft.Azure.Commands.Profile.GetAzureRMSubscriptionCommand.BeginProcessing()
                           at System.Management.Automation.Cmdlet.DoBeginProcessing()
                           at System.Management.Automation.CommandProcessorBase.DoBegin()
TargetObject          : 
CategoryInfo          : NotSpecified: (:) [Get-AzureRmSubscription], TargetInvocationException
FullyQualifiedErrorId : System.Reflection.TargetInvocationException,Microsoft.Azure.Commands.Profile.GetAzureRMSubscrip
                        tionCommand
ErrorDetails          : 
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {}





MyCommand             : Get-AzureRmSubscription
BoundParameters       : {}
UnboundArguments      : {}
ScriptLineNumber      : 1
OffsetInLine          : 1
HistoryId             : 16
ScriptName            : 
Line                  : Get-AzureRmSubscription
PositionMessage       : At line:1 char:1
                        + Get-AzureRmSubscription
                        + ~~~~~~~~~~~~~~~~~~~~~~~
PSScriptRoot          : 
PSCommandPath         : 
InvocationName        : Get-AzureRmSubscription
PipelineLength        : 0
PipelinePosition      : 0
ExpectingInput        : False
CommandOrigin         : Internal
DisplayScriptPosition : 



00000000000000000000000000000000000000000000000000000000000000000000000000000000


Message        : Exception has been thrown by the target of an invocation.
Data           : {}
InnerException : System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS 
                 validated cryptographic algorithms.
                    at System.Security.Cryptography.SHA256Managed..ctor()
TargetSite     : System.Object InvokeMethod(System.Object, System.Object[], System.Signature, Boolean)
StackTrace     :    at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, 
                 Boolean constructor)
                    at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, 
                 Object[] parameters, CultureInfo culture)
                    at System.Security.Cryptography.CryptoConfig.CreateFromName(String name, Object[] args)
                    at System.Security.Cryptography.SHA256.Create()
                    at Microsoft.WindowsAzure.Commands.Common.MetricHelper.GenerateSha256HashString(String originInput)
                    at Microsoft.Azure.Commands.ResourceManager.Common.AzureRMCmdlet.InitializeQosEvent()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.BeginProcessing()
                    at Microsoft.Azure.Commands.Profile.GetAzureRMSubscriptionCommand.BeginProcessing()
                    at System.Management.Automation.Cmdlet.DoBeginProcessing()
                    at System.Management.Automation.CommandProcessorBase.DoBegin()
HelpLink       : 
Source         : mscorlib
HResult        : -2146232828



11111111111111111111111111111111111111111111111111111111111111111111111111111111


Message        : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
Data           : {}
InnerException : 
TargetSite     : Void .ctor()
StackTrace     :    at System.Security.Cryptography.SHA256Managed..ctor()
HelpLink       : 
Source         : mscorlib
HResult        : -2146233079

[pburkholder]

(That Resolve-Error function is super-useful! It's going in my $profile)

[markcowl]

@pburkholder Got it. This is related to client-side telemetry. Can you see if you can execute Disable-AzureRmDataCollection and if so, whether this fixes the issue?

If you can't run the cmdle, you can place a file that looks like this:

{"enableAzureDataCollection":false}

and place it here: %AppData%\Roaming\Windows Azure Powershell\AzureDataCollectionProfile.json

[markcowl]

@pburkholder On second thought, looking at the code, that isn't going to work, it looks like the hash is created regardless.

[pburkholder]

Ok. Thanks for digging in. We'll wait with bated breath....

[pburkholder]

Based on https://blogs.technet.microsoft.com/secguide/2014/04/07/why-were-not-recommending-fips-mode-anymore/ and the stack trace, can we change

https://github.com/Azure/azure-powershell/blob/master/src/Common/Commands.Common/MetricHelper.cs#L208

to use something other than SHA256Managed? Or do we then run into a slew of Md5 or SHA1 calls that just throw the same error?

[markcowl]

@pburkholder This is the only place that we use cryptographic functions directly in the common code, and there is a simple fix for this one (using Sha256CryptographicProvider directly, or using Sha256Cng).

But the issue is that this change has been shipping for about a year, so that it's possible that some other cmdlets have cropped up in that time that use other Cryptographic functions that are not FIPS compliant. To fix this properly, we would need to make FIPS compliance testing (or static analysis) part of our check-ins. Depending on the priority, a proper fix may have to wait in the near term.

We may be able to provide you with a version that fixes this issue to test in the near term, while we decide on the longer term fix.

[pburkholder]

I’ve discovered that I could not reproduce the FIPS error for AzureRM with Win10 Anniversary edition. This raises several questions:

1. Have enabled FIPS algorithms changed between Win2012R2 Win10 and Win2016/Win10Anniversary Edition?
2. If so, how can I find the documentation on what algorithms are available on each platform? And
3. Can the enabled algorithms be back-ported to Win2012R2/Win10?