Open Stack

Hi,


Recently I’ve started investigating the requirement for FIPS [1] 
compliance with kata containers, currently
it doesn’t seem there's much cryptography happening in Kata, however, it 
was brought to my attention
that it might be more common in the confidential computing solutions.
As the requirement for FIPS compliance is sometimes correlated to 
dealing with sensitive information I
tend to believe it might also be a requirement by some of the 
confidential computing users.

Since I’m jumping a bit late on the confidential computing train \o/ I’d 
like to ask some newbie questions:

  * Was FIPS compliance discussed/considered in the context of 
confidential computing?

  * Is it known already what crypto components are expected to be used?

  * I saw it’s planned to re-implement the ocicrypt library in Rust[2], 
AFAIU Rust doesn’t have standard library
    cryptography, hence, i assume it will count on all sorts of other 
crypto dependencies, is there any plan to
    have limitations/requirements on what should be used?

I'm not a FIPS nor crypto expert, however I'd be glad to help or provide 
more info if required :)

Regards,
Snir.

[1] https://en.wikipedia.org/wiki/FIPS_140-2
      https://www.nist.gov/itl/current-fips

[2] 
https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35


More not necessarily related info:

BoringCryto- google's FIPS compliant lib:
https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md

Allowed algorithms:
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexb.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexc.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexd.pdf