Open Stack

> On 30 Jun 2021, at 16:23, Snir <ssheribe at redhat.com> wrote:
> 
> Hi,
> 
> 
> Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently
> it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention
> that it might be more common in the confidential computing solutions.
> As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I
> tend to believe it might also be a requirement by some of the confidential computing users.
> 
> Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:
> 
>  * Was FIPS compliance discussed/considered in the context of confidential computing?

Not that I recall

> 
>  * Is it known already what crypto components are expected to be used?

The ones I heard mentioned are:

- ocicrypt (https://github.com/containers/ocicrypt) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs) for attestation
- LUKS for volumes
- TLS / HTTPS when communicating from the container
- ssh to talk to the container itself


> 
>  * I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library
>    cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to
>    have limitations/requirements on what should be used?

Not that I am aware of.

> 
> I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)
> 
> Regards,
> Snir.
> 
> [1] https://en.wikipedia.org/wiki/FIPS_140-2
>      https://www.nist.gov/itl/current-fips
> 
> [2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35
> 
> 
> More not necessarily related info:
> 
> BoringCryto- google's FIPS compliant lib:
> https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md
> 
> Allowed algorithms:
> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf
> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexb.pdf
> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexc.pdf
> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexd.pdf
> 
> 
> 
> _______________________________________________
> kata-dev mailing list
> kata-dev at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev