<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:Helvetica;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
        {mso-style-name:msonormal;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:11.0pt;
        font-family:"Calibri",sans-serif;}
span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:"Calibri",sans-serif;
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica">* Was FIPS compliance discussed/considered in the context of confidential computing?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">I haven’t been part of the confidential computing discussions, but we discussed having minimal FIPS support in the past - not in the context of confidential computing. What we ended up doing was to atleast
 the least make sure the guest is started in FIPS mode on detecting that the host is running in FIPS mode.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><a href="https://github.com/kata-containers/kata-containers/commit/0bd41b9dbe691ed70fa8769089a4a8795a5d54c9">https://github.com/kata-containers/kata-containers/commit/0bd41b9dbe691ed70fa8769089a4a8795a5d54c9</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">Kernel support for FIPS was also added in the upstream kata kernel config.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">-Archana <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Christophe de Dinechin <cdupontd@redhat.com><br>
<b>Date: </b>Wednesday, June 30, 2021 at 8:18 PM<br>
<b>To: </b>Snir <ssheribe@redhat.com>, Connor Kuehl <ckuehl@redhat.com><br>
<b>Cc: </b>kata-dev <kata-dev@lists.katacontainers.io><br>
<b>Subject: </b>Re: [kata-dev] Confidential Computing and FIPS compliance<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">+Connor FYI<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 30 Jun 2021, at 16:47, Christophe de Dinechin <<a href="mailto:cdupontd@redhat.com">cdupontd@redhat.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
<br style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<br>
</span><o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica">On 30 Jun 2021, at 16:23, Snir <<a href="mailto:ssheribe@redhat.com">ssheribe@redhat.com</a>> wrote:<br>
<br>
Hi,<br>
<br>
<br>
Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently<br>
it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention<br>
that it might be more common in the confidential computing solutions.<br>
As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I<br>
tend to believe it might also be a requirement by some of the confidential computing users.<br>
<br>
Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:<br>
<br>
* Was FIPS compliance discussed/considered in the context of confidential computing?<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
Not that I recall<br>
<br style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<br>
</span><o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
* Is it known already what crypto components are expected to be used?<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
The ones I heard mentioned are:<br>
<br>
- ocicrypt (</span><a href="https://github.com/containers/ocicrypt"><span style="font-size:13.5pt;font-family:Helvetica">https://github.com/containers/ocicrypt</span></a><span style="font-size:13.5pt;font-family:Helvetica">) and ocicrypt-rs (</span><a href="https://github.com/containers/ocicrypt-rs"><span style="font-size:13.5pt;font-family:Helvetica">https://github.com/containers/ocicrypt-rs</span></a><span style="font-size:13.5pt;font-family:Helvetica">)
 for attestation<br>
- LUKS for volumes<br>
- TLS / HTTPS when communicating from the container<br>
- ssh to talk to the container itself<br>
<br>
<br style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<br>
</span><o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
* I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library<br>
  cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to<br>
  have limitations/requirements on what should be used?<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
Not that I am aware of.<br>
<br style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<br>
</span><o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"><br>
I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)<br>
<br>
Regards,<br>
Snir.<br>
<br>
[1] <a href="https://en.wikipedia.org/wiki/FIPS_140-2">https://en.wikipedia.org/wiki/FIPS_140-2</a><br>
    <a href="https://www.nist.gov/itl/current-fips">https://www.nist.gov/itl/current-fips</a><br>
<br>
[2] <a href="https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35">
https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35</a><br>
<br>
<br>
More not necessarily related info:<br>
<br>
BoringCryto- google's FIPS compliant lib:<br>
<a href="https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md">https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md</a><br>
<br>
Allowed algorithms:<br>
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf<br>
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexb.pdf<br>
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexc.pdf<br>
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexd.pdf<br>
<br>
<br>
<br>
_______________________________________________<br>
kata-dev mailing list<br>
kata-dev@lists.katacontainers.io<br>
http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev<o:p></o:p></span></p>
</blockquote>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
</div>
</body>
</html>