search

DataDog / saluki

An experimental toolkit for building telemetry data planes in Rust.
Apache License 2.0
12 stars 2 forks source link

Consider if we should always enforce/check for FIPS compliance during TLS initialization. #183

Open tobz opened 1 month ago

tobz commented 1 month ago

Presently, we utilize rustls, with its default cryptography provider, AWS-LC, as a pathway to generating FIPS-compliant ADP binaries. While FIPS is not currently enabled by default, it is likely that we will want to do so in the future to avoid issues around FIPS-vs-not-FIPS builds.

However, enabling FIPS support boils down to enabling a specific set of feature flags on related crates, which is opaque and doesn't lend itself well to asserting that a build was built in FIPS mode.

We should consider what it might take to check for FIPS mode at runtime, such that we could ensure that startup terminated if we detected that we were not in FIPS mode. This would also require analyzing if always running in FIPS mode would be sufficient/harmful to users when FIPS compliance wasn't actually necessary.

tobz commented 3 weeks ago

We're actually checking (or will be checking, rather) for FIPS mode as part of #205.

That PR doesn't fully address this issue, though, around investigating if always using FIPS mode is harming use cases that don't need FIPS compliance.