This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms

[jcallen1234]

When running a Get-KeePassEntry command and entering the database password I get the following error.

New-Object : Exception calling ".ctor" with "1" argument(s): "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms."
At C:\Program Files\WindowsPowerShell\Modules\PoShKeePass\internal\New-KPConnection.ps1:95 char:39
+ ... AddUserKey((New-Object KeepassLib.Keys.KcpPassword([System.Runtime.In ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [New-Object], MethodInvocationException
    + FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand

Exception calling "Open" with "3" argument(s): "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms."
At C:\Program Files\WindowsPowerShell\Modules\PoShKeePass\internal\New-KPConnection.ps1:123 char:9
+         $null = $DatabaseObject.Open($IOInfo, $CompositeKey, $IStatus ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : InvalidOperationException

InvalidDatabaseConnectionException : The database is not open.
At C:\Program Files\WindowsPowerShell\Modules\PoShKeePass\internal\New-KPConnection.ps1:128 char:13
+             Throw 'InvalidDatabaseConnectionException : The database  ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (InvalidDatabase...se is not open.:String) [], RuntimeException
    + FullyQualifiedErrorId : InvalidDatabaseConnectionException : The database is not open.

[jkdba]

@jcallen1234 thanks for reaching out, can you please provide the following details:

1. Powershell Version
2. PoShKeePass Version
3. What Method do you use to authenticate to keepass? master password, master password and key file, master password and network account, etc
4. Was this ever working and it stopped? If so what changed since it stopped working?

[jcallen1234]

C:\Program Files\WindowsPowerShell\Modules> $PSVersionTable Name Value ---- ----- PSVersion 5.1.14393.3053 PSEdition Desktop PSCompatibleVersions {1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.3053} BuildVersion 10.0.14393.3053 CLRVersion 4.0.30319.42000 WSManStackVersion 3.0 PSRemotingProtocolVersion 2.3 SerializationVersion 1.1.0.1 v.2.1.3.0 master password and key file First time using the module. @jcallen1234<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fjcallen1234&data=02%7C01%7Cjason.allen%40sba.gov%7Ca612ed8c1eaa4ff98fe108d73d3949f4%7C3c89fd8a7f684667aa1541ebf2208961%7C1%7C0%7C637045188563299801&sdata=9dbL20THHAu8Qx9bVJZxdtBM1DOQP6uSFgxVtrwBTSc%3D&reserved=0> thanks for reaching out, can you please provide the following details: 1. Powershell Version 2. PoShKeePass Version 3. What Method do you use to authenticate to keepass? master password, master password and key file, master password and network account, etc 4. Was this ever working and it stopped? If so what changed since it stopped working? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FPSKeePass%2FPoShKeePass%2Fissues%2F171%3Femail_source%3Dnotifications%26email_token%3DAJIKIUOKYHSSDX6DVHXZ353QKPITXA5CNFSM4IYPGIQ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7ES7KY%23issuecomment-533278635&data=02%7C01%7Cjason.allen%40sba.gov%7Ca612ed8c1eaa4ff98fe108d73d3949f4%7C3c89fd8a7f684667aa1541ebf2208961%7C1%7C0%7C637045188563299801&sdata=kFoS86DoAYXEaI0R69oQpuVOFxf16wVVO2I%2F%2FGsmmOM%3D&reserved=0>, or mute the thread<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAJIKIUNWKSAHKZU3FBZY3O3QKPITXANCNFSM4IYPGIQQ&data=02%7C01%7Cjason.allen%40sba.gov%7Ca612ed8c1eaa4ff98fe108d73d3949f4%7C3c89fd8a7f684667aa1541ebf2208961%7C1%7C0%7C637045188563309794&sdata=6gMDa1icGnPM9Ix47FCVrRk0DbzRqMmpQ07FRl%2FQECw%3D&reserved=0>.

[jkdba]

As discussed this appears to happen when FIPS is enabled in windows.

From Initial testing it appears the keepass gui can deal with fips, will need to investigate how this is done and see if it can be replicated in the module's connection functions

[PatrickOnGit]

See the following article about FIPS compliancy in Windows:
why we're not recommending "fips-mode" anymore (as security default)

Specifically see the section "Why FIPS mode is particularly onerous"

Bottom line, the application itself needs to check if fips compliancy is enabled and if so it either choose algorithms supported within this mode or implement its own library.

[isopodshuffle]

Is there a workaround available for this? I'm getting the same error (Windows 10 version 1909, Powershell v5.1, PoshKeePass v2.1.3.0). Unfortunately disabling FIPS mode isn't an option, as it's set by group policy and I don't have the ability to change that.

I've tried setting up the database configuration three different ways (password, windows user, and key file), and also tried both Database File Encryption Algorithm options, but no luck

[ryanmahoney96]

Is there a workaround available for this? I'm getting the same error (Windows 10 version 1909, Powershell v5.1, PoshKeePass v2.1.3.0). Unfortunately disabling FIPS mode isn't an option, as it's set by group policy and I don't have the ability to change that.

I've tried setting up the database configuration three different ways (password, windows user, and key file), and also tried both Database File Encryption Algorithm options, but no luck

Bumping this, is there any workaround available?

[veemun]

Would really be nice to have this work in FIPS mode. We are required to have our machines in FIPS mode.

Edit: So I"ve just tried this is powershell 7 instead of 5 and it seems to work as expected there. Recommend updating to PS7 since we probably won't see a backported fix from Microsoft