Confidential Computing and FIPS compliance
Hi, Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention that it might be more common in the confidential computing solutions. As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I tend to believe it might also be a requirement by some of the confidential computing users. Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions: * Was FIPS compliance discussed/considered in the context of confidential computing? * Is it known already what crypto components are expected to be used? * I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to have limitations/requirements on what should be used? I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :) Regards, Snir. [1] https://en.wikipedia.org/wiki/FIPS_140-2 https://www.nist.gov/itl/current-fips [2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL... More not necessarily related info: BoringCryto- google's FIPS compliant lib: https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS... Allowed algorithms: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip...
On 30 Jun 2021, at 16:23, Snir <ssheribe@redhat.com> wrote:
Hi,
Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention that it might be more common in the confidential computing solutions. As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I tend to believe it might also be a requirement by some of the confidential computing users.
Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:
* Was FIPS compliance discussed/considered in the context of confidential computing?
Not that I recall
* Is it known already what crypto components are expected to be used?
The ones I heard mentioned are: - ocicrypt (https://github.com/containers/ocicrypt) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs) for attestation - LUKS for volumes - TLS / HTTPS when communicating from the container - ssh to talk to the container itself
* I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to have limitations/requirements on what should be used?
Not that I am aware of.
I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)
Regards, Snir.
[1] https://en.wikipedia.org/wiki/FIPS_140-2 https://www.nist.gov/itl/current-fips
[2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL...
More not necessarily related info:
BoringCryto- google's FIPS compliant lib: https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS...
Allowed algorithms: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip...
_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
+Connor FYI
On 30 Jun 2021, at 16:47, Christophe de Dinechin <cdupontd@redhat.com> wrote:
On 30 Jun 2021, at 16:23, Snir <ssheribe@redhat.com> wrote:
Hi,
Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention that it might be more common in the confidential computing solutions. As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I tend to believe it might also be a requirement by some of the confidential computing users.
Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:
* Was FIPS compliance discussed/considered in the context of confidential computing?
Not that I recall
* Is it known already what crypto components are expected to be used?
The ones I heard mentioned are:
- ocicrypt (https://github.com/containers/ocicrypt <https://github.com/containers/ocicrypt>) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs <https://github.com/containers/ocicrypt-rs>) for attestation - LUKS for volumes - TLS / HTTPS when communicating from the container - ssh to talk to the container itself
* I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to have limitations/requirements on what should be used?
Not that I am aware of.
I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)
Regards, Snir.
[1] https://en.wikipedia.org/wiki/FIPS_140-2 https://www.nist.gov/itl/current-fips
[2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL...
More not necessarily related info:
BoringCryto- google's FIPS compliant lib: https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS...
Allowed algorithms: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip...
_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
* Was FIPS compliance discussed/considered in the context of confidential computing? I haven’t been part of the confidential computing discussions, but we discussed having minimal FIPS support in the past - not in the context of confidential computing. What we ended up doing was to atleast the least make sure the guest is started in FIPS mode on detecting that the host is running in FIPS mode. https://github.com/kata-containers/kata-containers/commit/0bd41b9dbe691ed70f... Kernel support for FIPS was also added in the upstream kata kernel config. -Archana From: Christophe de Dinechin <cdupontd@redhat.com> Date: Wednesday, June 30, 2021 at 8:18 PM To: Snir <ssheribe@redhat.com>, Connor Kuehl <ckuehl@redhat.com> Cc: kata-dev <kata-dev@lists.katacontainers.io> Subject: Re: [kata-dev] Confidential Computing and FIPS compliance +Connor FYI On 30 Jun 2021, at 16:47, Christophe de Dinechin <cdupontd@redhat.com<mailto:cdupontd@redhat.com>> wrote: On 30 Jun 2021, at 16:23, Snir <ssheribe@redhat.com<mailto:ssheribe@redhat.com>> wrote: Hi, Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention that it might be more common in the confidential computing solutions. As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I tend to believe it might also be a requirement by some of the confidential computing users. Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions: * Was FIPS compliance discussed/considered in the context of confidential computing? Not that I recall * Is it known already what crypto components are expected to be used? The ones I heard mentioned are: - ocicrypt (https://github.com/containers/ocicrypt) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs) for attestation - LUKS for volumes - TLS / HTTPS when communicating from the container - ssh to talk to the container itself * I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to have limitations/requirements on what should be used? Not that I am aware of. I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :) Regards, Snir. [1] https://en.wikipedia.org/wiki/FIPS_140-2 https://www.nist.gov/itl/current-fips [2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL... More not necessarily related info: BoringCryto- google's FIPS compliant lib: https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS... Allowed algorithms: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fip... _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
Archana,
* Was FIPS compliance discussed/considered in the context of confidential computing?
I haven’t been part of the confidential computing discussions, but we discussed having minimal FIPS support in the past - not in the context of confidential computing. What we ended up doing was to atleast the least make sure the guest is started in FIPS mode on detecting that the host is running in FIPS mode.
And this works. Snir had to do some workaround in order to use the dracut-fips modules when generating the guest initrd (when the host is running on FIPS mode) ...
https://github.com/kata-containers/kata-containers/commit/0bd41b9dbe691ed70f... Kernel support for FIPS was also added in the upstream kata kernel config.
... but generally speaking the work done on kata-containers was solid. \o/ However, with this whole new world of vendored code I brought to Snir's attention that we should be careful on what we're (maybe blindly) vendoring, as if whatever we vendor ends up implementing their own crypto algorithms we may violate FIPS on our side. So, it's more a head's up that we should be paying attention to what we'll use and a request for help on ensuring that whatever we use, we check before whether it'd break FIPS compliance. Not related to this email, but still related to this thread (especially to Christophe's answer), ocicrypt and ocicrypt-rs should be properly evaluated. And I think we may encounter more cases as we progress with the implementation of the confidential effort. Best Regards, -- Fabiano Fidêncio
participants (4)
-
Christophe de Dinechin
-
Fabiano Fidêncio
-
Shinde, Archana M
-
Snir