Open Stack

* Was FIPS compliance discussed/considered in the context of confidential computing?

I haven’t been part of the confidential computing discussions, but we discussed having minimal FIPS support in the past - not in the context of confidential computing. What we ended up doing was to atleast the least make sure the guest is started in FIPS mode on detecting that the host is running in FIPS mode.
https://github.com/kata-containers/kata-containers/commit/0bd41b9dbe691ed70fa8769089a4a8795a5d54c9
Kernel support for FIPS was also added in the upstream kata kernel config.

-Archana

From: Christophe de Dinechin <cdupontd at redhat.com>
Date: Wednesday, June 30, 2021 at 8:18 PM
To: Snir <ssheribe at redhat.com>, Connor Kuehl <ckuehl at redhat.com>
Cc: kata-dev <kata-dev at lists.katacontainers.io>
Subject: Re: [kata-dev] Confidential Computing and FIPS compliance

+Connor FYI


On 30 Jun 2021, at 16:47, Christophe de Dinechin <cdupontd at redhat.com<mailto:cdupontd at redhat.com>> wrote:




On 30 Jun 2021, at 16:23, Snir <ssheribe at redhat.com<mailto:ssheribe at redhat.com>> wrote:

Hi,


Recently I’ve started investigating the requirement for FIPS [1] compliance with kata containers, currently
it doesn’t seem there's much cryptography happening in Kata, however, it was brought to my attention
that it might be more common in the confidential computing solutions.
As the requirement for FIPS compliance is sometimes correlated to dealing with sensitive information I
tend to believe it might also be a requirement by some of the confidential computing users.

Since I’m jumping a bit late on the confidential computing train \o/ I’d like to ask some newbie questions:

* Was FIPS compliance discussed/considered in the context of confidential computing?

Not that I recall



* Is it known already what crypto components are expected to be used?

The ones I heard mentioned are:

- ocicrypt (https://github.com/containers/ocicrypt) and ocicrypt-rs (https://github.com/containers/ocicrypt-rs) for attestation
- LUKS for volumes
- TLS / HTTPS when communicating from the container
- ssh to talk to the container itself




* I saw it’s planned to re-implement the ocicrypt library in Rust[2], AFAIU Rust doesn’t have standard library
  cryptography, hence, i assume it will count on all sorts of other crypto dependencies, is there any plan to
  have limitations/requirements on what should be used?

Not that I am aware of.



I'm not a FIPS nor crypto expert, however I'd be glad to help or provide more info if required :)

Regards,
Snir.

[1] https://en.wikipedia.org/wiki/FIPS_140-2
    https://www.nist.gov/itl/current-fips

[2] https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#heading=h.ap8sog36kw35


More not necessarily related info:

BoringCryto- google's FIPS compliant lib:
https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md

Allowed algorithms:
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexb.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexc.pdf
https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexd.pdf



_______________________________________________
kata-dev mailing list
kata-dev at lists.katacontainers.io
http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210630/b73e6b31/attachment.html>