Open Stack

+Connor FYI

> On 30 Jun 2021, at 16:47, Christophe de Dinechin <cdupontd at redhat.com> wrote:
> 
> 
> 
>> On 30 Jun 2021, at 16:23, Snir <ssheribe at redhat.com> wrote:
>> 
>> Hi,
>> 
>> 
>> Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently
>> it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention
>> that it might be more common in the confidential computing solutions.
>> As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I
>> tend to believe it might also be a requirement by some of the confidential computing users.
>> 
>> Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:
>> 
>> * Was FIPS compliance discussed/considered in the context of confidential computing?
> 
> Not that I recall
> 
>> 
>> * Is it known already what crypto components are expected to be used?
> 
> The ones I heard mentioned are:
> 
> - ocicrypt (https://github.com/containers/ocicrypt <https://github.com/containers/ocicrypt>) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs <https://github.com/containers/ocicrypt-rs>) for attestation
> - LUKS for volumes
> - TLS / HTTPS when communicating from the container
> - ssh to talk to the container itself
> 
> 
>> 
>> * I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library
>>   cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to
>>   have limitations/requirements on what should be used?
> 
> Not that I am aware of.
> 
>> 
>> I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)
>> 
>> Regards,
>> Snir.
>> 
>> [1] https://en.wikipedia.org/wiki/FIPS_140-2
>>     https://www.nist.gov/itl/current-fips
>> 
>> [2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35
>> 
>> 
>> More not necessarily related info:
>> 
>> BoringCryto- google's FIPS compliant lib:
>> https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md
>> 
>> Allowed algorithms:
>> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf
>> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexb.pdf
>> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexc.pdf
>> https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexd.pdf
>> 
>> 
>> 
>> _______________________________________________
>> kata-dev mailing list
>> kata-dev at lists.katacontainers.io
>> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210630/99590192/attachment-0001.html>